Reports & recommendations

The operator should be required by regulation to submit to the regulatory body a Safety Case in respect of each of its installations. The regulation should be analogous to Reg 7 of the CIMAH Regulations, subject to recommendations 2–13 (paras 17.33-43).

The Safety Case should demonstrate that certain objectives have been met, including the following:- (i) that the safety management system of the company (SMS) and that of the installation are adequate to ensure that (a) the design and (b) the operation of the installation and its equipment are safe (paras 17.36 and 21.56-57); (ii) that the potential major hazards of the installation and the risks to personnel thereon have been identified and appropriate controls provided (para 17.37); and (iii) that adequate provision is made for ensuring, in the event of a major emergency affecting the installation (a) a Temporary Safe Refuge (TSR) for personnel on the installation; and (b) their safe and full evacuation, escape and rescue (paras 17.37-38, 19.109, 19.157 and 20.8).

The SMS should be in respect of (a) the design (both conceptual and detailed) of the operator’s installations; and (b) the procedures (both operational and emergency) of those installations. In the case of existing installations the SMS in respect of design should be directed to its review and upgrading so far as that is reasonably practicable (para 21.56). The SMS should set out the safety objectives, the system by which these objectives are to be achieved, the performance standards which are to be met and the means by which adherence to these standards is to be monitored (para 21.56). It should draw on quality assurance principles similar to those stated in BS 5750 and ISO 9000 (para 21.58).

In furtherance of the objectives set out in para 2 above, the operator should be required to set out the following in the Safety Case:- (i) A demonstration that so far as is reasonably practicable hazards arising from the inventory of hydrocarbons (a) on the installation, and (b) in risers and pipelines connected to the installation both in themselves and as components of the total system of which they form part have been minimised (paras 19.17 and 19.20). (ii) A demonstration that so far as is reasonably practicable the exposure of personnel on the platform to accidental events and their consequences has been minimised (para 17.37). (iii) A demonstration by quantified risk assessment of major hazards that the acceptance standards have been met in respect of risk to the integrity of the TSR, escape routes, embarkation points and lifeboats from design accidental events and that all reasonably practicable steps have been taken to ensure the safety of persons in the TSR and using escape routes and embarkation points (paras 17.38 and 19.157). (iv) A demonstration that within the TSR there are facilities as specified by the operator which are adequate for the purpose of control of an emergency (para 19.182). (v) A fire risk analysis, in accordance with recommendation 49 below (para 19.90). (vi) An evacuation, escape and rescue analysis, in accordance with recommendations 73-75 below (para 20.9).

For the purposes of the demonstration referred to in para (iii) of recommendation 4, the accidental events are to be identified by the operator. A design accidental event is an event which will not cause the loss of any of the following:- — the integrity of the TSR, — the passability of at least one escape route from each location on the platform, — the integrity of a minimum complement of embarkation points and lifeboats specified for personnel in the TSR, and — the passability of at least one escape route to each of these embarkation points, within the endurance period specified. Events more severe than this are referred to as residual accidental events (para 19.160). The acceptance standards for risk and endurance time should be set before the submission of the Safety Case. Standards should be set by reference to the ALARP principle. For the time being it should be the regulatory body which sets these standards. The operator should define the conditions which constitute loss of integrity of, and the standards of protection for, the TSR and escape routes to the TSR and from the TSR to the embarkation points; and should specify the minimum complement of embarkation points and lifeboats for the TSR (paras 19.158-159).

The TSR should normally be the accommodation (paras 19.156 and 19.161). In the case of existing installations any requirement for the upgrading of the accommodation, escape routes and embarkation points should be determined on the basis of the Safety Case (para 19.165).

In connection with the above the Safety Case should specify the following:- In respect of the TSR- — its function — the conditions which constitute its integrity — the conditions for integrity of its supporting structure — the events in which and the period for which it is to maintain its integrity (paras 19.157-158). In respect of escape routes to the TSR and from the TSR to the embarkation points- — the conditions which constitute their passability — the conditions for integrity of their supporting structure — the events in which and the periods for which they are to maintain their passability (provided that for each location on the platform there should be a minimum of two escape routes to the TSR, at least one of which should remain passable for the period) (para 19.164). In respect of embarkation points and lifeboats- — the number and location — the conditions for their integrity and that of their supporting structure — the events in which and the periods for which they are to maintain their integrity — the minimum complement for the TSR (para 19.164).

No fixed installation should be established or maintained in controlled waters; and no mobile installation should be brought into those waters with a view to its being stationed there or maintained in those waters unless a Safety Case in respect of that installation has been submitted to and accepted by the regulatory body (para 17.41).

As regards existing installations the date for submission of the Safety Case should be laid down by regulation. There is an urgent need for the submission of Safety Cases, but the date should be selected by the regulatory body. The regulatory body should have the power, in the event of the failure of an operator to submit an acceptable Safety Case, to require the operator to take whatever remedial action it considered necessary, including requiring the installation to be shut down (paras 17.44-45).

A Safety Case should be updated:- (i) After a period of years from its last assessment (not less than 3, not more than 5, years). (ii) At the discretion of the regulatory body on the ground of a material change of circumstances, such as a change of operator, the occurrence of a major emergency (including one in which there is a precautionary evacuation), a major technological innovation or the discovery or better understanding of a major hazard. However, provision should be made in order to avoid the need for more than one Safety Case to be updated by an operator at the same time; and to enable the regulatory body to postpone the automatic updating where it has recently required a discretionary updating (para 17.46).

As regards modifications to installations or their equipment or procedures, the operator should, before putting the modification into effect, ascertain what effect, if any, it has on the relevant components of the Safety Case. An operator should be required to report to the regulatory body all intended modifications which meet criteria set by the regulatory body, with a view to discussing with the regulatory body whether and to what extent a review of the Safety Case is required (para 17.47).

For the time being the acceptance by the regulatory body of Safety Cases should not be regarded as justifying the revocation of regulations or the withdrawal of guidance notes (para 17.67). Where an operator proposes to meet the objectives of a Safety Case by means which are not in accordance with regulations or guidance notes the justification for such a course should be set out in the Safety Case. For the assistance of operators the regulatory body should publish as soon as possible, and thereafter update in the light of experience, a list of the individual regulations relating to an installation and its equipment in respect of which it is prepared to grant exemption in the light of a satisfactory demonstration in a Safety Case; and to do likewise in regard to guidance notes (para 17.67). In due course the existing regulations of a detailed prescriptive nature should be reviewed with a view to their revocation or replacement by regulations which set objectives. However, it is anticipated that there will continue to be even in the long term a case for some detailed prescriptive regulations (paras 17.63, 17.67 and 21.67).

The regulatory body should discuss with the industry whether it is desirable and practicable that at the stage of the application for Annex B consent (or its equivalent) there should be a procedure for submission by operators of a preliminary assessment of matters relevant to a Safety Case and for the acceptance of this assessment being a prerequisite for the granting of Annex B consent (para 17.43).

The regulatory body should be required regularly to review the operator’s audit on a selective basis; and itself to carry out such further audit as it thinks fit; and by regular inspection verify that the output of the SMS is satisfactory (para 21.60).

The regulatory body should consider (i) after the introduction of requirements for the demonstration of SMS and auditing of compliance with it; and (ii) after experience in the operation and effectiveness of such requirements whether and to what extent it will be appropriate to retain the present system of certification (para 21.64).

(i) The principal regulations in regard to offshore safety should take the form of requiring that stated objectives are to be met (referred to as “goal-setting regulations”) rather than prescribing that detailed measures are to be taken (para 21.67). (ii) In relation to goal-setting regulations, guidance notes should give non-mandatory advice on one or more methods of achieving such objectives without prescribing any particular method as a minimum or as the measure to be taken in default of an acceptable alternative (para 21.67). (iii) However, there will be a continuing need for some regulations which prescribe detailed measures (para 21.67).

The provisions of the Mineral Workings (Offshore Installations) Act 1971 and the Petroleum and Submarine Pipe-lines Act 1975 which have the same general purposes as those of Part 1 of the Health and Safety at Work etc Act 1974 (HSWA), and the regulations made under such provisions, should be made relevant statutory provisions for the purposes of the HSWA (para 21.68).

The Construction and Survey Regulations, the Fire Fighting Equipment Regulations, the Life-Saving Appliances Regulations and the Emergency Procedures Regulations should be revoked and replaced by- (i) Construction Regulations, covering inter alia the structure and layout of the installation and its accommodation. (ii) Plant and Equipment Regulations, covering inter alia plant and equipment on the installation and in particular those handling hydrocarbons. (iii) Fire and Explosion Protection Regulations, covering inter alia both active and passive fire protection and explosion protection, and (iv) Evacuation, Escape and Rescue Regulations, covering inter alia emergency procedures, life-saving appliances, evacuation, escape and rescue. Each of the above sets of regulations should include goal-setting regulations as their main or primary provisions and should be supported by guidance notes giving advice which is non-mandatory in the sense set out in paragraph (ii) of recommendation 17 (para 21.69).

Operators should be encouraged to specify the standards which they will use to comply with goal-setting regulations. For a given installation compliance may be demonstrated by reference to such standards, the terms of guidance notes and what is shown by a safety assessment or a combination of one or more of such methods (paras 17.66 and 21.70).

As regards existing guidance notes the regulatory body should consider whether and to what extent they should be treated without replacement or modification as giving non-mandatory advice in the sense set out in paragraph (ii) of recommendation 17; and should inform the industry accordingly (para 21.71).

In connection with the preparation of guidance notes the regulatory body should review the procedures for consultation so as to ensure that the views of the representatives of employers and employees involved in work offshore are adequately taken into account (para 21.72).

The single regulatory body should discharge the safety functions in relation to fire-fighting equipment and life-saving appliances. As regards standby vessels it should discharge all functions, whether directly or through the agency of the Department of Transport (DoT), save those which relate to the statutory responsibility of the DoT under the Merchant Shipping Acts (paras 21.65-66).

The functions of the Petroleum Engineering Division of the Department of Energy (DEn) which are concerned with the regulation of offshore safety should in future be discharged by a discrete division of the Health and Safety Executive (HSE) which is exclusively devoted to offshore safety (paras 22.34 and 22.37).

This division should employ a specialist inspectorate and have a clear identity and strong influence in the HSE. It should be headed by a chief executive who should be responsible directly to the Director General of the HSE and should be a member of its senior management board. His function would include the development of the offshore safety regime, and in particular the implementation of its provisions for Safety Cases and SMS (para 22.37).

Standardisation of the permit to work system throughout the industry is neither necessary nor practicable. However, in view of the fact that there is much in common between the systems of different operators, the industry should seek to increase harmonisation, for example in the colours used for different types of permits to work and in the rules as to the period for which a permit to work remains valid (para 18.28).

While it is not inappropriate for contractors’ supervisors to act as Performing Authorities, operators should be made responsible for ensuring that such supervisors are trained in the permit to work system for the installation where they are to act as Performing Authorities and that they carry documentary proof of having completed such training (para 18.29).

Copies of all issued permits to work should be displayed at a convenient location and in a systematic arrangement such that process operating staff can readily see and check which equipment is under maintenance and not available for operation (para 18.8).

The regulatory body should be responsible for maintaining a database with regard to hydrocarbon leaks, spills and ignitions in the industry and for the benefit of the industry. The regulatory body should:- (i) discuss and agree with the industry the method of collection and use of the data, (ii) regularly assess the data to determine the existence of any trends and report them to the industry, and (iii) provide operators with a means of obtaining access to the data, particularly for the purpose of carrying out quantified risk assessment (para 18.43).

The Emergency Pipe-line Valve Regulations should continue in force until they are subsumed in the Plant and Equipment Regulations. The provision in these regulations for there to be on each riser a valve with full emergency shutdown capability and located as close to sea level as practicable is endorsed (paras 19.34-35).

There should be no immediate requirement that a subsea isolation valve (SSIV) be fitted on a pipeline connected to an installation. The operator should demonstrate in the Safety Case that adequate provision has been made, including if necessary the use of SSIVs, against hazards from risers and pipelines (para 19.36).

Studies should be carried out with the following objectives:- (i) To explore the feasibility of dumping in an emergency large oil inventories, such as those in the separators, in a safe and environmentally acceptable manner, so as to minimise the inventory of fuel available to feed a fire (para 19.19). (ii) To minimise the pipeline connections to platforms (para 19.21).

Studies should be carried out with the following objectives:- (i) To achieve effective passive fire protection of risers without aggravating corrosion (para 19.22). (ii) To improve the reliability and reduce the cost of SSIVs so that it is more often reasonably practicable to install them (para 19.37).

The regulations and related guidance notes should promote an approach to fire and explosion protection:- (i) which is integrated as between - — active and passive fire protection — different forms of passive fire protection, such as fire insulation and platform layout, and — fire protection and explosion protection (paras 19.87-95); (ii) in which the need for, and the location and resistance of, fire and blast walls is determined by safety assessment rather than by regulations (para 19.96); (iii) in which the function, configuration, capacity, availability and protection of the fire water deluge system is determined by safety assessment rather than by regulations (paras 19.97 and 19.99); (iv) which facilitates the use of a scenario-based design method for fire protection as an alternative to the reference area method (paras 19.91 and 19.98); and (v) which provides to a high degree the ability of the fire water deluge system, including the fire pump system, to survive severe accident conditions (para 19.100).

The regulatory body should work with the industry to obtain agreement on the interpretation for design purposes of its interim hydrocarbon fire test and other similar tests. If in the view of the regulatory body there exists a need for an improved test, such as a heat flux test, it should work with the industry in order to develop one (para 19.101).

The regulations and the related guidance notes should promote an approach to protection of the accommodation:- (i) in which external fire protection is provided both to prevent breach of the accommodation and to maintain breathable air within it (para 19.170); and (ii) in which an integrated set of active and passive measures is provided to prevent ingress of smoke and other contaminants into the accommodation and to maintain breathable air within it (paras 19.170-171).

For the purpose of maintaining breathable air within the accommodation, it should be required by regulation that the ventilation air intakes should be provided with smoke and gas detectors and that on smoke or gas alarm the ventilation and dampers should shut down (para 19.172).

The regulations and related guidance notes on escape routes should recognise that it may not be practicable to protect escape routes against all physical conditions; and accordingly should be based on the objective that they should remain passable (para 19.174).

The regulatory body should ask operators which have not already done so to carry out forthwith an assessment of the risk of ingress of smoke or gas into the accommodation; and to fit smoke and gas detectors and implement ventilation shutdown arrangements as in recommendation 57, without waiting for legislation (para 19.173).

It should be required by regulation that there should be available within the TSR certain minimum specified facilities for the monitoring and control of an emergency under hostile outside conditions (paras 19.178 and 19.182). These facilities should be in the Control Room, which should be located in the TSR (para 19.179). On existing installations where the Control Room is not in the TSR, these facilities should be in an Emergency Control Centre located in the TSR. In such a case the Control Room should be protected against fire and explosion as determined by safety assessment (paras 19.180-181).

It should be required by regulation that a Radio Room with facilities for external communications should be located in the TSR (para 19.179). On existing installations where the Radio Room is not in the TSR, these facilities should be in an Emergency Radio Room located in the TSR (para 19.180).

The regulations and related guidance notes should promote an approach to emergency systems:- (i) which provides to a high degree the ability of these systems to survive severe accident conditions (paras 19.188-189); and (ii) which applies to communications systems the fail-safe principle (para 19.193). The emergency systems include the emergency power supplies and systems, the emergency shutdown system and the emergency communications systems. Severe accident conditions include fire, explosion and strong vibration (para 19.188).

Operators should be required by regulation regularly to review pipeline emergency procedures and manuals. The review should ensure that the information contained in manuals is correct, that the procedures contained are agreed with those who are responsible for executing them and are consistent with the procedures of installations connected by hydrocarbon pipelines (para 19.196).

Operators should be required by regulation to institute and review regularly a procedure for shutting down production on an installation in the event of an emergency on another installation which is connected to the first by a hydrocarbon pipeline where the emergency is liable to be exacerbated by continuation of such production (para 19.197).

The analysis should specify the facilities and other arrangements which would be available for the evacuation, escape and rescue of personnel in the event of an emergency which makes it necessary or advisable in the interests of safety for personnel to leave the installation (para 20.9).

In particular the analysis should specify:- (i) The formal command structure for the control of an emergency affecting the installation; (ii) The likely availability and capacity of helicopters, whether in-field or otherwise, for the evacuation of personnel; (iii) The types, numbers, locations and accessibility of totally enclosed motor propelled survival craft (TEMPSC) available for the evacuation of personnel from (a) the TSR and (b) other parts of the installation from which access to the TSR is not readily available; (iv) The types, numbers and locations of life rafts and other facilities provided as means of escape to the sea; (v) The specification (including speed, sea capability and accommodation), location and functions of the standby vessel and other vessels available for the rescue of personnel; (vi) The types, numbers, locations and availability of fast rescue craft, whether stationed on the installation or on the standby or other vessels; and (vii) The types, numbers and locations of personal survival and escape equipment. (All in para 20.9).

The regulatory body should ask operators which have not already done so to undertake an evacuation, escape and rescue analysis forthwith, without waiting for legislation. The timetable for completion of this analysis should be agreed between the regulatory body and the industry but should not exceed a total of 12 months, and that only for operators of a large number of installations (para 20.9).

Operators should adopt a flight following system for determining at short notice the availability and capacity of helicopters in the event of an emergency. This system could be either a system operated by the individual operator or a North Sea-wide system (para 20.11).

The requirement by regulation that each installation should be provided with TEMPSC having in the aggregate sufficient capacity to accommodate safely on board 150% of the number of persons on the installation should be maintained (para 20.16). Such provision should include TEMPSC which are readily accessible from the TSR and which have in the aggregate sufficient capacity to accommodate safely on board the number of persons on the installation (para 20.16).

The regulatory body should work with the industry to develop equipment and methods to enable TEMPSC to be launched clear of the installation including where, as on existing installations, they are oriented so as to point along the side of the installation (para 20.18).

Reg 5 of the Life-Saving Appliances Regulations should be amended or replaced so as to enable free-fall TEMPSC to be installed on new and existing installations. It should remain for the operator to justify its choice of TEMPSC as being appropriate in the particular conditions of its installation (para 20.24).

It should be required by regulation that each installation should be provided with life rafts having in the aggregate sufficient capacity to accommodate safely on board at least the number of persons on board the installation; along with suitable ropes to enable those persons to obtain access to the life rafts after they have been launched and deployed (para 20.26).

A variety of means of descent to the sea should be provided on all installations. In accordance with recommendation 75 the types, numbers and locations of facilities for this purpose should be specified in the evacuation, escape and rescue analysis; but such facilities should include:- — fixed ladders or stairways — personal devices for controlled descent by rope (paras 20.28-29).

Each individual on board an installation should be provided with:- (i) a personal survival (or immersion) suit; (ii) a life-jacket; (iii) a smoke hood of a simple filter type to exclude smoke and provide protection for at least 10 minutes during escape to or from the TSR; (iv) a torch; and (v) fireproof gloves. These articles should be kept in the accommodation (para 20.36). Other survival suits, life-jackets and smoke hoods for at least one half of the number of persons on the installation should be stored in containers placed at suitable locations on the installation (para 20.36).

Changes in the regulations and the code for the assessment of standby vessels should be aimed at an improvement in the quality of standby vessels, introducing basic standards for existing vessels and higher specifications for new vessels (para 20.41).

It should be required by regulations that each standby vessel should comply with the following standards:- (i) It should be highly manoeuvrable and able to maintain its position; (ii) It should provide full visibility of the water-line in all directions from the bridge; (iii) It should have at least two 360° searchlights capable of being remotely controlled; (iv) It should have two fast rescue craft. One of the 2 fast rescue craft should be able to travel at 25 knots in normal sea states. The smaller fast rescue craft (9 person capacity) should be crewed by 2 persons; the larger by 3 persons. Fast rescue craft should be equipped with adequate means of communicating with the standby vessel by VHF radio; and carry an adequate portable searchlight; (v) It should have the means of rapid launching of its fast rescue craft; (vi) It should have adequate means of communication by radio with its fast rescue craft, the installation, nearby vessels and the shore; and (vii) It should have at least two methods of retrieving survivors from the sea. (All in para 20.42).

The regulatory body should work with the industry to obtain agreement as to adequate training packages for the crew of standby vessels. Such training should be administered, and records of training kept by the Offshore Petroleum Industry Training Board (OPITB) (para 20.55).

Operators should maintain lists of personnel on board by alphabetical order and also by reference to the names of contractors whose personnel are represented on board. These lists should be updated for every movement of personnel and copied immediately to the shore (para 20.62).

The UKOOA guidelines for offshore emergency safety training on installations should be a minimum requirement for survival, fire-fighting and other forms of training detailed therein for the relevant personnel employed offshore. Personnel who have not met the requirements of these guidelines should not be permitted to work offshore (para 20.64). In order to ensure that these guidelines are complied with operators should be required to devise and maintain a system for the purpose, pending the date when the central training register instituted by OPITB for recording the personal details and safety training courses attended by all personnel seeking employment offshore is fully operational (para 20.64).