1-s2.0-S0925753507001099-main

8/12/2019 1-s2.0-S0925753507001099-main

1/11

Analysis of hazard scenarios for a research environmentin an oil and gas exploration

and production company

Marco de Bruin a,*, Paul Swuste b

a Shell International Exploration and Production, HSE&SD Site Services Team, Rijswijk, Netherlandsb Sectie Veiligheidskunde, Technische Universiteit Delft, Netherlands

Received 13 November 2006; received in revised form 22 June 2007; accepted 22 June 2007

Samenvatting

Het onderhavige artikel onderzoekt HSE-gevaarsscenarios in de onderzoeksfaciliteiten van een internationaal bedrijfdat gespecialiseerd is in de exploratie en productie van olie en gas. Doel is:

I. het analyseren van de grootste HSE-gevaarsscenarios voor de experimentele opstellingen in de nieuweonderzoeksfaciliteiten;

II. in staat te zijn deze gevaren terug te dringen tot een te bepalen minimum door optimaal ontwerp.III. in staat te zijn het aantal en ernst van toekomstige (mondiale) onderzoeksgerelateerde incidenten/bijna-ongevallen

terug te dringen.

Om de tien grootste HSE-gevaarsscenarios te kunnen vaststellen die ontwikkeld zijn in een eerdere studie, wordt geb-ruikgemaakt van de Tripod -methode. Met deze methode worden ook barrieres en General Failure Typesbepaald voorde tien grootste gevaarsscenarios.

De meest frequente barriere is het checken van ontwerp, systemen en installaties. De tweede frequente barriere is (cen-traal georganiseerd) onderhoud. Andere frequente barrieres zijn het gebruik van juist materiaal/apparatuuronderdelen,periodieke inspectie en veiligheidsapparatuur. Meest frequente General Failure Type is ontwerp, op afstand gevolgddoor onderhoudsbeheer, organisatie, procedures en de overige types. Om bovengenoemde reductie van incidenten te berei-ken, wordt verbetering van deze barrieres en General Failure Typesvoorgesteld. Alhoewel dit artikel zich concentreertop het Nederlandse deel van het bedrijf, zijn de resultaten ook bruikbaar voor de gelijkwaardige faciliteiten in de USA.

Het gepresenteerde onderzoek is een afstudeerproject geweest van de post-academische opleiding Management ofSafety, Health and Environment (MoSHE) van de Technische Universiteit Delft. 2007 Elsevier Ltd. All rights reserved.

0925-7535/$ - see front matter 2007 Elsevier Ltd. All rights reserved.

doi:10.1016/j.ssci.2007.06.030

* Corresponding author. Tel.: +31 70 447 3702.E-mail address:[email protected](M. de Bruin).

Available online at www.sciencedirect.com

Safety Science 46 (2008) 261271

www.elsevier.com/locate/ssci
mailto:[email protected]:[email protected]

8/12/2019 1-s2.0-S0925753507001099-main

2/11

Abstract

The present study analyzes HSE hazard scenarios at the research areas of an international company that specializes inthe exploration and production of oil and gas. Objective is:

I. to analyze the major HSE hazard scenarios for the experimental facilities in the new research location;

II. to be able to reduce those hazards to a pre-defined minimum through optimal design;III. to be able to reduce the amount and severity of future research-related incidents/near-misses.

To analyze the ten major hazard scenarios, which were developed in a previous study, use is made of the Tripod technique. With this technique, also barriers and general failure types are determined for the major hazardscenarios.

The most frequent barrier is the checking of design, systems and installations. Second frequent barrier is (centrallyguided) maintenance. Further frequent barriers are the use of adequate material/equipment parts, periodic inspectionand safety device. Most frequent general failure type is design, followed at a distance by maintenance management, orga-nization, procedures and other types. To reach the above mentioned reduction of incidents, it is proposed to improve thesebarriers and general failure types. Although focusing on the Dutch part of the company, results are also usable for theequivalent facilities in the USA.

The research presented in this article is based on a final report of the post graduate master course Management ofSafety, Health and Environment of the Delft University of Technology. 2007 Elsevier Ltd. All rights reserved.

Keywords: Hazard; Scenario; Tripod; Research; Barrier

1. Introduction

This article analyzes health, safety and environmental (HSE) hazard scenarios at the research facilities of an

international company that specializes in the exploration and production (E&P) of oil and gas. The locationstudied in this article houses a centre of technology, in which some 60 research locations are accommodated.In these locations, a wide range of equipment and chemicals are in use, all facilitating dedicated research andservices in the field of E&P for the oil and gas industry. The focus is on general physical, chemical andmechanical research on rock, multiphase (oil/water/air) systems, drilling flush and drilling technology; mainlyby destructive and non-destructive experiments on rock, oil and (natural) gas samples. Emphasis herewith ison mechanical properties of tubes, drilling bars, drill heads, etc. and on analysis of properties of oils and gases.Experiments are mainly physical; chemical reactions are not common and chemicals in use are mainly used assolvent or extraction agent. Experimental research is carried out by 50 staff members; experiments take placeunder pressures up to 1000 bar and temperatures up to ca. 150 C. To deliver the necessary gases, a gas dis-tribution system fed from a central facility is in use.

Currently, the company is in the middle of a total renovation project of the site. The renovated site will

amongst others contain a new indoor and outdoor research area in which all current large and small scaleequipment will be based. To pave the way for the construction of the new facilities, large scale research equip-ment was moved to a temporary outside location in 2002. In 2007 all large and small scale equipment will betransferred to new facilities.

The company owns a similar E&P centre in Houston, Texas (USA) in which 55 laboratories are housed,employing 40 research staff members. In the late 1990s globalization efforts started and global practices wereadopted by the two centres. This resulted in amongst others the same system of incident reporting beginning in2000. The USA facilities will be integrated in the present study; in this way, the USA incident data can also beused which will make final results more accurate and globally applicable.

To assess the hazards for the situation in the current and hence also new (from 2007 on) research facilities,major hazard scenarios were developed (de Bruin and Swuste, 2006). For development of these scenarios the

following input was used: Layout Reviews, reported incidents from 19932004 and hazard scenarios from the

262 M. de Bruin, P. Swuste/ Safety Science 46 (2008) 261271

8/12/2019 1-s2.0-S0925753507001099-main

3/11

companys risk inventory and evaluation (RIE) and HSE studies. Until now the major hazard scenarios havenot been analyzed. Therefore the objective of this study is:

I. to analyze the major HSE hazard scenarios for the experimental facilities in the new research location;II. to be able to reduce those hazards to a pre-defined minimum through optimal design;

III. to be able to reduce the amount and severity of future research-related incidents/near-misses.

To reach the objectives as mentioned, the following research questions are defined:

(1) What are useful barriers to improve to reach reduction of amount and severity of future incidents/near-misses?

(2) What management choices should be made to install or enhance these barriers?

2. Material and methods

InTable 1the major hazard scenarios for the company are presented in decreasing order of importance.

They were developed and evaluated inde Bruin and Swuste, 2006.Scenarios were structured according to the bow-tie principle: events/circumstances, top event, conse-

quences. In this way the top event, the item management is interested in, is made explicitly clear. Thisbow-tie is a combination of a fault tree, leading from various hazards to a top event, and an event tree leadingfrom the top event to different sorts of damage as is shown inFig. 1. The fault tree is commonly referred to asthe left hand side, while the event tree is the right hand side ( Zemering and Swuste, 2005).

To elaborate these scenarios, in this article the Tripod technique is used. This technique is one of the moststructured approaches to represent scenarios (via targets, hazards and events) and their causation paths (EQEInternational webpage; Kennedy and Kirwan, 1998). For the present study the technique is excellently suit-able, because it makes use of barriers (as required for research question 1) which are analyzed back to activeand latent failures (and preconditions). Moreover, latent failures can be classified into general failure types

(GFTs); in this way a GFT Profile can be set up that indicates areas of improvement for the company. Stan-dardly used GFTs in the Tripod technique are:

HW hardwareDE designMM maintenance managementPR proceduresEC error enforcing conditionsHK housekeepingIG incompatible goalsOR organizationCO communicationTR trainingDF defences

It is important to notice that Tripod is used in this study as a prospective tool, while it was designed as aretrospective tool. This is justified in this case because the major hazard scenarios that are used for the futureresearch facilities consist of a retrospective long-term analysis of all relevant available safety data.

Within the company, the Tripod technique is the most widely used (and prescribed) tool to invest inci-dents; so also for future reference this is the preferred technique. In the Tripod technique events can alsobe a target or hazard leading up to a next event. Because of this fact, a tree model can be created which con-sists of several events. This is a fundamental difference with a bow-tie model (which is built around one centraltop event) and because of this reason it is possible to split a bow-tie scenario into several sub events. This sim-

plifies analysis and hence it is also possible to investigate scenarios which are more on the left hand side of a

M. de Bruin, P. Swuste / Safety Science 46 (2008) 261271 263

8/12/2019 1-s2.0-S0925753507001099-main

4/11

8/12/2019 1-s2.0-S0925753507001099-main

5/11

bow-tie, like scenarios 9 and 10 in Table 1. After analysis and determination of barriers in the scenarios, themost effective mitigation measures can be determined to reach objectives II and III.

3. Results

For all 10 scenarios, Tripod trees were developed. InFig. 2an example is given, dealing with scenario 5(hit by hoisted/lifted/loaded goods).The corresponding GFT profile for this example is in Fig. 3.The barriers that were identified per scenario are presented inTables 2.12.10.In total, 77 barriers were defined. The grand overview is presented in Table 3. InTable 4the GFTs for the

major scenarios are summarized; the profile is given inFig. 4.

4. Discussion and conclusions

4.1. Analysis of the Tripod tree

The reason for choosing scenario 5 as example in Fig. 2is the fact that it is the least extensive tree of the

major scenarios; other scenarios need a larger page format.Fig. 2clearly shows the main elements of a Tripod tree: hazards (e.g. hoisting/loading/lifting), targets (e.g. staff/assets underneath) and top events (e.g. hoist-ing/loading/lifting loads over assets or staff). It is also clear that an event can also be a target leading up to anext event (assets or staff hit by loads). Various barriers are in between hazards and top events; examples inthis scenario are: hoisting paths not used at the same time and procedures for hoisting. Barriers do alsointerfere between targets and top events, like no hazardous equipment/wires and evacuation of staff/assets.The barrier hoisting paths not used at the same time can fail, because it is not known among parties thatother ones are hoisting too. This is an active failure. Precondition of this active failure is lack of communica-tion between hoisting parties. Latent failure behind this precondition is the fact that there are ineffective pro-cedures about communication. The general failure types for this latent failure are classified to bepredominantly procedural (PR) and communicative (CO). Summarizing all GFTs (Fig. 3) shows that for this

scenario the dominant GFT is procedures (PR), the second ones being design (DE) and communication (CO).

Fig. 1. Bow-tie concept.


8/12/2019 1-s2.0-S0925753507001099-main

6/11

Fig.

2.

T

ripod

treeforscenario

5.


8/12/2019 1-s2.0-S0925753507001099-main

7/11

3

2

6

1

3

0

1

2

3

4

5

6

7

HW DE MM PR EC HK IG OR CO TR DF

General Failure Type

Occurrencei

nscenarios

Fig. 3. GFT profile for scenario 5.

Table 2.2Barriers for scenario 2 (escalation of emergency)

Barrier #

Fire-resistance of doors/building 2Emergency doors, signs, lights, muster points, exits 2Fire-fighting tools 1Routing, evacuation procedure 1BHV organization 1Regular updates of plan 1Adequate fire-fighting skills of BHV 1Design/system/installation check 3Design of automatic warning system 2Emergency and eye wash showers 1

Periodic inspections (of driveway) 1

Table 2.1

Barriers for scenario 1 (failure of equipment)

Barrier #

Design/system/installation check 1Use of adequate material/equipment parts 1Screening on HSE items 1Periodic inspection 1(Centrally guided) maintenance 1Safety relief valves/fuses/device 1Physical separation 3Insulation/shielding of system 2Blocking of fresh air supply 1

Table 2.3Barriers for scenario 3 (excessive system pressure)

Barrier #

Design/system/installation check 1(Centrally guided) maintenance 1Adequate flushing of equipment/lines 1Safety relief valves/fuses/device 1Use of adequate material/equipment parts 1Walls, explosion proof control room 1Leak-tight facilities, incl. grooves 1

No staff activities taking place nearby 1


8/12/2019 1-s2.0-S0925753507001099-main

8/11

Table 2.7Barriers for scenario 7 (poor waste management)

Barrier #

(Centrally guided) maintenance 1Cleaning after experiment 1Storage prescriptions 1Leak-tight facilities, incl. grooves 1Periodic inspection 1

Table 2.8Barriers for scenario 8 (exposure of unauthorized staff)

Barrier #

Adherence to rules on research area access 1Internal PtW system for contractors 1

Red warning light at entrance 1

Table 2.6Barriers for scenario 6 (operating error, spill)

Barrier #

Design/system/installation check 1

Use of adequate material/equipment parts 1Periodic inspection 1(Centrally guided) maintenance 1Indications/warning signs on equipment 1Safety relief valves/fuses/device 1Leak-tight facilities, incl. grooves 2

Table 2.4Barriers for scenario 4 (electrocution)

Barrier #

Design/system/installation check 1Use of adequate material/equipment parts 1Screening on HSE items 1

Periodic inspection 1(Centrally guided) maintenance 1Use of adequate protective measures (PPE) 1Insulation/shielding of system 1PtW system for working on electricity 1Safety relief valves/fuses/device 1Grounding 1

Table 2.5Barriers for scenario 5 (hit by hoisted/lifted/loaded goods)

Barrier #

Hoisting paths not used at the same time 1Procedures for hoisting 1No hazardous equipment/wires underneath 1Evacuation of staff/assets 1Use of adequate material/equipment parts 1


8/12/2019 1-s2.0-S0925753507001099-main

9/11

4.2. Barriers and GFTs

In total, the barriers that are presented inTable 3are the ones (in decreasing order of occurrence) that haveto be improved to mitigate the major scenarios (and reach reduction of amount and severity of future inci-dents/near-misses). It needs to be realized that the exact results depend very much on the fundaments ofthe Tripod technique. In the present study, for all barriers three GFTs were defined; when this amountwould be different, also the amounts inTable 4and Fig. 4would be different. Ratios between GFTs wouldroughly stay the same however. It needs also to be realized that the Tripod trees were set up by the authorof the present study. Another author might have come up with slightly different trees. Again, it is about trends

here. FromTable 3it is clear that the most frequent barrier is the checking of design, systems and installations.This is supported by the GFT design (Table 4). Looking at the major hazard scenarios (de Bruin, 2005)design shortcomings are mainly caused by a lack of thorough design safety studies (HAZIDs, HAZOPs,etc.) Due to the lack of these studies, in practice it appears that e.g. inadequate material, couplings and detec-tion systems were used, manifested in incidents. Also, when design safety studies were held, there was no goodsystem to track if action points were actually carried out. Another design shortcoming appears to be the dif-ficulty to assess the specifications (e.g. maximum pressure capacity, intrinsic material properties and actualpressure in parts) for equipment under design. Second frequent barrier is (centrally guided) maintenance (sup-ported by the GFT maintenance management). In the scenarios it appears that there is no adequate system inplace for periodic inspection and that maintenance is not centrally coordinated. Besides it appears that notenough time is spent on regular system checks. This resulted in e.g. malfunctioning safety device, corrosion,clogged lines and failing slings. Further frequent barriers are the use of adequate material/equipment parts,periodic inspection and safety device, etc. If management decides to improve on the major hazard scenarios,these are the barriers to enhance.

4.3. Future reviews

de Bruin and Swuste, 2006propose Scenario Based Reviews. In the nuclear industry, working with scenar-ios is quite common (e.g.Liu et al., 1998; Borovoi et al., 1999; Na et al., 2004). Besides, there is a tendency thatother industries start adopting a scenario approach, e.g. the Dutch Railways (Wielaard and Swuste, 2001) andGeneral Electric Plastics started Scenario Based Audits (Zemering and Swuste, 2005). In Scenario BasedReviews, experts can discuss real barriers and their causation paths. It is proposed to use the bow-tie model,as the main hazard scenarios were structured according to this model (see Table 1). When reviewing the major

scenarios it has to be assessed if barriers are effective. If not, improvement actions have to be defined per bar-

Table 2.9Barriers for scenario 9 (harm by lack of competences)

Barrier #

Clarity on HSE responsibilities 1Information/instruction by organization 1Ability to assess risks 1

Use of adequate protective measures (PPE) 1

Table 2.10Barriers for scenario 10 (loss of control by insufficient knowledge on equipment)

Barrier #

Safety relief valves/fuses/device 1Correction by operator 1Sufficient knowledge on system 1Intrinsic safe system 1(Centrally guided) maintenance 1Use of adequate protective measures (PPE) 1


8/12/2019 1-s2.0-S0925753507001099-main

10/11

rier. If, according to the reviewing team of experts, barriers might be missing, they can be added too. In thisway, scenarios stay optimized and organizational learning can start. Accompanying research questions mightbe:

What barriers/defences appear to fail (and how often) in the presented scenarios and need to be enhanced? Are there still barriers/defences missing in the presented scenarios? Are there existing effective barriers that are being eroded?

To reach objectives II and III, goals can be set by the companys management. If goals appear to beexceeded, it needs to be investigated which barriers fail in the presented scenarios and action items need to

be defined for these barriers.

Table 3Barriers in the major hazard scenarios

Barrier #

Design/system/installation check 7(Centrally guided) maintenance 6Use of adequate material/equipment parts 5

Periodic inspection 5Safety relief valves/fuses/device 5Leak-tight facilities, incl. grooves 4Physical separation 3Insulation/shielding of system 3Use of adequate protective measures (PPE) 3Screening on HSE items 2Fire-resistance of doors/building 2Emergency doors, signs, lights, muster points, exits 2Design of automatic warning system 2Blocking of fresh air supply 1Fire-fighting tools 1Routing, evacuation procedure 1

BHV organization 1Regular updates of plan 1Adequate fire-fighting skills of BHV 1Emergency and eye wash showers 1Adequate flushing of equipment/lines 1Walls, explosion proof control room 1No staff activities taking place nearby 1PtW system for working on electricity 1Grounding 1Hoisting paths not used at the same time 1Procedures for hoisting 1No hazardous equipment/wires underneath 1Evacuation of staff/assets 1Indications/warning signs on equipment 1

Cleaning after experiment 1Storage prescriptions 1Adherence to rules on research area access 1Internal PtW system for contractors 1Red warning light at entrance 1Clarity on HSE responsibilities 1Information/instruction by organization 1Ability to assess risks 1Correction by operator 1Sufficient knowledge on system 1Intrinsic safe system 1

Total 77


8/12/2019 1-s2.0-S0925753507001099-main

11/11

References

Borovoi, A.A., Lagunenko, A.S., Pazukhin, E.M., 1999. Radiochemical and selected physicochemical characteristics of lava and concretesamples from subreactor room no 304/3 of the fourth block of the chernobyl nuclear power plant and their connection with theaccident scenario. Radiochemistry 41 (2), 197202.

de Bruin, M.D., 2005. Hazard scenarios for E&P research facilities at SIEP Rijswijk. Internal Shell Report EP 2005-5197, Rijswijk.de Bruin, M.D., Swuste, P.H.J.J., 2006. Identification of hazard scenarios for a research environment in an oil and gas exploration and

production company. Tijdschrift voor Toegepaste Arbowetenschap 19 (4), 6575.EQE International webpage on hazard identification methods. .Kennedy, R., Kirwan, B., 1998. Development of a hazard and operability-based method for identifying safety management vulnerabilities

in high risk systems. Safety Science 30, 249274.Liu, T.J., Lee, C.H., Chang, C.Y., 1998. Power-operated relief valve stuck-open accident and recovery scenarios in the Institute of Nuclear

Energy Research integral system test facility. Nuclear Engineering and Design 186 (12), 149176.Na, M.G. et al., 2004. Prediction of major transient scenarios for severe accidents of nuclear power plants. IEEE Transactions on Nuclear

Science 51 (2), 313321.Wielaard, P., Swuste, P.H.J.J., 2001. De veiligheid van treinreizigers, een zoektocht naar bruikbare indicatoren. Tijdschrift voor

Toegepaste Arbowetenschap 14 (3), 712.Zemering, C.A., Swuste, P.H.J.J., 2005. Scenario based auditing. Tijdschrift voor Toegepaste Arbowetenschap 18 (4), 7988.

15

67

35

21

10

4

9

25

10

18 17

0

10

20

30

40

50

60

70

80


General Failure Type

Occ

urrencein10majorhazardscenario

s

Fig. 4. General failure type profile for the major hazard scenarios.

Table 4General failure types for the major hazard scenarios

Scenario General failure type Sum


1 7 16 5 2 1 1 3 1 36

2 11 6 3 6 2 4 2 4 10 483 2 10 5 1 1 4 1 244 2 8 6 4 1 1 3 1 3 1 305 3 2 6 1 3 156 1 13 5 1 1 2 1 247 3 4 1 4 3 158 4 3 1 1 99 3 3 6 12

10 3 3 2 1 1 5 3 18

Sum 15 67 35 21 10 4 9 25 10 18 17 231

http://www.eqe.co.uk/consulting/pdf/tripod.pdfhttp://www.eqe.co.uk/consulting/pdf/tripod.pdf

Documents

1-s2.0-S0925753507001099-main