DNVGL-SE-0466 In-service verification of oil and gas assetsrules.dnvgl.com/docs/pdf/DNVGL/SE/2016-09/DNVGL-SE-0466.pdf · 2016-09-01 · It should be noted that the emphasis of this

SERVICE SPECIFICATION

DNVGL-SE-0466 Edition September 2016

In-service verification of oil and gas assets

DNV GL AS

The electronic pdf version of this document found through http://www.dnvgl.com is the officially binding version. The documents are available free of charge in PDF format.

FOREWORD
DNV GL service specifications contain procedural requirements for obtaining and retaining certificates andother conformity statements to the objects, personnel, organisations and/or operations in question.
© DNV GL AS September 2016

Any comments may be sent by e-mail to [email protected]

This service document has been prepared based on available knowledge, technology and/or information at the time of issuance of this document. The use of thisdocument by others than DNV GL is at the user's sole risk. DNV GL does not accept any liability or responsibility for loss or damages resulting from any use ofthis document.

C

hang

es –

cur

rent
CHANGES – CURRENT
GeneralThis is a new document.

Service specification, DNVGL-SE-0466 – Edition September 2016 Page 3

DNV GL AS

C

onte

nts
Contents
CHANGES – CURRENT .................................................................................................. 3

Sec.1 Introduction.................................................................................................. 61.1 General...................................................................................................61.2 Background ............................................................................................61.3 Scope and objective ...............................................................................71.4 Application .............................................................................................8

Sec.2 References .................................................................................................... 92.1 External references ................................................................................92.2 DNV GL references ...............................................................................10

Sec.3 Definitions .................................................................................................. 113.1 Definitions............................................................................................113.2 Abbreviations .......................................................................................143.3 Verbal forms.........................................................................................14

Sec.4 Verification process - concepts.................................................................... 154.1 Barrier management ...........................................................................154.2 Performance requirements...................................................................174.3 Operator assurance activities...............................................................184.4 Verification scheme..............................................................................194.5 Setting of verification activities............................................................20

Sec.5 Verification process - methodology ............................................................. 225.1 Performing verification - planning of scope..........................................225.2 Performing verification - execution of onshore activities .....................225.3 Performing verification - execution of offshore activities .....................225.4 Reporting of verification.......................................................................235.5 Verification findings management........................................................245.6 Management of change ........................................................................245.7 DNV GL verifier responsibilities ............................................................255.8 Operator responsibilities ......................................................................25

Sec.6 Steps for establishing verification scheme without a barrier management system ........................................................................................................ 276.1 General.................................................................................................27

Sec.7 Maintaining an effective verification scheme............................................... 287.1 General.................................................................................................287.2 Review and audit process.....................................................................307.3 Operator – check process .....................................................................30

Sec.8 Application and interface with other common operational & regulatory situations .................................................................................................... 328.1 Scope and objectives............................................................................328.2 Application and interface with classed offshore units...........................328.3 Application and interface with combined operations (COMOPS)...........338.4 Application and interface with decommissioning and abandonment

phase ...................................................................................................33App. A Benefits of DNV GL in-service verification ................................................... 35App. B Example list of typical barriers.................................................................... 39


DNV GL AS

C

onte

nts
App. C Performance requirement format example.................................................. 42
App. D Regulatory regimes (a brief overview)........................................................ 47App. E Examples of scopes of work for verification activities ................................. 51App. F DNV GL in-service verification deliverables ................................................. 53


DNV GL AS

SECTION 1 INTRODUCTION
1.1 General

1.1.1 This service specification (SE) aims to provide a methodology to assure the safety and reliability of oil and gas assets by managing the integrity of major accident barriers (including safety and environmental) in the in-service phase.

1.1.2 In-service verification includes both verification of the asset during normal operation and verification related to material changes or repairs and modifications (hereafter referred to as management of change (MoC)) throughout the lifetime of the asset.

1.1.3 This document falls under the top level document DNVGL-SE-0474 Risk based verification.

1.1.4 This process may be applied to both offshore and onshore oil and gas assets. It can be applied to floating or fixed assets including floating production or LNG and to any or all parts of an asset when looking to verify it's safety barriers.

1.1.5 This process is intended to give guidance for application of the requirements for independent verification within the EU Directive on the Safety of Offshore Oil and Gas Operations, see App.D.1 for further information.

It is also intended to be flexible, such that it can equally be applied to any global location with or without current local offshore legislation.

1.1.6 Major accident barrier verification is most effective when carried out on a regular, periodic basis.

1.1.7 DNV GL’s independent in-service verification can form an integral part of an operator’s assurance philosophy and legislative obligations.

1.2 Background

1.2.1 There are various factors which may influence an operator’s need for application of a barrier management philosophy:

— recent process incidents indicate that there is an increased benefit from condition monitoring of safety systems

— certain national regulators have become stricter in monitoring how the operators are managing their risks in such a way that life, assets and environment are safeguarded

— the age profile of global assets is steadily increasing, which is resulting in a change in the risk profile of safety and integrity issues.


DNV GL AS

Guidance note:
For more information on how risks can be assessed and suitable barriers identified, please see DNV GL Technology Leadership Report Risk Management.

---e-n-d---of---g-u-i-d-a-n-c-e---n-o-t-e---

1.2.2 Where a regulatory framework exists, operators are required to demonstrate compliance in the management of their major accident barriers.

However, when operations occur in countries where regulations are not explicit or absent, these same operators usually rely on their own corporate standards and/or industrial established requirements to demonstrate their commitment in managing major hazards (MH’s) to their stakeholders.

For example, some operators stipulate the requirement to identify hazards and implement risk control including a suitable level of independent verification.

It is apparent that many operators now choose to harmonise a major accident barrier approach across their global operations. There is a broad recognition that management of major accident risk compliments management of business risk.

Guidance note:App.D summarises a range of country specific regulatory requirements.


1.2.3 App.A describes the benefits and value which DNV GL provides with regards to in-service verification.

1.3 Scope and objective

1.3.1 This SE provides guidance on DNV GL’s verification service for assessing the condition of safety barriers for in-service assets, especially for operators where there is limited regulatory or corporate guidelines on safety barrier management.

Guidance note:It should be noted that the emphasis of this document is from a technical barrier perspective (i.e. SECE’s). However, it is important to highlight that some operators or regulatory regimes may also require operational barriers to be verified (e.g. safety and environmentally critical tasks and procedures).


1.3.2 It aims to outline practices for in-service verification of an asset’s defined safety barriers, assessing the effectiveness of risk management efforts and verifying PR’s of safety and environmentally critical equipment.

1.3.3 This SE is primarily intended for offshore assets (fixed and mobile) used for the purpose of oil and gas exploration and production. It can equally be applied to onshore assets.

1.3.4 An asset’s original design should also be verified before they are commissioned, but the process for such is not the subject of this SE. Reference may be made instead to DNVGL-SE-0474 Risk based verification.


DNV GL AS

1.4 Application
1.4.1 Operators who want to verify their major accident barrier conditions against specified performance requirements may utilise this SE.

1.4.2 For operators who are required to demonstrate regulatory compliance, this SE may be used in conjunction with the regulatory or corporate requirements.

Guidance note:It should be noted that this SE cannot replace any specific regulatory requirement for offshore/onshore safety and verification thereof.



DNV GL AS

SECTION 2 REFERENCES
2.1 External references

Table 2-1 External references

Reference Title

2013/30/EU EU Directive on the Safety of Offshore Oil and Gas Operations

SI No. 398SI 1995/743SI 1995/738SI 1996/913SI 1996/825

UK Competent Authority:

— Offshore Installations (Safety Case) Regulations 2015— Prevention of Fire and Explosion and Emergency Response on offshore installations

(PFEER)1995— Offshore Installations and Pipeline Works Management and Administration Regulations

(1995)— Offshore Installations and Wells (Design and Construction etc.) Regulations (DCR, 1996)— Pipelines Safety Regulations (PSR) 1996

No. 14, 2006 Australia NOPSEMA:

— Offshore Petroleum and Greenhouse Gas Storage Acts 2006— Offshore Petroleum and Greenhouse Gas (Safety) Regulations 2009;— Part 5 of the Offshore Petroleum and Greenhouse Gas Storage (Resource Management and

Administration) Regulations 2011No. 520 of 13 May 2013

Danish Working Environment Authority: Offshore Safety Acts

BVOTOffshoreBergVEIBergV

BSH Standard

Germany:

— Tiefbohrverordnung (20.09.2006)— Offshore Bergverordnung (draft)— Elektrobergverordnung (23.10.2000)— Minimum requirements concerning the constructive design of offshore structures within the

Exclusive Economic Zone (EEZ)— Ground Investigation for Offshore Wind Energy— Design of Offshore Wind Turbines— Investigation of the Impacts of Offshore Wind Turbines on the Marine Environment

PSA – ActivitiesPSA – FacilitiesPSA – Framework HSEPSA – Management

Petroleum Safety Authority Norway:

— The Activity Regulations — The Facilities Regulations— The Framework HSE Regulations— The Management RegulationsUSA Code of Federal Regulation 250

CER/14/146 Ireland Commission for Energy Regulation (CER), Compliance Assurance System, Part of the Petroleum Safety Framework – Version 3.0, Dated 28th August 2014Step Change in Safety, Assurance & Verification Practitioner’s Guide (https://www.stepchangeinsafety.net/safety-resources/publications [cited 2016-01-20])


DNV GL AS

2.2 DNV GL references
Table 2-2 DNV GL internal references

Reference Title

DNV GL Technology Leadership Report Risk Management January 2015

Report No: PP074856, Rev. 1 DNV GL Technology Leadership Report Barrier and Bow Tie Diagrams January 2014

DNVGL-OS-A101 Safety principles and arrangements

DNVGL-OS-D101 Marine and machinery systems and equipment

DNVGL-OS-D201 Electrical installations

DNVGL-OS-D202 Automation, safety and telecommunication system

DNVGL-OS-D203 Integrated software dependent systems (ISDS)

DNVGL-OS-D301 Fire protection

DNVGL-OS-E101 Drilling plant

DNVGL-OS-E201 Oil and gas processing systems

DNVGL-OS-E301 Position mooring

DNVGL-OS-E302 Offshore mooring chain

DNVGL-OS-E401 Helicopter decks

DNVGL-RP-G104 Identification and management of environmental barriers

DNVGL-SE-0474 Risk based verification (currently published as DNV-OSS-300)

DNVGL-SE-0475 Verification and certification of submarine pipelines (currently published as DNV-OSS-301)

DNVGL-SE-0476 Offshore riser systems

DNVGL-SE-0477 Risk based verification of offshore structures (currently published as DNV-OSS-302)

DNVGL-SE-0478 Verification of subsea facilities (currently published as DNV-OSS-306)

DNVGL-SE-0479 Verification of process facilities (currently published as DNV-OSS-307)

DNVGL-SE-0480 Verification of lifting appliances for the oil and gas industry (currently published as DNV-OSS-308)

DNVGL-ST-E406 Design of free fall lifeboats

DNVGL-ST-F101 Submarine pipeline systems (currently published as DNV-OS-F101)

DNVGL-ST-F201 Dynamic risers (currently published as DNV-OS-F201)

DNVGL-ST-N001 Marine operations and marine warranty


DNV GL AS

SECTION 3 DEFINITIONS
3.1 DefinitionsThe following terms and definitions may be defined slightly different in each country and company.

Table 3-1 Definitions

Term Definition

ALARP refers to the principle of reducing risks to as low as reasonably practicableThis means that once risks are considered to be tolerable, further risk reduction measures are balanced against the cost (in money, time or trouble) of implementing such measures. The emphasis is to implement improvements unless they can clearly be shown to be “not reasonably practicable”, i.e. cost of implementation is unacceptable and disproportionate to safety benefit.

Guidance note:ALARP is a significant driver in the “non-prescriptive” approach for countries with safety case regime-type regulations, and hence affects the acceptability of risks the installation brings.


asset loose term used to describe the item to be made or maintainedCan refer to a full field development, an offshore/onshore facility, a pipeline system, a compressor station etc. or a part of these. It is interchangeable with the term object.

assurance represents the activities performed to ensure barriers meet performance requirementsThis includes activities in all phases of the lifecycle and may involve activity by the design contractors in the design, procurement and construction phases which the operator needs to monitor to ensure the barriers are “initially” suitable.

Guidance note:Assurance is typically first or second party activities carried out under the responsibility of the operator; see [4.3] for more details.


barrier technical, operational, or organizational element which is intended individually or collectively to reduce probability for a specific error, hazard, or accident to occur (ex. prevents); or which limits its harm / disadvantages (ex. mitigates consequences) Barriers represent a key element in reducing risk. (See also safety barrier).

barrier management coordinated activities to establish and maintain barriers so that the barriers sustain their function (ex. assurance activities and verification activities)

barrier system system designed and implemented to perform one or more barrier functions(In this document a barrier system is equivalent to a safety system.)

competence relates to relevant theoretical and practical knowledge and experience to enable a professional judgment to be made regarding the importance and suitability of plant/asset to be assessed

combined operations (COMOPS)

combined operations are defined as any operation involving the temporary interaction of two or more assets (e.g. a drilling rig operating alongside a fixed asset, or a floatel being bridge-linked to facilitate major work on a fixed asset)

escalation spread of impact of a hazardous event to equipment or other areas, thereby causing an increase in the consequences of the event

fixed platforms (FP) these platforms are built on concrete or steel legs, or both, anchored directly onto the seabed, supporting a deck with space for drilling rigs, production facilities and crew quarters Such platforms are, by virtue of their immobility, designed for very long term use. Various types of structure are used: steel jacket, concrete caisson, floating steel, and even floating concrete.

floatel a floating vessel or jack-up unit for the provision of accommodation

floating production storage and offloading unit (FPSO)

a floating vessel used for the production and processing of hydrocarbons, and for the storage and offloading of oil

floating offshore LNG unit (FLNG)

floating offshore process plants for the production or regasification of LNG or receiving, treatment and/or liquefaction of natural gas


DNV GL AS

floating production unit (FPU)

a ship-shaped floater or a semi-submersible used to process and export oil and gas

floating storage and offloading unit (FSO)

a ship-shaped floater used for the storage and offloading of oil

floating storage & regasification unit (FSRU)

floating offshore process plants for the receiving, storing and regasification of liquefied natural gas

functional requirements minimum criteria which should be satisfied to meet the stated safety and environmental objectives

hazard potential for human injury, damage to the environment, damage to property, or a combination of these (ISO 13702)

hazardous event incident which occurs when a hazard is realized (ISO 13702)

hazard identification (HAZID)

a technique for the identification of all significant hazards associated with the particular activity under consideration (ISO-17776)

independent a person is regarded as independent only where they have had no involvement or responsibility related to the aspect or object to be verified, nor any financial interest, which might compromise their objectivity; and they are sufficiently independent of any management system which bears responsibility for the aspect or object to be examined, that they will be objective in discharging his function

key performance indicators (KPIs)

a performance indicator or key performance indicator is a type of performance measurementKPIs evaluate the success of an organisation or of a particular activity in which it engages.

maintenance maintaining equipment and facilities in a satisfactory operating condition by providing for systematic inspection, detection and correction of incipient failures either before they occur or before they develop into major defects

major accident (European Union)

means, in relation to an installation or connected infrastructure:

(a) an event involving an explosion, fire, loss of well control or the release of oil, gas or dangerous substances causing, or with a significant potential to cause, fatalities or serious personal injury;

(b) an incident leading to serious damage to the installation or connected infrastructure involving, or with a significant potential to cause, fatalities or serious personal injury;

(c) any other incident leading to fatalities or serious injury to five or more persons who are on the offshore installation where the source of danger occurs or who are engaged in an offshore oil and gas operation in connection with the installation or connected infrastructure; or

(d) any major environmental incident resulting from incidents referred to in points (a), (b) and (c)

(2013/30/EU, EU Directive on the Safety of Offshore Oil and Gas Operations)

Guidance note:Where a country specific regulatory framework exists, the major accident definitions as defined in the underpinning regulations should be referred to.


major accident barriers measures that are designed/implemented with the explicit purpose: (1) to reduce the likelihood of triggering a major accident and/or (2) to reduce the impact (i.e. consequence) of an major accident

major hazard (MH) means a situation with the potential to result in a major accident (2013/30/EU, EU Directive on the Safety of Offshore Oil and Gas Operations)

management of change (MoC)

a controlled process with authorisation consistently applied and broadly framed with the following: a definition of and justification for the change, a risk assessment, a detailed scope of work, the details for installation and commissioning; documentation; and finally operations and lessons learned details

management review the formal evaluation of a company’s management system by a team of managersIt is usually conducted at least once a year.

management system a structured set of interdependent doctrines, processes, documents and principles that are intended to ensure that the activities of an organisation are directed, planned, conducted and controlled in such a way that provides reasonable assurance that the objectives of the organisation are met

Table 3-1 Definitions (Continued)

Term Definition


DNV GL AS

material change(European Union)

material change means:

(a) in the case of a report on major hazards, a change to the basis on which the original report was accepted including, inter alia, physical modifications, availability of new knowledge or technology and operational management changes;

(b) in the case of a modification of well operations or combined operations, a change to the basis on which the original notification was submitted including, inter alia, physical modifications, replacement of one installation with another, availability of new knowledge or technology and operational management changes

(2013/30/EU, EU Directive on the Safety of Offshore Oil and Gas Operations)

Guidance note:Where a country specific regulatory framework exists, the material change definitions as defined in the underpinning regulations should be referred to.


mitigation limitation of the undesirable effects of a particular event

mobile offshore unit (MOU) a buoyant construction engaged in offshore operations including drilling, production, storage or support functions, not intended for service at one particular offshore site and which can be relocated without major dismantling or modification

operator the company that operates an asset

performance requirement (PR)

in this SE, PR is a description of the essential requirements to be met, maintained or provided on demand by an element (May also be referred as performance standard).

risk effect of uncertainty on objectives, in a safety context the combination of the probability of harm occurring and the severity of that harm

Guidance note:Further definitions relating to risk may be found in ISO 31000.


Guidance note:Objectives can have different aspects such as financial, health and safety, and environmental goals and can apply at different levels such as strategic, organisation-wide, project, product and process.


risk assessment overall process of risk analysis and risk evaluation

risk management coordinated activities to direct and control an organisation with regard to risk

safety barrier a safety barrier is a physical, engineered system or human action that is implemented to prevent, control, or impede energy released from reaching assets and causing or contributing substantially to a major accident

safety and environmental critical elements (SECE’s)

means such parts of an installation and such of its plant (including computer programmes), or any part of those

a) the failure of which could cause or contribute substantially to a major accident; orb) a purpose of which is to prevent or limit the effect of, a major accident

This definition also applies to temporary equipment brought onto the offshore installation.verification confirmation by examination and provision of objective evidence that specified

requirements have been fulfilled

Guidance note:Verification is typically carried out by a third party verifier; see [4.4] for more details.


verification scheme (VS) in this SE, the verification scheme defines specific verification activities to be performed by the verifier to confirm the initial and continued suitability of the barriers for each phase of an asset’s lifecycleThis initial and continued suitability, through the remaining phases, will be verified against the specific criteria given within the performance requirements.(May also be referred as verification plan).


Term Definition


DNV GL AS

3.2 Abbreviations

3.3 Verbal forms

well intervention vessel (WIV)

a buoyant construction engaged in subsea well intervention operations

Table 3-2 Abbreviations

Abbreviation DescriptionALARP as low as reasonably practicable

BMS barrier management system

COMOPS combined operations

FLNG floating offshore LNG facilities

FP fixed platform

FPU floating production unit

FPSO floating production storage and offloading facility

FSO floating storage and offloading unit

FSRU floating storage and regasification unit

HAZID hazard identification

KPIs key performance indicators

MH’s major hazards

MoC management of change

MOU mobile offshore unit

PR performance requirement

SECE’s safety and environmentally critical elements

VS verification scheme

WIV well intervention vessel

Table 3-3 Verbal forms

Term Definitionshall verbal form used to indicate requirements strictly to be followed in order to conform to the documentshould verbal form used to indicate that among several possibilities one is recommended as particularly suitable,

without mentioning or excluding others, or that a certain course of action is preferred but not necessarily required

may verbal form used to indicate a course of action permissible within the limits of the document


Term Definition


DNV GL AS

SECTION 4 VERIFICATION PROCESS - CONCEPTS
4.1 Barrier management

4.1.1 Before the operator initiates a verification process, a risk-based barrier management system should be in place.

4.1.2 In a barrier management system, MH’s and related barriers are identified during formal risk assessment.

Guidance note:For more information on how risks can be assessed and suitable barriers identified, please see DNV GL Technology Leadership Reports:

— Barrier and Bow Tie Diagrams - January 2014— Risk Management – January 2015.


4.1.3 A risk assessment process model and how it relates to major accident barrier verification is depicted in Figure 4-1. It is a modified model of IEC/ISO 31010 Risk management – Risk assessment techniques.


DNV GL AS

Figure 4-1 Illustration of the relation between the major accident barrier verification and the risk assessment process

4.1.4 In a risk-based approach, the organisation has to establish the risk assessment context by defining the objectives, a risk criteria and a risk assessment program. This is followed by assessing the specific risk in the operations.

4.1.5 Based on the risk assessment outcomes, controls are identified to manage the risk. In this SE, “risk control” focusses on the barriers that prevent, detect, control, mitigate or respond to an event or accident caused by MH’s of an operation. The term, barriers can also be defined as safety and environmental critical elements (SECEs).

.


DNV GL AS

4.1.6
In addition to safety and environmental impact, the risks to be evaluated and covered by the barrier management approach can also be based on project economics, schedule, public relations, reputation or other criteria set by the operator.

4.1.7 Please see App.B for a list of typical barriers.

4.1.8 The required performance of a barrier is then documented in the PR (or performance standard).

4.1.9 The verification process and how it interfaces with the barrier management system is depicted in Figure 4-2.

Figure 4-2 Illustration of relationship between the barrier management system and the verification process

4.1.10 If the operator does not have a risk-based barrier management system in place, then see Sec.6.

4.2 Performance requirements

4.2.1 PR’s are an essential set of documents that will serve as a basis for the barrier assurance program and verification activity.


DNV GL AS

4.2.2
The PR describes the essential conditions that a barrier must maintain or provide on demand. It is a statement which can be expressed in measurable terms of the performance required of a system, item of equipment or procedure and which is used as the basis for managing the hazard and any events requiring emergency response, through the lifecycle of the asset.

4.2.3 The level of details in a PR may vary, but as a minimum the following characteristics should be considered in generating PR’s:

— Functionality

— What is it required to do?

— Availability

— For what proportion of time will the equipment be available to perform on demand?

— Reliability

— How likely is it to perform on demand?

— Survivability

— How will the system perform post event e.g. fire, explosion etc.?

— Interactions and dependencies

— Other barriers which are required to function in order for the one in question to also operate effectively.

Guidance note:Recognised norms and standards as well as company standards can also form basis for the PR’s. Further, where applicable, prescriptive requirements stipulated by the regulator shall be considered in the detailed criteria of the PR.


4.2.4 An example of a PR record can be found in App.C.

4.2.5 If the operator has not yet developed PR’s, see Sec.6.

Guidance note:Further detailed guidance on developing PR’s can be found in Appendix D of DNVGL-SE-0474 Risk based verification and step change in safety assurance & verification practitioner’s guide.


4.3 Operator assurance activities

4.3.1 Assurance is the term given to the range of measures that an operator will take to demonstrate to themselves and interested stakeholders that their assets possess sufficient integrity and that the plant, equipment and systems will operate with the required level of availability and reliability in relation to prescribed PR’s.

4.3.2 Good business practice drives operators to ensure assets have in place a documented and robust assurance management process to drive the safe operation of the asset throughout its operational lifecycle.


DNV GL AS

Guidance note:
Operators should take into account matters such as, equipment obsolescence, natural deterioration and the effects of ageing as the process entails maintenance and management activities including testing and inspection regimes for equipment as well as personnel training.


4.3.3 Assurance also includes design and construction of modifications and the management of change/impact on barriers through the use of a management of change (MoC) process.

Guidance note:See Step Change in Safety Assurance & Verification Practitioner’s Guide for guidance on this topic.


4.3.4 The assurance measure documentation should provide a short description of the performance assurance activity with clear ‘yes/no’ or ‘pass/fail’ criteria. If quantitative results have to be recorded (e.g. time, pressure, temperature), these should be specified in the performance criteria with the required units of measurement.

4.4 Verification scheme

4.4.1 How verification is managed should be detailed either through a written procedure or the verification scheme. This would normally be integrated into the operator’s management system.

4.4.2 The verification scheme should include, but not be limited to:

— roles and responsibilities, including reporting routes

— the arrangements for communication of necessary information— the PR’s

— the nature and frequency of examination and testing of barriers (verification activities)

— reporting of verification activities and findings— arrangements for making and preserving records

— review and revision of the verification scheme

— competency requirements of the DNV GL verifier

— interactions with other barrier critical processes and procedures i.e. management of change, temporary equipment, well examination, combined operations etc.

Guidance note:The verification scheme can be developed by the DNV GL verifier.


4.4.3 MoC is an important element supporting major accident prevention throughout an asset’s lifecycle. As such, the operator should ensure that a process is established for handling MoC, see [5.6].

Guidance note:Poor identification of the hazards and risks as a result of change can lead to improper change management and increase the potential for major incidents.



DNV GL AS

4.5 Setting of verification activities
4.5.1 The term verification represents the activities, (separate to assurance) which are performed by the DNV GL verifier to provide an independent assessment of the effectiveness of the barriers against the criteria stipulated in the PR’s.

4.5.2 Verification should not be considered a one-off task. It is recommended that this be carried out periodically in order to facilitate continuous monitoring of barriers to ensure their ongoing suitability.

4.5.3 The setting of verification activity scope shall depend on the risk level of each barrier, the content of the PR and their relative impact on the management of MH’s.

4.5.4 Risk analysis tools may be used to derive the verification scope, but for existing operational assets it may be preferable to make a simplified engineering judgement based risk assessment.

4.5.5 Verification activities are the instruction to the DNV GL verifier of how they shall confirm that the criteria specified in each PR are met. For each PR there should be at least one examination activity. The activities should include:

— what is to be done – a description of the examination activity to be performed to verify that each criterion specified in each PR is met

— type of examination activity to be performed, e.g. inspection, witness, review, audit— extent of involvement in activity, where applicable (e.g. percentage sample)— how often it is to be repeated (if relevant)— unique identifier for each activity, for control and reporting purposes — a clear reference to a specific PR — note of specific documents or processes (e.g. planned assurance activities, rolling inspection

programmes) which will be used as a basis for verification or for reference as part of the examination activity.

4.5.6 The following may contribute to the specification of interval or frequency of activity:

— requirements of recognised applicable standards— risk assessments— assumptions and conclusions of risk and/or reliability studies on relevant systems— extent of installation assurance routines and inspection plans— interval between the asset operator’s assurance activities— manufacturers recommendations for the equipment— findings of previous verification activities— result and performance demonstrated during verification activities.

Guidance note:The verification activities may be (optional) contained in a database application in order to facilitate the dynamic process of modifications and updates, and also provides a powerful management and reporting tool.



DNV GL AS

4.5.7
To further assist in the selection of scopes of work for verification activities, see App.E.

4.5.8 In reference to [4.1.6], for those verification requirements associated with other risks, DNVGL-SE-0474 and supporting standards should be consulted in order to define appropriate verification activities for all phases of the asset/systems.


DNV GL AS

SECTION 5 VERIFICATION PROCESS - METHODOLOGY
5.1 Performing verification - planning of scope

5.1.1 In order to successfully implement the verification scheme as described in Sec.4, for each campaign (and individual barriers) it is important to work with the operator’s team to create a detailed plan of the work to be carried out. A periodic plan is devised following discussions between DNV GL and the operator to schedule the offshore and onshore verification activities for each barrier.

5.1.2 Prior to each visit a detailed scope document is prepared in advance and presented in a planning meeting with both offshore and onshore personnel, this ensures that the operator’s management team understands the aim of the visit and may allow suitable resources to be available as necessary.

5.2 Performing verification - execution of onshore activities

5.2.1 A review of the operator’s assurance processes is an integral part of a verification scheme. The expectation is that the DNV GL verifier will undertake a technical review, covering the philosophy, methodology, scope and implementation of said assurance processes. The review should include matters such as defect management, deferments, barrier control inhibits, outstanding verifier findings etc., all with reference to the defined criteria in the PR’s.

5.2.2 It is recommended to prepare discipline specific and discrete scopes of work which will be subject to the onshore maintenance and documentation review immediately prior to attending the asset.

Guidance note:By taking smaller work packages, it ensures that the DNV GL verification engineer carries out a thorough review which will in turn direct his attention to specific technical details during the asset survey.


5.2.3 On completion of the scope of work, DNV GL can carry out further technical review onshore to follow up any areas which need clarification. The reporting will then be a combined onshore and offshore verification activity report.

5.3 Performing verification - execution of offshore activities

5.3.1 The offshore scope of examination is carried out according to the details given in the verification scheme; Activities will include a balance of inspection and witness type activities with priority given to those which can only be achieved offshore.

5.3.2 Defects and observations found should be summarized in a daily meeting to ensure clarity on the details and that where possible these can be corrected before the end of the visit.

A final close-out meeting is held with the offshore management team to review the activities completed and the final list of anomalies. A preliminary report should then be delivered to the offshore management team.


DNV GL AS

5.3.3
Once back onshore the DNV GL verifier will complete any further review activities and will follow up the preliminary report with the onshore operations and maintenance team to relay as much detail as possible and ensure any reported anomalies are valid and accurate.

5.3.4 For each issue raised, the DNV GL verifier should attempt to find the basic root cause behind the anomaly to benefit the customer.

Guidance note:Examples of customer benefits are illustrated in case studies 1 to 3 of App.A.


5.4 Reporting of verification

5.4.1 The reports shall clearly state whether the barrier examined meets the PR’s. The DNV GL verifier report shall contain adequate information to confirm completion of the verification scope of work. Reporting by exception is not considered best practice and both positive and negative results shall be reported, including actual equipment components examined.

5.4.2 Where the DNV GL verifier notes deficiencies within the PR’s or verification scheme these should be formally reported to the operator. This process, if different, should be documented within the verification scheme/procedure.

5.4.3 Reporting of findings needs to be comprehensive and justified, with due consideration of the value to the operator.

5.4.4 Where practical, action items/observations should be reported in terms of its criticality/seriousness i.e. action items should be ranked as having a high/medium/low priority for closure.

Guidance note:The following from the Step Change in Safety Assurance & Verification Practitioner’s Guide can be used as a guide when ranking action items:

— RED (HIGH LEVEL): Fundamental barrier assurance system failures that need senior management to remedy and/or resource, multiple failures of a PR and/or immediate threat to the integrity of the asset;

— YELLOW (MEDIUM LEVEL): Single PR failure with no immediate threat to the integrity of the asset; and— GREEN (LOW LEVEL): PR satisfied, but verifier may suggest an improvement to the system or may request additional information

to demonstrate compliance with a PR.


5.4.5 An informal, and unofficial, ‘quick’ report should be provided to appropriate parties when leaving the site to allow early attention to matters raised.

5.4.6 The DNV GL verifier shall issue the final verification reports in a timely manner.

Guidance note:Good practice is for the operator and DNV GL verifier to agree target reporting times, which can be documented under the verification scheme.



DNV GL AS

5.4.7
Periodic verification status reporting by the DNV GL verifier is also recommended. A regular report should include the following:

— completion of verification activities versus plan — the status of the findings showing open and overdue items— areas of concern.

5.4.8 App.F outlines the DNV GL in-service verification deliverables that are issued in relation to this SE.

5.5 Verification findings management

5.5.1 For findings raised by the DNV GL verifier, the operator should aim to identify and remedy the root cause in order to avoid recurrence and to promote internal learning.

5.5.2 A visible and robust method of tracking and closing verification findings is required. Database systems are good practice as they can provide visibility of issues/control responses and facilitate effective interrogation of the historical data to provide trends to assist in finding effective solutions.

5.5.3 DNV GL verifier should be involved in the close-out of verification findings and in each case it should be evident whether the verifier has agreed with the closure or not.

5.6 Management of change

5.6.1 For modifications to barriers the size of any change can vary substantially from a simple but critical modification all the way up to a major brownfield upgrade on an existing asset. The extent of verification will vary according to the complexity of change and this should involve a staged process of review to ensure that modifications are correctly selected, developed and executed.

5.6.2 Each operator may have differing processes, which should be detailed in the verification scheme, but they should broadly be in line with the following basic processes:

1) Initiate Change request outlining objective and reason of change and impact on barriers.

2) Define Develop and agree scope of verification activities dependent on the significance of the MoC in question.This may include one, some or all of the following activities:

— detailed design review— verification during manufacture/fabrication— verification during hook-up & commissioning — close-out review.

3) Execute Complete verification activities and issue verification reports.

4) Close-out/operateOn completion of all verification activities for the project.


DNV GL AS

5.7 DNV GL verifier responsibilities
5.7.1 Develop, or be consulted in the development of, the verification scheme and the periodic review.

5.7.2 The leader of the DNV GL verification team has the responsibility to ensure that the established scope (as agreed with operator and verifier), objective and level of verification is communicated to the verification team. The leader of the DNV GL verification team will also organise and plan resources according to the schedule agreed with the operator.

5.7.3 The leader of the DNV GL verification team also has the responsibility to ensure that the individual verifiers have the required competency to carry out the agreed scope of work in line with the overarching competency system.

5.7.4 Perform verification activities as defined in the verification scheme. The DNV GL verifier will identify any errors in the assurance management processes which could compromise the objectives of the barriers, i.e. being effective when required.

5.7.5 The DNV GL verifier shall undertake sufficient activities in order to form a professional judgement whether the barriers are likely to remain in good condition and repair and function as required until they are verified again.

5.7.6 Report to the operator on the suitability of the barriers detailing activities performed, findings and remedial actions recommended.

5.7.7 Communicate any reservations on the barriers or content of the verification scheme to the operator. The DNV GL verifier is providing an independent view of the suitability of the barriers to manage the risks.

5.8 Operator responsibilities

5.8.1 The operator should systematically identify hazards; assess the risks associated with those hazards being realised and put in place suitable procedures and measures to control the risks.

Guidance note:The operator is responsible for compliance either towards regulators or its corporate requirements. This covers a broad range of compliance through all lifecycle phases, including the need for continual assessment of the assets risk to be maintained at tolerable and/or as low as reasonably practicable (ALARP) levels.


5.8.2 The operator’s management system should effectively demonstrate the management of risks and incorporate the provisions for verification.

5.8.3 Ensure that the verification scheme is put into effect.


DNV GL AS

5.8.4
Provide adequate resources to facilitate the management of verification. This is partially achieved by having clearly defined verification activities and frequency within the verification scheme in order that suitable verifier resources can be resourced to execute the work scope.

5.8.5 Ensure the DNV GL verifier has the necessary access to the plant, maintenance records, management system and other systems.

5.8.6 The operators are required to provide documents, information and data requested by the DNV GL verification team in a timely manner.

5.8.7 Periodically audit the verification scheme as part of the management system.

5.8.8 Ensure that a periodic review of the verification scheme is completed by, or in consultation with, the DNV GL verifier and, where necessary, revise or replace it. This should consider the evolving phases of the lifecycle, material changes, and the impact of ageing where a more thorough review may need to take place.

5.8.9 Ensure that a note is made of any action items/observations made by the DNV GL verifier on the verification scheme.

5.8.10 Notify the DNV GL verifier in the event of major repairs and breakdowns of barriers.

5.8.11 Maintain records of reports and correspondence from the DNV GL verifier.

5.8.12 Carry out initial screening of barriers to identify those affected when modifications to assets are carried out.

5.8.13 Ensure that a documented competency system is in place, with traceable means of assessment, clearly stating the criteria and method of assessing the individual DNV GL verifier. The operator should carry out regular competency reviews to ensure compliance against this process.


DNV GL AS

SECTION 6 STEPS FOR ESTABLISHING VERIFICATION SCHEME
WITHOUT A BARRIER MANAGEMENT SYSTEM

6.1 General

6.1.1 When the risk assessment process and how it relates to major accident barrier verification has not been completed, DNV GL can utilise industry best practice and experienced based PR’s for relevant barriers appropriate to the asset type, see App.B.

6.1.2 Prior to commencement of detailed activities, the DNV GL verifier and the operator shall agree on the barrier selection and PR’s, and a verification scheme shall be developed in line with this SE, see [4.2] to [4.5].


DNV GL AS

SECTION 7 MAINTAINING AN EFFECTIVE VERIFICATION SCHEME
7.1 General

7.1.1 When an operator has elected to employ a major accident barrier verification scheme it should be obvious, to gain maximum benefit, that management shall own the process and put in place certain steps to ensure that the system is subject to continuous review and maintained up-to-date. They shall ensure that the effectiveness of the scheme is continuously monitored.

7.1.2 The objective of this section is to recommend particular steps that an operator may wish to employ to ensure the effectiveness of the scheme.

7.1.3 In under taking such a process the operator can ensure that the barrier verification scheme is robust and efficient in contributing to preventing a major accident or environmental incident.

7.1.4 The DNV GL verifier should have an active role in supporting the operator to maintain an effective verification scheme.

7.1.5 The process of maintaining an effective barrier verification scheme is illustrated in Figure 7-1.


DNV GL AS

Figure 7-1 Illustration of the process of maintaining an effective barrier verification scheme


DNV GL AS

7.2 Review and audit process
7.2.1 Management reviews of the effectiveness of the selected barrier verification process should be made and can be initiated by the following:

— periodic, as defined within the company management system

— major modifications to the asset which result in amendments to the list of barriers or PR’s

— changes to the asset operating parameters or environmental conditions

— revision of any codes/standards referenced in the verification scheme

— incorporate new learnings from within the operators own organisation, other industry developments and regulatory body developments

— consider if the scheme is still suitable as required by governing regulations.

When the barrier management system is subjected to a management audit, such an audit should consider the following aspects:

— any action items/observations issued by the DNV GL verifier

— status of planned verification activities and any overdue items

— revisions made to the verification scheme since the last audit

— the continuing validity of the record of barriers

— the continuing validity of the record of PR’s

— the continuing validity of the verification activities and their frequency

— internal/external audits by the customer (operator or licensee) and regulatory body.

7.2.2 Changes to the barrier verification scheme should be well managed to ensure that all relevant personnel are made aware of the changes and their consequences.

Guidance note:Depending upon the content of the verification scheme, barrier owners (technical authorities or subject matter experts), discipline engineers, safety engineering, operator verification regime focal points and independent verifiers may need to be involved.


7.2.3 In the case of PR’s, consideration should be given to the addition of criteria which may be necessary to address failure modes that may emerge or develop as a result of the ageing process which can impact on assets in later life.

7.3 Operator – check process

7.3.1 Operators should establish a robust monitoring process to ensure the timely and satisfactory execution of the barrier verification scheme. This should include the monitoring of:

— the timely and satisfactory completion of verification activities

— the closure of action items/observations issued by the DNV GL verifier

— the performance trending of barriers to forecast when they are likely to reach a status of nonconformity, thus enabling mitigating programmes to be put into place in a timely manner

— the status of barrier verification KPIs.


DNV GL AS

7.3.2
The operator should ensure that monitored data is visible for all key stakeholders.

Guidance note:Common industry practice is to utilise web-based systems which are integrated into the operator’s assurance system supported by front end dashboards.



DNV GL AS

SECTION 8 APPLICATION AND INTERFACE WITH OTHER COMMON
OPERATIONAL & REGULATORY SITUATIONS

8.1 Scope and objectives

8.1.1 This section aims to provide a framework for addressing how the in-service verification phase should interface with the following common operational and regulatory interface situations:

— classed offshore units— combined operations (COMOPS)— decommissioning and abandonment.

8.2 Application and interface with classed offshore units

8.2.1 General8.2.1.1 Offshore classification establishes basic rule requirements based on theory and experience for MOUs. It verifies that the required safety standards are designed and built into the vessel and its main systems, and supports the owner in ensuring that they are observed and maintained during the unit’s operation.

8.2.1.2 Classification of offshore units can be used as a basis for, or in support of, PR’s and activities to both assure and verify compliance.

Guidance note:It should be noted that the classification process does not imply compliance with regulatory regime requirements alone, and should not be considered as a substitute or replacement for these.


8.2.1.3 The classification process provides valuable benefits in the maritime environment of the offshore industry. The most significant benefits are:

— rules are based on experience, current best practice and are frequently updated— requirements apply to the main structures and systems which are important for safety and integrity— the approval process (independent verification) is systematically applied and documented from design

through to operation.

8.2.1.4 Work under verification requirements and classification can be combined wherever possible to:

— take advantage of the experienced systematics and resources of classification— improve cost efficiency through avoiding unnecessary duplication of work, i.e. to the extent that the

classification and verification scopes are executed in an integrated manner.

Guidance note:Certain regulatory authorities have accepted that work carried out under the scope of class/flag can be considered as contributing to fulfilling the requirements of the verification regime. It is accepted that there is no need for duplication of the same items under different headings.


8.2.2 Application8.2.2.1 PR’s can be built around classification rules where the rules can be demonstrated to meet or exceed criteria identified from the operator’s barrier management studies and/or shelf state regulatory regime requirements.

8.2.2.2 The classification systematics are similar in principle to that defined by a typical verification regime and credit can be taken, where applicable, for the work carried out under the class process towards fulfilling the expectations of the PR’s where no other additional requirements have been stated.


DNV GL AS

8.2.2.3 Where classification society rules do not fully meet the expectations of the PR’s, classification can
still be recognized as a contributor to verification, but additional verification tasks will need to be completed by the DNV GL verifier.

8.2.2.4 Reporting of verification activities (for all in-service verification lifecycle phases) should be completed in accordance with the requirements laid out in the verification scheme.

8.3 Application and interface with combined operations (COMOPS)

8.3.1 General8.3.1.1 There are a number of interfaces during a combined operation, these interfaces can include hardware or software interfaces (such as, alarms, communications, means of escape, firewater systems interconnections, hazardous areas etc.), which are likely to result in an amendment to the record of barriers for the respective assets.

8.3.2 Application8.3.2.1 The interfaces should be clearly defined before the combined operations commence. A key component of this is to ensure that a robust communication process is established between all parties in order to avoid assumptions being made about responsibilities and activities.

Guidance note:Common industry practice to facilitate this can take the form of:

— prior to commencement of COMOPS the operator and partners will review the relevant interfaces

— a bridging document can be prepared, which will have clearly defined scope of work for potentially different verifiers

— the scopes are then agreed by both verifiers and accepted in writing to the relevant operators.


8.3.2.2 The operator and verifier for each asset must understand and agree the barriers and PR’s affected, as well as defining the verification activities required to be performed by the verifiers.

8.3.2.3 Any resulting changes to the incumbent verification schemes can be included as an appendix for the duration of the combined operations.

8.3.2.4 Verification findings raised by the verifiers should be managed as defined in the incumbent verification scheme, but both operators should be notified of the outcome.

8.3.2.5 Following the end of the combined operation, the verifier should carry out verification activities to ensure that the integrity of the asset has been returned to its original state, or complies with the requirements for the revised arrangements following modifications.

8.4 Application and interface with decommissioning and abandonment phase

8.4.1 General8.4.1.1 When a field eventually ceases production, the final phase is decommissioning and abandonment. This broadly involves the plugging and abandonment of all wells, cleaning of manifolds and pipelines, and the removal of topsides and subsea facilities and sub-structure to shore.

8.4.2 Application8.4.2.1 Operators should carry out a new hazard assessment, which may lead to a revised list of barriers being identified to manage those hazards.


DNV GL AS

8.4.2.2 New PR’s, relevant means of assurance and verification will then be required to be developed for
each phase. The development should focus on:

— what barriers are actually required— what the barriers must achieve— what order/sequence the barriers are being removed/’switched off’.

Guidance note:All barriers must remain effective until the associated hazard is no longer present (e.g. gas detectors should remain operational until the installation is permanently gas free).


8.4.2.3 The operator and verifier should understand and agree on the newly identified barriers, PR’s, relevant means of assurance and verification.

8.4.2.4 Hazards may change during the different phases of decommissioning and abandonment and plans/procedures should be established for the timely review/revision to ensure that appropriate barriers and PR’s are in place for the correct hazards and; inspection, maintenance, assurance and verification activities, are aligned.

8.4.2.5 The operator should ensure that activities required for decommissioning and field abandonment are documented.


DNV GL AS

APPENDIX A BENEFITS OF DNV GL IN-SERVICE VERIFICATION
In general, the requirement for verification from regulators, operators and other stakeholders is driven by:

— a need for trust and confidence while managing risk and identifying improvement opportunities— reputation concerns: The media will very quickly publicise accidents, which in turn affect share price and

reputation — the needs of insurance market: Verification itself is not insurance, but independent verification can be

a requirement from insurance companies and owners or financing institutions.

The external verification market is not driven by legislation and official requirements alone. In many cases, asset operators choose to work with external parties such as DNV GL due to the following advantages we can offer:

— technical competence and expertise,— a trusted brand,— an independent view and approach,— quality assurance,— insight into best practices, international or other relevant experience.

More operational specific advantages for an operator in applying an in-service verification approach may include:

— reduced probability of undesirable events— improved availability and reliability through the known condition of critical plant— cost and time savings through avoiding undue attention to areas and activities that are low contributors

to risk— a demonstrable and auditable case for safety to key stakeholders.

A pictorial overview of the benefits and value which DNV GL offers with regards to in-service verification is depicted in Figure A-1.

Figure A-1 Illustration of DNV GL in-service verification benefits and value statement


DNV GL AS

The following case studies illustrate the advantages described above in a practical application:
A.1 Verification case studies

Example 1

1. Provide a single sentence summarising the relevant system and issue

Fire pump availability impaired due to a fire pump being offline and lack of redundancy in remaining fire pumps. Verifier identified a potential issue with reliability/availability.

2. Describe the problem and how verification identified this

Issue:

It was identified through offshore inspection/testing that one of four fire pumps was currently offline due to issues with the diesel engine of one of them. This was known to the platform management and replacement parts were on order. This left 3 pumps online (1 × diesel and 2 × electric) which is more than sufficient in normal operation as only 2 pumps are needed to supply firewater for the worst case demand scenario.

Through verification and DNV GL’s consequence based approach further consideration was given to the availability and reliability of the complete fire water system, it was questioned if the current fire water pump set-up still had sufficient capacity for all scenarios.

The operator’s fire water pump availability matrix document was reviewed to confirm if any mitigation measures were required under the operator’s own procedures.

It was found that for the given situation that if availability is reduced to 1 diesel and 2 electric fire pumps then the platform power generation system (2 off gas turbines) should be immediately switched to diesel supply instead of fuel gas.

This mitigation was put in place in order to prevent the scenario that in the event of a power outage, the electric fire pumps would trip, which would only leave one fire pump (diesel) available.

Improvements made:

— operator raised awareness of their own procedural requirements

— control room operators now utilise a copy of this matrix on the F&G panel in the CCR for consideration at all times when fire pumps going offline/out of service

— performance standard reliability/availability section revised to include this matrix document and criteria amended accordingly

— diesel supplies and storage quantities reviewed to ensure sufficient volume available for given scenarios.

Benefits:

— availability and reliability of critical safety system remains assured

— avoid potential situation with serious reduction in fire water

— avoid unnecessary production impact and losses due to a fuel gas shutdown.

3. Explain the potential consequences which may have arisen should Verification not have identified the issue.

— firewater coverage not sufficient to mitigate against any fire scenario leading to potential escalation

— revenue loss due to production shutdown.

Example 2


Following testing and subsequent investigation, verifier identified a significant reliability/availability issue with an import production riser emergency shutdown valve (ESDV).


DNV GL AS

Issue:

During high level ESD system function testing (as directed by the in-service verification scheme), the verifier noted that the production riser ESDV failed to close. On discussion with production technicians it became apparent that the ESDV in question had recent issues with respect to closing on demand.

Following interrogation of unplanned shutdown records, as a means to substantiate the above, it was evident that the valve had been recorded as not operating correctly for approximately 8 months. The verifier could not find any evidence within the operator’s assurance process which could justify continued operation with a known faulty riser ESDV.

As a consequence the verifier raised a high level finding recommending that the operator a) provides justification (risk assessment, mitigating factors etc.) for continued operation with a known faulty riser ESDV and b) evaluates its safety management system with regards to the evaluation of risk and mitigation measures associated with the failure of a barrier.

Improvements made:

— riser ESDV was immediately repaired, re-tested and confirmed to close on demand— assurance routine frequency of testing was increased with immediate effect— risk assessment with associated mitigating factors was immediately applied— operator carried out extensive updates to its safety management system and associated assurance

process — operator looked into long term suitability of the valve design on the asset in question and its other

assets.

Benefits:

— performance requirement availability and reliability remains assured — reduction in risk of a major accident hazard— increased confidence that barriers will operate as specified and upon demand — reputation secured.

3. Explain the potential consequences which may have arisen should verification not have identified the issue.

— barriers would not have been effective during a major accident resulting in an escalation of the event and potentially leading to fatalities and potential major environmental incident

— in order to maintain safe operations, the decision to shut down operation until barrier was compliant may have been necessary, resulting in loss of production. This was avoided by the thorough approach taken by both the verifier and the operator

— potential for high focus from local regulator was avoided— any MAH event as above would have led to Worldwide media, public scrutiny and criticism.

Example 3


Verifier identifies safety critical assurance testing not completed on the operator’s assets cranes.


Issue:

During completion of annual operational verification in compliance with the operator’s verification scheme, a visit to verify the cranes was scheduled. When the verifier arrived on the asset he was informed that one crane had been fully completed already but that the second crane was still scheduled to be completed entirely. On attempting to verify the cranes control system, the maintenance technician commented that the test could not be completed as he did not have the correct test equipment or suitable experience at the current time to complete the test and should be rescheduled to a later date.


DNV GL AS

The verifier enquired how the first crane had been completed - had the situation changed since then? It was
confirmed that no change in personnel or equipment had taken place.

The verifier then reviewed the detailed maintenance history noting that all historical notes (for routines on a 3 month period) were identical for the last 2 years: none of the text contained information confirming the safety critical test was suitably completed.

It was clear from the DNV GL review that although the performance requirement and the instructions within the maintenance routine were clear on the actual test to be completed that the tests were incomplete and the records were not accurately completed. A review of the memory function within the cranes protection device confirmed that the test had not been carried out for 2 years.

Improvements made:

Company responsible for maintenance of crane:

— mobilised a competent person with correct equipment immediately— completed the assurance test as per the maintenance routine— provided a competent person on the rota for maintenance— provided a copy of the control system memory to the operator.

Operator:

— shared all information with the verifier to allow for thorough investigation— identified a competence gap on the rota offshore — amended the reviewer of WO history to be lead technicians only.

Benefits:

— correct assurance testing now being completed in accordance with the maintenance strategy— thorough review of maintenance records by competent persons to ensure detailed history is suitable for

the task completed— operator is now confident that suitable assurance testing being completed.

3. Explain the potential consequences which may have arisen should verification not have identified the issue

— potential loss of a major equipment through premature failure of major systems— potential for high focus from local regulator was avoided— potential for MAH scenario (dropped object) coming to fruition.


DNV GL AS

APPENDIX B EXAMPLE LIST OF TYPICAL BARRIERS
The following table presents typical high risk barriers with respect to safety of personnel and environment for the main types of offshore assets. These are often called safety and environmentally critical elements (ref e.g. UK Safety Case regime, EU Directive). This list is intended as a tool to help to ensure that key systems identified as high(est) risk are not omitted. However, the list shall not be construed to be exhaustive and shall only be used without due considerations.

TPYPICAL HIGH RISK BARRIERS & BARRIER ELEMENTS

MO

DU

/W

IV

FLO

ATE

L

FPS

O/

FSO

/FP

U/

FL

NG

/FS

R

FP

STRUCTUREJackets and piles - - - XGravity based structure - - - XJack-up legs and associated jacking and locking systems X X - -Hull (including watertight closures) X X X -Drilling derrick X - - XFirewater caisson and supports - - - XTopsides primary structure including bridge and flare tower X X X XHelideck X X X XLifting (cranes) and hoisting (drilling equipment) X X X XCrane pedestal X X X XFoundations X X X XBlast protection including blast venting provisions X - X XDropped object protection incl. subsea protective structures X X X XTurret - - X -DRILLINGMud systems X - - XBlowout preventer system X - - XChoke and kill (including emergency blowdown) X - - XCement system X - - XMarine riser system X - - XWell control instrumentation X - - XDiverter system X - - XWELLSFIXED PLATFORM WELLSCasings - - - XProduction casings, liners - - - XTubing string and all accessories - - - XDHSV (retrievable), control line(s), tubing hanger, penetrator and tubing head valving - - - X

Complete wellhead assembly and including annulus valves - - - XComplete production tree including: tubing bonnet, valves and components within the tree - - - X

SUBSEA WELLSCasings X - X -Production casings X - X -Liners, tubing string, accessories X - X -

Annulus tubing with associated landing nipple X - X -


DNV GL AS

DHSV, control line, and tubing hanger penetrator X - X -

Subsea high pressure wellhead assembly X - X -

POWER

Emergency power X X X X

Battery systems X X X X

Protection of electrical equipment X X X X

Computer software X X X X

IGNITION PREVENTION

Electrical earthing continuity X X X X

Electrical equipment in hazardous areas X X X X

Protection of hot surfaces X X X X

Natural ventilation X X X X

Lightning protection X X X X

Shutdown philosophy X X X X

FIRE AND GAS

Gas (flammable and toxic) detection system X X X X

Fire detection system X X X X

Deluge X X X X

Sprinklers X X X X

Fire pumps X X X X

Firewater ring main X X X X

Foam system X X X X

Gaseous systems (e.g. Halon, CO2) X X X X

Passive fire protection (including doors, walls and penetrations) X X X X

Ventilation systems X X X X

EMERGENCY RESPONSE AND EVACUATION

Temporary refuge X X X X

Escape routes X X X X

Helideck systems (markings, nets, obstacle marking/lighting etc.) X X X X

Escape (battery-backed) lighting X X X X

Internal communications (e.g. public address/general alarm, manual alarm call points, telephones) X X X X

External communications (including marine and aviation) X X X X

PPE (incl. lifejackets, survival/immersion suits, helideck crash equipment) X X X X

ESCAPE SYSTEMS

Descent to sea systems (personal descent devices, knotted ropes, nets) X X X X

Ladders to sea X X X X

Life rafts X X X X

Standby vessel and associated fast rescue craft X X X X

TEMPSC/lifeboats X X X X


MO

DU

/W

IV

FLO

ATE

L

FPS

O/

FSO

/FP

U/

FL

NG

/FS

R

FP


DNV GL AS

HYDROCARBON CONTAINMENTTopside and subsea hydrocarbon piping and equipment (including valves and instrumentation) - - X X

Emergency shutdown system including software, process shutdown, high integrity protection systems, overpressure protection systems etc. X X X X

Cryogenic spill protection - - X -

Relief and blowdown system - - X X

High speed machinery trips X - X X

Local atmospheric vents X - X X

Drains (open and closed hazardous) X X X X

Risers and riser emergency shutdown valves - - X X

Powered emergency release couplings - - X -

Pipelines - - X X

Pipeline subsea isolation valves - - X X

Pipeline leak detection system - - X X

Pipeline corrosion protection system - - X X

LNG transfer lines - - X -

Cryogenic pressure vessels, piping and equipment - - X -

LNG storage tanks - - X -

MARINE

Mooring (including move-off) X X X -

Navaids (including lights, foghorns, marine/weather monitoring systems) X X X X

Radar early warning system X X X X

Ballast and bilge (stability) X X X -

Inert gas system - - X -

Dynamic positioning system X X X -

Thrusters X X X -

TEMPORARY EQUIPMENT

Bridge connections to support vessels X X X X

Gas cylinders and attachments X X X X

Power generators X X X X

Temporary public address/general alarm systems X X X X

Well test equipment X - - X

Radioactive source store X - X X

Explosives store X - - X

SAFETY MANAGEMENT SYSTEM X X X X


MO

DU

/W

IV

FLO

ATE

L

FPS

O/

FSO

/FP

U/

FL

NG

/FS

R

FP


DNV GL AS

Service specification, D

NVG

L-SE-0466 – Edition S

eptember 2016

Page 42

DN

V G

L A

S

APPENDIX C PERFORMANCE REQUIREMENT FORMAT EXAMPLE

Hazard management role

sary equipment Prevent, detect, control, mitigate, rescue and recovery

loads are supplied via the emergency switchboard ency generator starts and supplies the emergency

of four sub-systems which provide the following unications, FSU control and supervisory systems,

nnectors on the cable are covered under the

ary to fulfil this SCE.

equipment in the event of a hydrocarbon release.

control system.

Hazard management goal

To provide a reliable and secure power supply during an emergency to allow continued safe operation of all the necesand systems.

Barrier description/boundary

Emergency power is provided from one of two sources, the emergency generator and the centralised UPS. The emergency generator is designed to operate in island mode to provide power to the essential loads. The essential AF-EN-5301. Upon loss of main generation all systems will be isolated with the exception to UPS loads until the emergswitchboard.The centralised UPS is supplied via the main generation system and also from the emergency generator, it consists supplies 115V AC, 110V DC and 48V DC. The centralised UPS supports the ESD/F&G system, external/internal commelectrical switchgear control and NAV AIDs. All electrical power cabling/electrical protection which connects the systems is covered under this PS however the coHazardous Area Equipment Performance Standard.

Dependencies Role

FIRE & EXPLOSION PROTECTION Required to provide protection to the main equipment’s necess

HYDROCARBON CONTAINMENT / STATIC EQUIPMENT Required to provide fuel systems for the emergency generator.

TEMPORARY REFUGE Required to house the essential components for this SCE.

Interactions Role

: ACTIVE FIRE PROTECTION SYSTEMS Required to provide power to the fire pumps.

: EMERGENCY & ESCAPE LIGHTING Required to provide power to the individual luminaires.

: EMERGENCY SHUTDOWN & BLOWDOWN SYSTEM Required to provide power to the ESD system

: EXTERNAL COMMUNICATIONS Required to provide power to the communications system.

: FIRE & GAS DETECTION SYSTEM Required to provide connections to end users.

: HAZARDOUS AREA HARDWARE To ensure that no spark potential is provided from the use of this

: HELICOPTER FACILITIES Required to provide power to the helideck lighting systems.

: HVAC ENCLOSED AREAS Required to provide connections to end users.

: INSTALLATION LOCATION SYSTEM Required to provide power to end users.

: INTERNAL COMMUNICATIONS Required to provide power to the communications system.

: STABILITY & BALLASTING SYSTEM Required to provide power to the loading computer and ballast

: SHUTTLE TANKER POSITION KEEPING Required to provide power to the positioning system.


NVG


eptember 2016

Page 43

DN

V G

L A

S

Performance criteria Verification activities

i

tivity description

Freq(m

on

ths)

Offsh

ore?

TAR

?

rm the emergency generator and. 12 Y N

rocedures and history to ergency generator is tested 12 Y N

rm the emergency generator and provides power to itchboard AF-EN-5301

12 Y N

onfirm that the fuel tank has 12 Y N

rgency generator starts when zero volts are detected usbar.

24 Y Y

rocedures and history to ergency generator starts when zero volts are detected usbar.

24 Y Y

rm the emergency have power supplied form the nerator only.

24 Y Y

Safety function Functional requirements/acceptance criteria Related assurance activities

Verificatio

ntem

nu

mb

er

Ac

The emergency generator shall start on demand

The emergency generator shall be capable of starting under two different methods. These are pneumatic air via compressor and pneumatic air via the black start compressor.

XXX

EP-01 TEST To confistarts on dem

EP-02REVIEW PM pensure the emperiodically

The emergency generator shall provide power onto the distribution board

When the generator stabilises the emergency generator shall synchronise and provide power onto the main emergency switchboard AF-EN-5301.

XXX EP-03TEST To confisynchronises emergency sw

The emergency generator shall have sufficient fuel

The emergency generator has a 5m3 fuel tank which should be 75% full. XXX EP-04 INSPECT To c

sufficient fuel.

The emergency generator shall start automatically

The emergency generator should start automatically on zero volts detected on the 440v busbar. XXX

EP-05TEST The emeautomatically on the 440 v b

EP-06

REVIEW PM pensure the emautomatically on the 440 v b

The emergency distribution system shall provide power

The emergency distribution system should provide power to the consumers via one of the two emergency switchboards AF-EN 5302 (Accommodation Emergency Switchboard) or AF-EN-5304 (Turret Emergency Switchboard).

XXX EP-07TEST To confiswitchboards emergency ge


NVG


eptember 2016

Page 44

DN

V G

L A

S

rm the UPS can support the for 15 minutes with results ut to ensure that the UPS can stems.

24 Y Y

onfirm cabling is secured 12 Y N

Verification activities

tivity description

Frequ

ency

(mon

ths)

Offsh

ore?

TAR

?

rification of functionality. - - -



Performance criteria Verification activities

i

tivity description

Freq(m

on

ths)

Offsh

ore?

TAR

?

The centralised UPS shall provide uninterruptable electrical power to designated systems

The UPS should be capable of providing 115v AC to the following systems for 60 minutes:

— fire and gas system— ESD system— telecommunication systems— process control systems— supervisory control system.

XXX

EP-08

TEST To confidesigned loadextrapolated osupport the sy

The UPS should be capable of providing 48v DC to the Telecommunications PA Systems for 60 minutes. XXX

The UPS should be capable of providing 110v DC to the switchboard electrical trip and closure system for 60 minutes.

XXX

Distribution cabling shall connect the end user to the network

All power cabling should be suitably rated for the environment it is located, with terminations completed in an approved manner. The cable should be installed as per IEC 60092-350. All cabling should be minimum of flame retardant according to IEC 60332-1-2 and IEC 60332-3-22. All cabling for equipment used as part of an essential/safety system shall be fire resistant to IEC60331-21 or IEC 60331-31.

XXXX EP-09 INSPECT To ccorrectly.

Availability criteria

Requirements/acceptance criteria Related assurance activities

Verificatio

n item

nu

mb

er

Ac

The emergency generator shall be 100% available when the system is in operation. XXXX NIL Covered by ve

The centralised UPS shall be 100% available when the system is in operation. XXXX NIL Covered by ve

The power distribution network shall 100% available when the system is in operation. XXXX NIL Covered by ve

Safety function Functional requirements/acceptance criteria Related assurance activities

Verificatio

ntem

nu

mb

er

Ac


NVG


eptember 2016

Page 45

DN

V G

L A

S

Reliability criteria Verification activities

tivity description

Frequ

ency

(mon

ths)

Offsh

ore?

TAR

?

rgency generator to confirm it e load for 1 hour test run. 12 Y N

rocedures and history to PS load test results he UPS can support the .

24 N N

Verification activities

e V

erification

item n

um

ber

Activity description

Frequ

ency

(mon

ths)

Offsh

ore?

TAR

?

/ NIL

Covered by verification of functionality.

- - -

NIL Nil - - -

Requirements/acceptance criteria Related assurance activities

Verification

item n

um

ber

Ac

The emergency generator should be capable of powering the essential loads. The essential loads have been calculated at 350kW. XXX EP-10 TEST the eme

can support th

All UPS should be capable of supporting the loads required. XXX EP-11

REVIEW PM pconfirm the Udemonstrate tessential load

Survivability criteria

Event System characteristics/measures Related assurancactivities

Fire and explosion

The emergency generator, main emergency Sw Bd and distribution system is located on Level 02 within an H120 rated module. The location of the accommodation emergency Sw Bd is Level 01 within the H120 rated TSR. The location of the turret emergency Sw Bd and distribution system is in a safe area, forward and below the main deck within an A60 rated enclosure.The location of the 115v AC UPS and distribution system is within the H120 rated TSR. The location of the 110v DC UPS and distribution system is within the H120 rated emergency generator room. The location of the 48v AC UPS and distribution system A is within the H120 rated TSR. The location of the 48v AC UPS and distribution system B is within the H120 rated emergency generation module which is H120 rated and located aft of the main deck and accommodation module.All cabling for equipment used as part of an essential/safety system shall be fire resistant to IEC60331-21 or IEC 60331-31.

Assured by originalmodification designspecification.

Loss of stability Main system equipment shall be protected from event by location, see Fire and explosion. N/A


NVG


eptember 2016

Page 46

DN

V G

L A

S

NIL Nil - - -

NIL Nil - - -

NIL Nil - - -

/ NIL

Covered by verification of functionality.

- - -

Final approval

Survivability criteria Verification activities

e

Verificatio

n item

nu

mb

er

Activity description

Frequ

ency

(mo

nth

s)

Offsh

ore?

TAR

?

Vessel impact Main system equipment shall be protected from event by location, see Fire and explosion. N/A

Helicopter incident

Main system equipment shall be protected from event by location, see Fire and explosion. N/A

Dropped object Main system equipment shall be protected from event by location, see Fire and explosion. N/A

Extreme weather

All cabling should be minimum of flame retardant according to IEC 60332-1-2 and IEC 60332-3-22.

Assured by originalmodification designspecification.

Referenced documentation

Document number Title

XXX-AF-316-001-001 to 005 ASSET Field Operational Safety Case

Approvals

Reviewed by Company TA approval

Date: Date: Date:

Event System characteristics/measures Related assurancactivities

APPENDIX D REGULATORY REGIMES (A BRIEF OVERVIEW)
Australia:

The regulatory regime is objective-based (goal setting), but with prescriptive elements. An accepted safety case is required in order to undertake activities. The basic premise is that the ongoing management of safety is the responsibility of the operator and not the regulator NOPSEMA.

There is a requirement for a one off Validation of the Safety Critical Elements Codes & Standards by an independent validator prior to the safety case being accepted by the regulator for facilities planning to operate in Australian waters. The independent validator is employed by the operator.

Although the regulations indicate ongoing monitoring and maintaining of control measures is required of the operator, there is no requirement for in service verification to be undertaken by an independent verification body (IVB).

Brazil:

The regulatory regime is based on the ANP (petroleum agency regulator) and on the DPC (Brazilian flag administration). Both demand recognized independent companies to provide verification services. Related to the ANP, the main activities are the National Content Verification and the commissioning of Pipelines for Hydrocarbon Transportation. For the Brazilian flag administration, there are statutory requirements for fixed offshore installations, but the certification is optional although the operators normally contract a class society to certify their units in order to get insurance advantages, to increase safety and to ensure the compliance with the requirements. Petrobras, the main operator, has also the practice to request that offshore pipelines and risers are verified according to applicable DNV GL SE/ST’s.

Canada:

A blend of goal-oriented and prescriptive regulations is in place. The Chief Safety Officer and Chief Conservation Officer may however, subject to certain criteria, authorize the use of equipment, methods, measures, or standards in lieu of any required by regulation, or grant an exemption from any regulatory requirement in respect of equipment, methods, measures, or standards.

Production units must comply with the Drilling, Installation and Production Regulations, and be issued with a Certificate of Fitness from an approved Certifying Authority (e.g. DNV GL).

In addition, all units (drilling and production as well as diving and accommodation) must comply with the Petroleum Installations Regulations, the Petroleum Drilling and Production Regulations and the Oil and Gas Occupational Safety and Health Regulations. A Certificate of Fitness from a recognized certifying authority is required for installations (drilling, accommodation, diving, and production installations).

China:

SAWS, the regulator responsible for the activities relevant to offshore oil development, qualifies Certification Authorities and other agencies relevant to safety inspection/risk assessment.

Verification of compliance is, to a certain extent, made by qualified independent certification authorities: only five, including DNV GL are qualified by SAWS.

The requirements are extensively substantiated by referencing recognised national and international standards.

Denmark:

The operator is ultimately responsible for establishment of a management system ensuring safety on its offshore installations.

As part of the Danish Offshore Safety Act it is the responsibility of the operator to identify recognized norms and standards that are important to health and safety and implement them in its management system. These recognised norms and standards must be followed and can only be deviated in order to reach a higher safety level or as a result of industry development.

Further, the Danish offshore safety act and underlying executive orders and guidelines pursuant to this act describe the requirements for establishing a verification scheme for SECE’s and well barriers. The operator must present the verification scheme along with verifiers’ comments during the establishment of this scheme to the authorities.


DNV GL AS

The verification shall cover the suitability of the SECE’s and well barriers in line with their specifications,
which also include recognized norms and standards as well as good industry practice. The verification shall also cover survey and testing of the SECE’s.

D.1 EU Offshore Safety Directive 2013/30/EU:Parts of the new EU Directive which will affect DNV GL verification services, are listed below: “Independent verification” means an assessment and confirmation of the validity of particular written statements by an entity or organisational part of the operator or the owner of the non-production installation that is not under the control of or influenced by, the entity or organisational part using the statements.

The verifier role must be described in the safety and environmental management system (included in the major hazards report).

The verifier is required to be:

— providing independent assurance during design, operation, examination and testing of SECEs and ECEs (as defined in the major hazards report)

— independently assuring well design and well control measures, and— further verifying and reporting on any material changes, as required by the competent authority.

Scheme for independent verification shall be established.

The goal is to provide independent assurance of well design and well control measures.

For production installations, the scheme shall be in place prior to operations, while for non-production installations, the scheme must be in place prior to the installation being operated in EU waters.

The independent verifier shall meet the following requirements with regard to its independence from the operator and the owner of the non-production installation:

— His function does not require him to consider any aspect of a safety and environmental critical element or specified plant in which he was previously involved prior to the verification activity or where his objectivity might be compromised.

— He is sufficiently independent of a management system which has, or has had, any responsibility for any aspect of a component in the scheme of independent verification or well examination so as to ensure he will be objective in carrying out his functions within the scheme.

Member states shall require that the operator and the owner of the non-production installation ensure that the independent verifier is able to meet the following requirements with regard to his competence:

— technical competence, including suitably qualified staff in adequate numbers and with sufficient experience

— suitable allocation of tasks by the independent verifier to staff qualified to undertake them— suitable arrangements for the flow of information between the operator and the independent verifier— sufficient authority given by the operator to the independent verifier to be able to perform his functions

adequately.

Material changes shall be referred to the independent verifier for him to undertake further verification, and the outcomes of further verification shall be communicated to the competent authority, if requested.

Installations outside the EU

While the Directive applies only to the EU, it does also state that it expects ‘responsible operators and owners’ to conduct their operations worldwide according to their major accident prevention policy. This includes requiring operators registered in the EU to submit reports on major accidents that also occur in other territories. DNV GL’s global network of experts enables operators to meet this requirement by supporting compliance activities for installations around the world.

Germany:

The operator of offshore installation in the German North Sea and Baltic Sea has the overall responsibility for personnel and environmental safety critical elements. The operator has to report any safety and


DNV GL AS

environmental issues, modifications and periodical inspection to the responsible authorities the German
Mining authority (Landesbergamt, “LBEG”) for Oil and Gas facilities and the Federal Maritime and Hydrographic Agency (Bundesamt für Seeschifffahrt und Hydrographie, “BSH”) for offshore wind industry. The operator has to follow the requirements of the European offshore directive and national rules, laws and regulation. With validity of the European offshore directive 3. party in-service verification will be required and will become a rising importance in Germany.

DNV GL Oil and Gas Germany is appointed as technical expert on behalf of LBEG to verify and assure safe operation and best quality of the German Oil & GAS offshore facilities. As technical service provider of many offshore wind substations in the German offshore sector Oil and Gas Germany has a key role in the BSH permitting processes to certify safe design, construction, installation and operation along the whole life cycle.

India:

The Oil Industry Safety Directorate (OISD) is a technical directorate under the Ministry of Petroleum and Natural Gas that formulates and coordinates the implementation of a series of self-regulatory measures aimed at enhancing safety in the oil and gas industry in India.

In addition, the Petroleum and Natural Gas Regulatory Board regulates the refining, processing, storage, transportation, distribution, marketing and sale of petroleum, petroleum products and natural gas.

Various services by independent agencies, such as certification, verification etc. are required under the above regulations.

Ireland:

For offshore installations (fixed platform, MOU or subsea production), the “petroleum undertaking shall appoint an operator prior to carrying out any designated petroleum activities“. For a non-production installation the “owner means a person entitled to control the operation of a nonproduction installation”. The operators and owners must establish a scheme of independent verification in accordance with requirements and procedures stated by the Commission (CER). The operators or owners have overall responsibility for safety. They are responsible for establishing a written verification scheme for the safety and environmentally critical elements as identified in a “safety case.”

A Facilities Verification Scheme is a description of the work carried out by Independent Competent Body(s) to verify whether a petroleum undertaking has identified and continues to meet suitable performance standards for SCEs for pipelines and facilities (except wells). Verification is required for all petroleum infrastructure related to the carrying on of a designated petroleum activity, including offshore and onshore facilities, pipelines, wells and for all phases of the petroleum infrastructure’s lifecycle.

An Independent Competent Body shall execute verification according to the verification scheme established by the operator or owner. The Verification Scheme must define suitable review that allows the ICB to make a judgment as to whether the petroleum undertaking [operator] is following their own assurance processes for the SCEs from design through to on-going operations.

Classification may be used to document partial compliance with regulations for floating units. Class societies normally act as ICB for MOUs.

Norway:

All companies have a general duty to ensure compliance with requirements of acts, statutory rules and regulations as well as their own defined requirements for their operations. The supervisory activities of the PSA (the regulator) do not exempt the operators of this duty. The operator has to develop a comprehensive verification program that may include verification activities performed by contractors at various levels. Class has no delegated authority from PSA, but flag/class can be used to document partial compliance with the regulations for floating units. Often the operator requests an independent body such as DNV GL to perform verification of their assets, or parts of their assets.

PSA describe their requirements in PSA regulations. The requirements are extensively substantiated by referencing recognised national and international standards, which include some of DNV GL’s offshore standards and recommended practices.


DNV GL AS

UAE:
ADNOC is the de facto regulatory body for HSE for the oil and gas industry in Abu Dhabi, and the Codes of Practice are a key component of ADNOC's regulatory responsibilities. The ADNOC HSE Codes of Practice (COP) are the standards by which the Group manages HSE. They are ADNOC-specific and refer to UAE Laws & Regulations, standards already in place in the Group Companies, and standards used by the international oil and gas industry.

The Code of Practices mandates that independent third party agencies are to be engaged to provide Independent Verification Body services.

UK:

For offshore installations (fixed platform, MOU or FPSO), the owner has overall responsibility for safety. They are responsible for establishing a written verification scheme for the safety and environmentally critical elements as identified in a “safety case.”

An independent competent verifier shall execute verification according to the verification scheme established by the duty holder. Classification may be used to document partial compliance with regulations for floating units. Class societies normally act as verifiers for MOUs and FPSOs.

USA:

The regulatory system has been subject to changes following the Macondo accident. It is now a hybrid regulatory approach; prescriptive regulations including 96 industry standards; performance objectives can be achieved by alternate means with BSEE (regulator) approval.

Industry self-inspections and records are required by regulation.

Third party reviews (design, fabrication, and installation) are required for deepwater or novel structures. The BSEE (the regulator) issue a production permit based on review and audit of production facilities and a Certified Verification Agency (CVA) Statement. The USCG issues a Certificate of Compliance for floating production facilities. Classification is credited towards C.o.C.


DNV GL AS

APPENDIX E EXAMPLES OF SCOPES OF WORK FOR VERIFICATION
ACTIVITIES

VERIFICATION ACTIVITIES (NATURE) TYPE

Examination of suitability of management system documentation:

Integrity management system

Office based

Assurance management system

Change management system

Inspection report and records

Calibration reports and records

Inspection and test plans

Function test procedures and records

Training records

P&IDs

Incident logs

Demonstration of continued suitability:

Review of documentation:

Confirm by review that an integrity management programme is implemented ensuring the integrity is maintained for the lifetime of the asset.

Office based

Verify the VS are based on corrosion risk assessments and risk based inspection methodologies or appropriate standards.Confirm by review that the basis of the inspection schedule in the maintenance management system is referenced to a risked based assessment.Confirm by review that the basis of the test schedule in the maintenance management system is referenced to a risked based assessment.Confirm by review of function tests and calibration records that all tests plans are implemented, deferments to the plan documented and all anomalies have been recorded, documented, analysed and corrective actions implemented.

Verify suitability and completeness of VS.

Verify suitability and completeness of maintenance procedures.

Verify training and competence records.

Confirm by review of the management of change system that it has correctly captured the performance requirement criteria for changes involving the respective barriers and equipment and all relevant documentation is up to date.


DNV GL AS

Guidance note:The determination of a representative sample size for such verification activities will be agreed with the operator.


On-site demonstration:

Demonstrate coherent communication of the barrier management systems and procedures.

Site based

Verify the correct versions of the P&IDs are available in the control room.

Verify that the current version of P&IDs correctly depicts the arrangement of instruments and detectors on the asset.Review inspection records/history and demonstrate recommended remedial action is closed out or scheduled for completion appropriately.Confirm by witness of routine functional testing that up to date procedures are implemented, followed correctly and conducted by competent personnel (e.g. tests/inspections/musters etc.)Confirm by review for evidence of systems and procedures for corrective actions to be taken and implemented in the event of a function test failureConfirm by review of incident logs, daily reports and work orders that all process upsets or excursions beyond the stated design limits are recorded, documented, investigated, analysed and remedial action implemented.Confirm by review for evidence of systems and procedures for corrective actions to be taken and implemented in the event of process upsets, excursions or unplanned downtime.

Confirm by inspection of equipment that the condition of protective barriers is adequately maintained.

Confirm by inspection of equipment that the condition of protective barriers is adequately maintained.

Confirm by inspection of equipment that the separation distances specified in the design are maintained.

Audit compliance with barrier assurance processes (e.g. control of temporary equipment, management of inhibits, control of Lo/Lc valves, management of defined life repairs etc.), through inspection and, testing, and the review of site records

VERIFICATION ACTIVITIES (NATURE) TYPE


DNV GL AS

APPENDIX F DNV GL IN-SERVICE VERIFICATION DELIVERABLES
F.1 GeneralDNV GL issue verification deliverables during the execution of the in-service verification scope, and at its completion.

The purpose of the deliverables is to document the scope of work performed, and the conclusions reached, by DNV GL.

The in-service verification documents typically follow the hierarchy shown in Figure F-1 below:

— verification report

— intermediate documents.

Figure F-1 General document hierarchy for in-service verification

F.2 Verification reportA verification report is issued by DNV GL as a statement confirming the conclusion of the verification process. A verification report may in principle be issued at any stage of the verification in-service process.

The verification report shall include:

— examination activity reference (including revision number),

— barrier,

— PR,

— description of verification activity completed,

— list of documentation examined/reviewed (including revision number),

— description of any outstanding or partially completed verification activities,

— findings or conclusions (has the required performance requirement criteria been met?).


DNV GL AS

F.3 Intermediate documents
DNV GL may issue intermediate documentation of progress or conclusion related to individual verification elements, such as:

— a document review — a site visit — a test.

Intermediate deliverables may be in the form of:

— verification comments (may be listed in VerCom, Letter, email or other agreed communication type) — visit report — audit report — survey report.

F.4 Validity of verification documentsVerification documents are, in principle, documents confirming that an examination has been carried out, and are valid only at the time of issue.


DNV GL AS

SAF

DNV GLDriven by our purpose of safeguarding life, property and the environment, DNV GL enables organizations to advance the safety and sustainability of their business. We provide classification and technical assurance along with software and independent expert advisory services to the maritime, oil and gas, and energy industries. We also provide certification services to customers across a wide range of industries. Operating in more than 100 countries, our 16 000 professionals are dedicated to helping our customers make the world safer, smarter and greener.

ER, SMARTER, GREENER

Documents

DNVGL-SE-0466 In-service verification of oil and gas assetsrules.dnvgl.com/docs/pdf/DNVGL/SE/2016-09/DNVGL-SE-0466.pdf · 2016-09-01 · It should be noted that the emphasis of this