DNVGL-SE-0469 Verification of hydrocarbon refining and … · 2017-09-18 · 1.2.2.4 Verification plan is how an independent examination of these safety-critical elements is planned

The electronic pdf version of this document, available free of chargefrom http://www.dnvgl.com, is the officially binding version.

DNV GL AS

SERVICE SPECIFICATION

DNVGL-SE-0469 Edition August 2017

Verification of hydrocarbon refining andpetrochemical facilities

FOREWORD

DNV GL service specifications contain procedural requirements for obtaining and retainingcertificates and other conformity statements to the objects, personnel, organisations and/oroperations in question.

© DNV GL AS August 2017

Any comments may be sent by e-mail to [email protected]

This service document has been prepared based on available knowledge, technology and/or information at the time of issuance of thisdocument. The use of this document by others than DNV GL is at the user's sole risk. DNV GL does not accept any liability or responsibilityfor loss or damages resulting from any use of this document.

Cha

nges

- c

urre

nt

Service specification — DNVGL-SE-0469. Edition August 2017 Page 3Verification of hydrocarbon refining and petrochemical facilities

DNV GL AS

CHANGES – CURRENT

GeneralThis document supersedes the October 2010 edition of DNV-DSS-314.The purpose of the revision of this service document is to comply with the new DNV GL document reference code system and profile requirements following the merger between DNV and GL in 2013. Changes mainly consist of updated company name and references to other documents within the DNV GL portfolio.

Some references in this service document may refer to documents in the DNV GL portfolio not yet published (planned published within 2017). In such cases please see the relevant legacy DNV or GL document. References to external documents (non-DNV GL) have not been updated.

Editorial correctionsIn addition to the above stated changes, editorial corrections may have been made.

Con

tent

s


DNV GL AS

CONTENTS

Changes – current.................................................................................................. 3

Section 1 Introduction to risk based verification.................................................... 61.1 Introduction......................................................................................61.2 Risk based verification..................................................................... 71.3 Definitions.......................................................................................101.4 Abbreviations..................................................................................121.5 References...................................................................................... 13

Section 2 Principles of risk based verification...................................................... 142.1 Purpose of section.......................................................................... 142.2 Verification principles..................................................................... 142.3 Selection of level of verification..................................................... 162.4 Communications..............................................................................19

Section 3 Service overview................................................................................... 213.1 Purpose of section.......................................................................... 213.2 Service process...............................................................................213.3 Front end engineering design......................................................... 223.4 Project design, construction and commissioning............................ 233.5 Operations...................................................................................... 303.6 Facility modifications...................................................................... 32

Appendix A Selection of verification level.............................................................35A.1 Introduction....................................................................................35A.2 Quantitative risk assessment......................................................... 35A.3 Trigger questions............................................................................39

Appendix B Verification documents.......................................................................41B.1 Purpose of appendix.......................................................................41B.2 DNV GL certificate of conformity.................................................... 41B.3 Statement of conformity.................................................................42B.4 Other verification documents......................................................... 43B.5 Use of quality management systems.............................................. 44B.6 Verification forms........................................................................... 46

Appendix C Generic detailed verification scopes of work tables............................50C.1 Purpose of appendix.......................................................................50

Con

tent

s


DNV GL AS

C.2 Description of terms used in the scope of work tables....................50C.3 Overall project management.......................................................... 52C.4 Design.............................................................................................52C.5 Construction....................................................................................76C.6 Commissioning................................................................................91C.7 Operations.................................................................................... 100C.8 Modifications or upgrades.............................................................115

Appendix D Major accident hazards versus safety-critical elements................... 118D.1 Purpose of appendix.....................................................................118

Appendix E Guidance on the development of verification plans.......................... 124E.1 Purpose of appendix..................................................................... 124E.2 The verification plan’s part in facility risk management................124E.3 Independent third-party verification.............................................125E.4 Verification plan............................................................................126E.5 Verification reporting....................................................................129E.6 Review and revision of the verification plan................................. 130

Changes – historic.............................................................................................. 131


DNV GL AS

SECTION 1 INTRODUCTION TO RISK BASED VERIFICATION

1.1 Introduction

1.1.1 Function of this document

1.1.1.1 This service specification gives criteria for and guidance on third-party verification of the safety andintegrity of hydrocarbon refineries and petrochemical facilities during new developments, operations andduring modifications to existing facilities.

1.1.1.2 The experience gained from past projects specific to an oil refinery and a petrochemical plant isincorporated in this service specification. This service specification:

— describes DNV GL's verification services for oil refineries and petrochemical facilities,— provides guidance for facility owners and others for the selection of the level of involvement of those

carrying out the certification and verification activities, whether by simple trigger questions or as a resultof a quantitative risk assessment

— provides a common platform for describing the scope and extent of verification activities.— identifies typical risk critical equipment and the appropriate level of verification activities recommended to

meet the verification objective and requirements.

1.1.1.3 This document is an object-specific service specification conforming to the philosophy defined inDNVGL-SE-0474 Risk based verification, see [1.5].

1.1.2 Objectives

1.1.2.1 The objectives of this document are to:

— describe DNV GL’s verification services for hydrocarbon refineries and petrochemical facilities during:

— design— construction— commissioning— operations— modification

— provide guidance for facility owners and other parties for the selection of the level of involvement of thosecarrying out verification activities, whether quantitatively as a result of a quantitative risk assessment orqualitatively by simple trigger questions

— provide a common platform for describing the scope and extent of verification activities.

1.1.3 Scope of application for verification

1.1.3.1 This SE may be adopted for the verification of all parts of all hydrocarbon refineries or types ofpetrochemical facilities or selected project phases.

1.1.3.2 This SE describes the principle of a levelled verification involvement, where the extent of verificationinvolvement is linked to the risks associated with part or all of the facility.

1.1.3.3 The primary scope of DNV GL’s verification work is the verification of the integrity of hydrocarbonfacilities and the safety of its personnel and those in close proximity to it. Other aspects, such as theverification of the environmental impact of the facility, or its ability to meet the owner’s business objectives,may be included in DNV’s scope of work if desired by the owner.


DNV GL AS

1.1.3.4 Statutory verification (or certification) of hydrocarbon facilities to the requirements of nationalauthorities is not included specifically in the scope of application of this SE. Such verification (or certification)shall be governed by the regulations of the relevant Authority. However, if detailed procedures are not givenby these Authorities, this SE will be used by DNV GL as a guideline for its work.

1.1.4 Structure of this document

1.1.4.1 This document consists of three sections and five appendices:

— Sec.1, this section, explains the relationship between this document and DNV GL’s overall risk basedverification process.

— Sec.2 explains the principles of DNV GL’s verification process with its risk based levels of involvement, andhow the level of involvement for a particular project is defined.

— Sec.3 describes the verification process and the activities for each of the project phases.— App.A gives guidance on the selection of verification level, preferably as the result from a quantitative risk

assessment or alternatively, qualitatively as a result of the posing of trigger questions.— App.B gives examples of verification documents. The use of quality management systems is addressed

here.— App.C gives a generic detailed scope of work tables for all phases and all levels of involvement. These

tables are the basis for the development of project-specific scopes of work tables.— App.D gives typical refinery hazards and their interface with safety-critical elements and risk mitigation

measures.— App.E gives guidance on the formulation of plans for the verification of the design, construction and

commissioning of hydrocarbon facilities.

1.2 Risk based verification

1.2.1 General

1.2.1.1 This SE describes the principles of verification of the safety and integrity of hydrocarbon facilities forall phases.

1.2.1.2 The risk based verification concept is described in DNVGL-SE-0474 and visualized in Figure 1-1overleaf.

1.2.1.3 The verification plan is the pivot element, with the asset specification, risk assessment and definitionof verification involvement as input and the verification execution being the implementation.

1.2.2 Verification’s role in hazard management

1.2.2.1 Major accident hazards are identified in a formal safety assessment by an analysis of the risks to thefacility’s personnel using suitable definitions of such accidents.

1.2.2.2 Safety-critical elements are those hardware-related measures, including computer software,designed to reduce the risk to the facility’s personnel.

1.2.2.3 Performance standards are the definitions of how these safety-critical elements perform their riskreduction functions.

1.2.2.4 Verification plan is how an independent examination of these safety-critical elements is planned toconfirm that they are suitable and fulfil the safety and integrity requirements of the facility’s owner.A graphical representation of this process is shown in Figure 1-2 overleaf.


DNV GL AS

Guidance note:Further details of these terms are given in [E.2.2].

---e-n-d---o-f---g-u-i-d-a-n-c-e---n-o-t-e---

Figure 1-1 DNV GL risk based verification flow chart


DNV GL AS

Figure 1-2 Verification as part of hazard management

1.2.3 Risk based verification planning

1.2.3.1 The selection of the level of verification shall depend on the level of risk a particular item adds tothe overall risk to the facility. The planning can be simplified or detailed. This is further described in DNVGL-SE-0474.

1.2.3.2 This service specification addresses both approaches as input into the preparation of a verificationplan.

Guidance note:Risk may be evaluated based on safety, environmental impact, business, schedule, public relations, reputation or other criteria setby the owner.The generic scopes of work tables are generated based on safety and integrity risks. Where other risks, such as environment orbusiness, are required by the owner to be considered during the verification process, the principles set out in this document maybe used to modify the generic scopes of work tables given in App.C.


1.2.3.3 In view of the complexity of most hydrocarbon facilities, DNV GL recommends strongly that theverification level be derived from the results of a quantitative risk assessment of the facility.

Guidance note:Only in the simplest of hydrocarbon facilities, with consequently lower levels of risk would DNV GL consider that simplifiedqualitative verification planning using the trigger questions set out in App.A be justifiable.For novel technology for which there are no applicable standards to verify against, technology qualification according to proceduresas defined in DNVGL-RP-A203 Technology qualification may be used as input for verification.


1.2.4 Certificate of conformity

1.2.4.1 A certificate of conformity may be issued by DNV GL to confirm compliance according to the scope ofwork. An example is given in App.B.

1.2.4.2 The DNV GL certificate of conformity confirms that, after performing verification according to a DNVGL defined scope of work, DNV GL has found the hydrocarbon facility to conform to a given DNV GL standardor acceptable international standard.


DNV GL AS

1.2.4.3 Usually DNV GL performs the complete scope of work. However, in some circumstances, DNV GL mayaccept external independent review certificates, for example for pressure vessels. This shall be reflected inthe certificate text.

1.2.4.4 A statement of conformity is issued in all instances where certificate of conformity is not applicable.,see App.B for further details.

1.3 Definitions

1.3.1 Verbal formsTable 1-1 Definitions of verbal forms

Terms Definition

shall verbal form used to indicate requirements strictly to be followed in order to conform to thedocument

should verbal form used to indicate that among several possibilities one is recommended asparticularly suitable, without mentioning or excluding others, or that a certain course ofaction is preferred but not necessarily required

may verbal form used to indicate a course of action permissible within the limits of the document

1.3.2 TermsTable 1-2 Definitions of terms

Terms Definition

certificate of conformity a document signed by a qualified party affirming that, at the time of assessment, the productor service met the stated requirements (BS 4778: Part 2), see [1.5]

Guidance note:For this SE, a certificate is a short document (often a single page) stating compliance withspecified requirements. The results from the associated verification activities shall be containedin a separate (single or multiple volumes) report.


commissioning (phase) the phase, after mechanical completion, where the facility is made ready for operation, thisphase includes any contractual performance trials

commissioningcompletion

is the completion of the commissioning phase where the hydrocarbon facility is capable ofperforming to its design specification, this may include contractual performance trials

construction (phase) all activities during construction, including fabrication, installation and testing up tomechanical completion

design all related engineering to design the facility including process, structural, mechanical,electrical and instrumentation disciplines as well as materials and corrosion

design (phase) an initial project phase that takes a systematic approach to the production of specifications,drawings and other documents to ensure that the facility meets specified requirements(including design reviews to ensure that design output is verified against design inputrequirements)


DNV GL AS

Terms Definition

fabrication activities related to the assembly of objects such as structural assemblies, pressure vessels,piping or tanks. These may be built fully on-site or built offsite in parts and transferred to sitefor assembly or integration

hazard a physical situation with the potential to cause harm, such as injury or death to workers,damage to property, disruption of business or pollution of the environment

hazard and operabilitystudy (HAZOP)

the application of a formal systematic detailed examination of the process and engineeringintention of new or existing facilities to assess the hazard potential of operation outside thedesign intention or malfunction of individual items of equipment and their consequentialeffects on the facility as a whole.

manufacture is the making of articles or materials for the facility. In relation to hydrocarbon facilities, thistypically refers to activities for the production of various components under contracts fromone or more contractor or supplier

mechanical completion is the completion of the construction phase (qv) where all equipment, such as pumps andcompressors, may be energised and pressure vessels may be filled with their contents toenable commissioning to take place

modifications alterations to an existing hydrocarbon facility by modifying an existing part of the facility oradding new parts

Guidance note:In hydrocarbon facilities, this is referred to frequently as upgrading.


operations (phase) the phase when the facility is being used for the purpose for which it was designed

risk the qualitative or quantitative likelihood of an accident or unplanned event occurring,considered in conjunction with the potential consequences of such a failure: in quantitativeterms, risk is proportional to the quantified probability of a defined failure mode times itsquantified consequence

risk reduction measures those measures taken to reduce the risks to the operation of the hydrocarbon facility and tothe health and safety of personnel associated with it or in its vicinity by:

— reduction in the probability of failure— mitigation of the consequences of failure.

Guidance note:The usual order of preference of risk reduction measures is:

— inherent safety

— prevention

— detection

— control

— mitigation

— emergency response.


safety objectives the safety goals in terms of functionality, reliability/availability and survivability for thedesign, construction and operation of the hydrocarbon facility including acceptance criteria forthe level of risk acceptable to the owner


DNV GL AS

Terms Definition

verification an examination to confirm that an activity, a product or a service is in accordance withspecified requirements.

Guidance note:The examination shall be based on information, which can be proved true, based on factsobtained through observation, measurement, test or other means. It should be noted that thereis a distinct difference between verification and certification. The scope of work for verification isultimately decided by the customer, while the scope of work for certification is ultimately decidedby DNV GL (or the national authorities when DNV GL issues certificates on their behalf).


verification plan a plan, which defines the scope of the work for verification; it includes verification objectives,acceptance criteria, elements to be verified, level of involvement by party and type ofverification activity

1.4 AbbreviationsTable 1-3 Abbreviations

AbbreviationDescription

CCTV closed circuit television

D&ID ducting and instrumentation diagram

D&ID ducting and instrumentation diagram

ESD emergency shutdown

ESDV emergency shutdown valve

FEED front end engineering design

FERA fire and explosion risk assessment

FGS fire and gas system

FMEA failure mode and effect analysis

HAZID hazard identification

HAZOP hard and operability study

HVAC heating, ventilation and air conditioning

ICS integrated control system

NDT non-destructive testing

P&ID piping and instrumentation diagram

PCS process control system

PFD process flow diagram

PFP passive fire protection

PLEM pipeline end manifold


DNV GL AS

AbbreviationDescription

PS performance standard

PSD process shutdown

QRA quantitative risk assessment

SCE safety-critical element

SIL safety integrity level

SPM single point mooring

UFD utility flow diagram

UPS uninterruptible power supply

VAR verification activity report

VCE vapour cloud explosion

1.5 ReferencesTable 1-4 References

Document code Title

BS 4778 Quality Vocabulary, Part 2 Quality Concepts and Related Definitions, 1991, British StandardsInstitute, London

Health and Safety at Work etc Act 1974, HMSO London, ISBN 0 10 543774 3

The Offshore Installations (Safety Case) Regulations 2005, Statutory Instrument 2005 number3117, HMSO London, ISBN 0 11 073610 9

A Guide to the Offshore Installations (Safety Case) Regulations 2005, HSE Books London, ISBN0 7176 6184 9

Council Decision 93/465/EEC of 22 July 1993 Concerning the Modules for the Various Phasesof the Conformity Assessment Procedures and the Rules for the Affixing and Use of the CEConformity Marking, which are Intended to be Used in the Technical Harmonisation Directives,Official Journal L 282 of 17/11/93.

DNVGL-SE-0474 Risk based verification

EN 10204 Metallic Products - Types of Inspection Documents, 2004, European Committee forStandardization, Brussels

ISO 8402 Quality -Vocabulary, 1994 (withdrawn), International Organization for Standardization, Geneva

ISO 9000 Quality Management Systems - Fundamentals and Vocabulary, 2005, International Organizationfor Standardization, Geneva

ISO 9001 Quality Management Systems - Requirements, 2008, International Organization forStandardization, Geneva

ISO 10005 Quality Management Systems – Guidelines for Quality Plans, 2005, International Organizationfor Standardization, Geneva

ISO TR 10013 Guidelines for Quality Management System Documentation, 2001, International Organizationfor Standardization, Geneva


DNV GL AS

SECTION 2 PRINCIPLES OF RISK BASED VERIFICATION

2.1 Purpose of section

2.1.1 Objectives

2.1.1.1 The objectives of this section are to provide:

— an introduction to the principles of verification the safety and integrity of hydrocarbon refineries andpetrochemical facilities,

— an introduction to the principles of risk based levels of verification activity and— guidance on the selection of levels of verification.

2.2 Verification principles

2.2.1 Purpose of verification

2.2.1.1 Verification constitutes a systematic and independent examination of the various phases in the life ofa hydrocarbon facility to determine whether it has sufficient integrity to meet its safety objectives.

2.2.1.2 Verification activities are expected to identify errors or failures in the safety and integrity-relatedwork associated with the hydrocarbon facility and to contribute to reducing the risks to its operation and tothe health and safety of personnel associated with it or in its vicinity.

2.2.1.3 Verification is primarily focused on integrity and human safety, but business risk (cost and schedule)may be addressed also if required by the owner.

2.2.2 Verification as a complementary activity

2.2.2.1 Verification shall be complementary to routine design, construction and operations activities and nota substitute for them. Therefore, although verification will take into account the work, and the assuranceof that work, carried out by the owner and its contractors, it is possible that verification will duplicate somework that has been carried out previously by other parties involved in the hydrocarbon facility.

2.2.2.2 The verification plan shall be developed and implemented in such a way as to minimise additionalwork and cost, and to maximise its effectiveness. The development of the verification plan shall depend onthe findings from the examination of quality management systems, the examination of documents and theexamination of project activities.

2.2.3 Risk based levels of verification

2.2.3.1 To achieve a DNV GL certificate of conformity for a hydrocarbon facility a verification of the activitiesdescribed by the scope of work defined within this SE first shall take place.

2.2.3.2 The level of verification activity is differentiated according to the overall risk to the facility andto individual parts of it. If the risk to the facility (or a particular part) is higher, the level of verificationinvolvement is higher. Conversely, if the risk to the facility (or a particular part) is lower, the level ofverification activities can be reduced, without any reduction in their effectiveness.


DNV GL AS

2.2.3.3 Verification of hydrocarbon facilities is categorised into low, medium and high. A summary of thelevels of involvement is given in Table 2-1.

2.2.3.4 It is the prerogative of the owner of the hydrocarbon facility to choose the level of verification.The selection should consider the factors given in Sec.2 [3]. The selection of the most suitable verificationlevel may be guided by using the information gained from a quantitative risk assessment, or alternativelyqualitatively by trigger questions, as described in App.A. Further guidance is provided in DNVGL-SE-0474Risk based verification.

2.2.3.5 Where DNV GL is issuing the certificate of conformity for the facility, DNV GL will decide on theappropriate scope and use the same type of questions to evaluate the suitability of the selected level.

2.2.3.6 Different levels of verification can be chosen for different phases of the hydrocarbon facility’s design,construction or commissioning, or even within the same phase if necessary. For example, the design ofa particular component or unit may be innovative and considered high risk whereas the construction andinstallation methods are well-known and considered low risk. The converse might be true also.

2.2.3.7 The level of verification can be reduced or increased during a phase if the originally chosen level isconsidered too rigorous or too lenient, as new information on the risks to the hydrocarbon facility becomesavailable.

2.2.3.8 Verification should be planned in close co-operation with the owner and each of its contractors,to provide a scope of work that is tailor-made to the schedule of each production process or activity, i.e.to make the verification activities, surveillance and hold points, an integrated activity and not a delayingactivity.

Guidance note:Many contractors have adequate quality control systems and quality control departments, with competent personnel to perform,for example, inspection at pressure vessel manufacturers.In that case, not all verification work need be done by DNV GL personnel. Where applicable, the various inspections may be carriedout by competent persons other than DNV GL personnel.In that situation DNV GL’s verification activities may comprise:

— reviewing the competence of the contractor’s personnel,

— auditing their working methods and their performance of that work, and

— reviewing the documents produced by them.


2.2.3.9 Verification will direct greatest effort at those elements of the hydrocarbon facility whose failure orreduced performance will have the most significant impact on safety and integrity.

2.2.3.10 The degree of confidence placed in a certificate by its users depends on their degree of confidencein the verification carried out. Therefore, the level of verification will be stated on the certificate of conformityfor the facility.

2.2.3.11 If more than one verification level has been used for a phase, then the lowest level will be reportedon the facility’s certificate, and the additional verification activities will be identified and described in theverification report.


DNV GL AS

2.3 Selection of level of verification

2.3.1 Selection factors

2.3.1.1 The selection of the level of verification shall depend on the criticality of each of the elements thathave an impact on the management of hazards and associated risk levels of the facility. This is illustrated byFigure 2-1 below.

2.3.1.2 The contribution of each element shall be judged qualitatively and/or quantitatively and shall use,where possible, quantified risk assessment data to provide a justifiable basis for any decisions made.

Table 2-1 Levels of verification - summary of involvement

Level Description of involvement Guidance for application on the level ofinvolvement

Low

— Review of general principles and productionsystems during design, construction andcommissioning

— Review of principal design documents,construction and commissioning procedures andqualification reports

— Site attendance only during system testing— Less comprehensive involvement than level

medium

— Proven facility designs with relativelyharmless contents and/or installed in benignenvironmental conditions

— Established design; manufacturing andinstallation by experienced contractors

— Low consequences of failure from a safety pointof view (or environmental or commercial, ifrequired)

— Relaxed to normal completion schedule

Medium


— Detailed review of principal and other selecteddesign documents with support of simplifiedindependent analyses

— Detailed review of construction andcommissioning procedures

— Full time attendance during (procedure)qualification and review of the resulting reports

— Audit-based or intermittent presence at site

— Facilities in moderate or well-controlledenvironmental conditions

— Facilities with a moderate degree of novelty— Medium consequences of failure from a safety

point of view, (or environmental or commercial,if required

— Ordinary completion schedule

High


— Detailed review of most design documents withsupport of simplified and advanced independentanalyses

— Detailed review of construction andcommissioning procedures

— Full-time attendance during (procedure)qualification and review of the resulting reports

— Full time presence at site for most activities— More comprehensive involvement than level

medium

— Facilities with a high degree of novelty or largeleaps in technology

— Extreme environmental conditions— Inexperienced contractors or exceptionally tight

completion schedule— Very high consequences of failure from a safety

point of view (or environmental or commercial,if required


DNV GL AS

Level Description of involvement Guidance for application on the level ofinvolvement

Guidance note:Completion schedules affect verification involvement in an indirect but important way. The effect of a tight completionschedule is pressure on the project team to take less time to carry out the various tasks. Tight completion schedules aremore prone to run late, thus adding more pressure on the project team. Problems which have been encountered in thissituation in the past have included:

— design reviews not carried out

— incomplete welding

— non-destructive testing incomplete

— missing structural members

— commissioning incomplete.


2.3.1.3 Selection factors are the:

— overall safety objectives for the facility,— assessment of the risks associated with the facility and the measures taken to reduce these risks,— degree of technical innovation in the facility,— experience of the contractors in carrying out similar work,— quality management systems of the owner and its contractors.

Figure 2-1 Selection of the required level of verification

2.3.2 Overall safety objective

2.3.2.1 An overall safety objective covering all phases of the hydrocarbon facility from design to operationshall be defined by the owner. The safety objective should address the main safety goals as well asestablishing acceptance criteria for the level of risk acceptable to the owner. Depending on the facility andits location, the risk could be measured in terms of human injuries as well as environmental, political andeconomic consequences.


DNV GL AS

2.3.3 Assessment of risk

2.3.3.1 A systematic review should be carried out to identify and evaluate the probabilities andconsequences of failures in the hydrocarbon facility. The extent of the review shall reflect the criticality ofthe facility, the planned operation and previous experience with similar facilities. This review shall identifythe risk to the operation of the facility and to the health and safety of personnel associated with it or in itsvicinity.

2.3.3.2 Once the risks have been identified, their extent can be reduced to a level as low as reasonablypracticable by means of one or both of:

— reduction in the probability of failure,— mitigation of the consequences of failure.

Guidance note:Reasonable practicabilityThe term as low as reasonably practicable (ALARP) has come into use through the United Kingdom’s The Health and Safety atWork etc. Act 1974. See sec. E109. Reasonable Practicability is not defined in the Act but has acquired meaning by interpretationsin the courts.It has been interpreted to mean that the degree of risk from any particular activity can be balanced against the cost, time andtrouble of the measures to be taken to reduce the risk.Therefore, it follows that the greater the risk the more reasonable it would be to incur substantial cost, time and effort in reducingthat risk. Similarly, if the risk were very small it would not be reasonable to expect great expense or effort to be incurred inreducing it.Further guidance on the principles and application of ALARP may be obtained from the United Kingdom’s Heath and SafetyExecutive web-site at http://www.hse.gov.uk/risk/theory/alarp.htm (July 2009).


2.3.3.3 The result of the systematic review of these risks is measured against the safety objectives and usedin the selection of the appropriate verification activity level.

2.3.4 Technical innovation and contractor experience

2.3.4.1 The degree of technical innovation in the hydrocarbon facility system shall be considered. Risks tothe facility are likely to be greater for a facility with a high degree of technical innovation than with a facilitydesigned, manufactured and installed to well-known criteria in well-known locations.

2.3.4.2 Similarly, the degree of risk to the facility should be considered where contractors are inexperiencedor the work schedule is tight.

2.3.4.3 Factors to be considered in the selection of the appropriate verification level include:

— degree of difficulty in achieving technical requirements— knowledge of similar facilities— knowledge of contractors’ general experience— knowledge of contractors’ experience in similar work.

2.3.5 Quality management systems

2.3.5.1 Adequate quality management systems shall be implemented to ensure that gross errors in the workfor facility design, construction and operations are limited.

http://www.hse.gov.uk/risk/theory/alarp.htm


DNV GL AS

2.3.5.2 Factors to be considered when evaluating the adequacy of the quality management system include:

— whether or not an ISO 9001, see [1.5] or equivalent certified system is in place— results from external audits— results from internal audits— experience with contractors’ previous work— project work-force familiarity with the quality management system, e.g. has there been a rapid expansion

of the work force or are all parties of a joint venture familiar with the same system.

2.4 Communications

2.4.1 Notification of verification level

2.4.1.1 An assessment of the required level of verification for a project should be made by the owner beforepreparing tender documents for design and construction activities. The owner can then specify this level ininvitations to tender. This will give contractors clear guidance and reference when estimating the extent andcost of efforts associated with verification activities.

2.4.1.2 The required level of verification can be assessed by the owner using this SE. However, if theowner requires the contractor to carry out this assessment as part of his response to an invitation to tenderthe owner should provide the necessary information to enable the contractor to carry out this work. Thisinformation should include overall safety objectives for the hydrocarbon facility as well as particulars, such astemperatures, pressures, contents and environmental criteria, commonly contained in a design brief.

2.4.2 Obligations

2.4.2.1 To achieve the purpose and benefits of verification the involved parties shall be mutually obliged toshare and act upon all relevant information pertaining to the verification scope.

2.4.2.2 The owner shall be obliged to:

— Inform DNV GL about the basis for selecting the level of verification and the investigations andassumptions made in this context.

— Give DNV GL full access to all information concerning the verification scope for the hydrocarbon facilityand ensure that clauses to this effect are included in contracts for parties acting on behalf of the ownerand parties providing products, processes and services covered by the verification scope. If information isproprietary and not available, exclusion from verification shall be mutually agreed with DNV GL.

— Ensure that DNV GL is involved in the handling of deviations from specified requirements within theverification scope.

— Act upon information provided by DNV GL with respect to events or circumstances that may jeopardisethe safety or integrity of the facility and/or the purpose and benefit of verification

— Ensure that the safety objective established for the facility is known and pursued by parties acting onbehalf of the owner and parties providing products, processes and services covered by the verificationscope.

2.4.2.3 Second parties shall be obliged to:

— Perform their assigned tasks in accordance with the safety objectives established for the project.— Provide the owner and DNV GL with all relevant information pertaining to the verification scope.


DNV GL AS

2.4.2.4 DNV GL will be obliged to:

— Inform the owner if, in the opinion of DNV GL, the basis for selecting the level of verification or theassumptions made in this respect are found to be in error or assessed incorrectly.

— Inform the owner of events or circumstances that, in the opinion of DNV GL, may jeopardise the safety orintegrity of the facility and/or the purpose and benefit of verification.

— Effectively perform all verification work and adjust the level of involvement according to the actualperformance of parties providing products, processes and services covered by the verification scope.


DNV GL AS

SECTION 3 SERVICE OVERVIEW

3.1 Purpose of section

3.1.1 Objectives

3.1.1.1 The objectives of this section are to provide, for hydrocarbon refining and petrochemical facilities:

— an overview of verification activities— details of DNV GL’s verification activities for aspects of the facility’s development, operation or

modification.

3.2 Service process

3.2.1 General principles

3.2.1.1 The process of DNV GL’s verification of hydrocarbon facilities is based on distinct project phases andthe recognition of key milestones.

3.2.1.2 The risk based verification process follows the common project phases:FEED (optional):

— conceptual design.

Project design and construction:

— project management— detail design— construction— manufacturing and fabrication of components and assemblies— site assembly and integration.

Project completion:

— commissioning— issue of as-built and as-installed documentation.

Facility operations:

— operations, maintenance and inspection.

Facility modifications:

— design, construction and commissioning of modifications and alterations.

Verification tasks need not be performed as part of a complete verification (or certification) of a hydrocarbonfacility but can be stand-alone service for all or part of a project.

3.2.2 Scopes of work

3.2.2.1 An overview of the scopes of work for verification, at the three levels of verification low (L), medium(M) and high (H), are given in the tables in this section.

3.2.2.2 Note that the activity audit of the quality management system may be omitted if there exists aquality management system in accordance with ISO 9001, certified by an accredited third party for the scopeof work being carried out in the project.


DNV GL AS

3.2.2.3 Typical generic detailed scopes of work descriptions, which show all the activities to be verified, aregiven in App.C.

3.2.2.4 A specific scope of work description shall be made for each particular project. This description shouldbe similar to the tables in App.C and will be part of the final DNV GL verification report.

3.2.2.5 For operations which are not mentioned specifically in the tables but which are still found critical fora particular project the same general levels will be described.

3.3 Front end engineering design

3.3.1 Verification during front end engineering design

3.3.1.1 Verification during front end engineering design (FEED), or the conceptual and/or feasibility studiesof a project, is not a prerequisite for verification. However, verification of the early stages of a project canreduce the extent, depth and cost of verification required during the design, construction and commissioningphases or indicates areas where verification would be difficult to achieve without further work beingundertaken.

3.3.1.2 Design verification during FEED can be combined with additional reviews, where required by theowner, of:

— environmental aspects— project schedule— cost.

3.3.1.3 The FEED design documents shall be reviewed on a sample basis to ensure that the requirements ofthe project’s specifications and standards have been incorporated.

3.3.1.4 Verification during FEED is the examination of the assumptions, methods and results of the designprocess and is performed to ensure that the specified requirements of the project will be achieved.

3.3.1.5 FEED verification will consist of one, or more, of reviewing:

— specifications for design— design reports and drawings— calculations— specifications for construction and operation, resulting from design.

3.3.1.6 Definition of the scope of work for verification of FEED will follow Table 3-1.

Table 3-1 Scope of work for verification of FEED

LevelVerification activity

L M H

Review of reports and specifications for construction and operation 1)

— spot check of critical aspects x x x

— spot check review of main specifications and reports x x

— thorough review of main specifications and reports x


DNV GL AS


L M H

1) Services related to safety and integrity risks only.

However, optional verification services, relating to environmental, business or other risks, when requested bythe owner, may be carried out in the same manner.

3.4 Project design, construction and commissioning

3.4.1 General

3.4.1.1 All design, construction and commissioning aspects, relevant to hydrocarbon facility safety andintegrity, shall be covered by the verification process.

3.4.1.2 Verification describes the individual activities undertaken by DNV GL at the various stages of thedesign, construction and commissioning of the hydrocarbon facility to confirm that the safety and integrityrequirements of the owner have been fulfilled.

3.4.2 Verification of overall project management

3.4.2.1 Verification of the overall project management is the examination of the means of controlling thewhole hydrocarbon facility project.

3.4.2.2 This verification is to ensure that the necessary controls are in place to ensure information flowsbetween the various interfaces. This is especially important where separate contractors have been employedfor different phases of the project.

3.4.2.3 Definition of the scope of work for verification of overall project management will follow Table 3-2.

Table 3-2 Scope of work for verification of overall project management

Level

Verification activity L M H

Review of the project management process

— review of project quality management documentation. x x x

— audit of the quality management system x x

— review of sub-contractor control x x

— review of interface controls x x

— review of methods of information flow including document control x x


DNV GL AS

3.4.3 Verification during design

3.4.3.1 Design verification is the examination of the assumptions, methods and results of the designprocess and is performed at the specified level of verification to ensure that the specified requirements of thehydrocarbon facility will be achieved.

3.4.3.2 Design verification will consist of one or more, of the following:

— reviewing the design process— reviewing specifications for design— reviewing design reports and drawings— review of technology qualification program and associated results (for new technology)— performing independent parallel calculations— audit of project quality management system reviewing specifications for construction and operation,

resulting from design.

3.4.3.3 Typical design aspects that shall be verified during the design of hydrocarbon processing are:Civil and structural:

— geotechnical report— civil works and foundations— structures.

Plant facilities:

— general plant layout and equipment— process safety systems— emergency shutdown and alarm systems— hazardous area classification and ventilation.— passive and active fire protection philosophy— fire and gas detection and alarm system— electrical system— emergency lighting— process and utility piping systems— mechanical system— material selection and corrosion management.

3.4.3.4 Definition of the scope of work for verification of design will follow Table 3-3.

Table 3-3 Scope of work for verification of design


L M H

Review of the design process

— review of design quality management documentation x x x

— audit of design quality management system x x

Review of specifications for design

— review of the design basis with emphasis of the survey results and environmentaldata: evaluation of the design criteria

x x x


DNV GL AS


L M H

Review of design reports and drawings

— review of the main documentation to ensure that the main criteria have beenaccounted for in design, that the governing conditions are identified, and that thechosen design philosophies are in accordance with specified codes and standards

x x x

— evaluation of the main methods used and spot checks of the input data and thecalculation results

x x

— detail review of main design reports x

Performing independent parallel calculations

— check of pressure containment or overall integrity x x x

— simplified independent analysis/ calculation(s) performed by spot checks x x

— advanced independent analysis/ calculation(s) performed by spot checks x

Review of specifications for construction and operation

— spot check of critical aspects x x x

— review of main specifications x x

— thorough review of main specifications x

Review of specific operational challenges

— general principles x x x

— review of main documents supported by simplified analyses x x

Guidance note:Design verification activities may be split up between basic design and detailed design, or other sub-phase, depending on type ofcontract.


3.4.4 Verification during construction

3.4.4.1 Verification during construction is carried out by means of full time attendance, audits, inspection orspot checks of the work, as appropriate, in sufficient detail to ensure that the specified requirements of thehydrocarbon facility will be achieved.

3.4.4.2 Verification of these activities relates not only to the contractor’s work but also to the monitoring ofthis work carried out by the owner.

3.4.4.3 During construction verification shall consist of one, or more, of:

— reviewing the construction process— reviewing construction procedures— reviewing qualification processes and results— surveillance during construction activities— reviewing final documentation.


DNV GL AS

3.4.4.4 Typical site activities to be verified during construction and up to mechanical completion are:Civil and structural:

— civil and structural works— equipment supports— storage tank foundations— structural fire protection.

Mechanical:

— mechanical equipment installation— process piping installation— welding procedures qualification and control— welders’ qualification and welders’ identification control— welding quality records— non-destructive testing methods and reports— pressure and leak tests of process piping system— set pressures for relief valves.

Electrical and instrumentation:

— electrical equipment and instrumentation in hazardous areas— insulation resistance and continuity tests on equipment and cables— equipment earthing— electrical installation work— relevant tests of electrical and instrumentation equipment, especially calibration of instruments and

setting of protective devices if any.

Common:

— material control and identification system— final inspection reports of procured items.

3.4.4.5 The documents that should be produced in the project and submitted for review typically are:

— construction procedures and method statements; including test requirements, test procedures andacceptance criteria, repairs, personnel qualification records, etc.

— material specifications and data sheets— drawings— quality plans including Inspection and test plans— welding procedure specifications and welding procedure qualification record— NDT procedures.

3.4.4.6 The final documentation to be submitted after construction that should reflect the ‘as-built’ status ofthe facility, should include but not be limited to:

— construction test records; visual, NDT, test samples, dimensional, heat treatment, etc.— hydrostatic test reports— as-built drawings.

3.4.4.7 Definition of the scope of work for verification of construction shall follow Table 3-4 formanufacturing and fabrication of critical, high-risk, components, Table 3-5 for manufacturing and fabricationof components not considered to be high-risk and Table 3-6 for site construction activities.

3.4.4.8 Component risk of shall be defined preferably by a quantitative risk assessment but qualitativemethods may be used for lower-risk facilities.


DNV GL AS

Table 3-4 Scope of work for verification of manufacturing and fabrication of HIGH-RISKcomponents


L M H

Review of the manufacturing and fabrication process

— Review of manufacturing and fabrication management systems x x x

— Audit of the quality management system x x

Review of manufacturing and fabrication procedures

— Review manufacturing, fabrication and inspection procedures for confirmation ofcompliance with the manufacturing specification

x x x

— Review method statements x x

Review of qualification process

— Review the manufacturing procedure specification, (MPS), manufacturingprocedure qualification test (MPQT), if applicable

x x x

— Full time attendance during MPQT, if applicable, or first day production x x

Surveillance during manufacturing and fabrication activities

— Visit-based attendance during testing, to ensure, based on spot checks, that thedelivered products have been produced in accordance with the manufacturingspecification

x x x

— Visit-based or full-time attendance during manufacturing and fabrication toensure, based on spot checks, that the delivered products have been produced inaccordance with the manufacturing specification

x x

— Full-time attendance during manufacturing and fabrication to ensure, based onspot checks, that the delivered products have been produced in accordance withthe manufacturing specification

x

Review of final documentation x x x

Guidance note:Materials may be ordered with certificates of independent third-party verification (e.g. 3.2 according to EN 10204, see [1.5]). Thiscan this be integrated in the overall verification activities, so not to duplicate work.Additionally, credit may be given to components that are CE-marked, providing that the appropriate conformity assessmentmodules have been used, e.g. for equipment for which the verification plan requires verification of design, Module H is insufficientand Module H1 is required, irrespective of the requirement of the particular directive see [1.5].


3.4.5 Verification during commissioning

3.4.5.1 Verification during commissioning is carried out by means of full time attendance, audits, inspectionor spot checks of the work, as appropriate, in sufficient detail to ensure that the specified requirements ofthe hydrocarbon facility will be achieved.


DNV GL AS

3.4.5.2 Verification of these activities relates not only to the contractor’s work but also to the monitoring ofthis work carried out by others.

3.4.5.3 During commissioning verification shall consist of one, or more, of:

— reviewing the commissioning process— reviewing commissioning procedures— surveillance during commissioning activities— reviewing final documentation.

Table 3-5 Scope of work for verification of manufacturing and fabrication of non-HIGH-RISKcomponents


L M H

Review of the manufacturing and fabrication process

— Review of manufacturing and fabrication management systems x x

Review of manufacturing and fabrication procedures

— Review manufacturing, fabrication and inspection procedures for confirmation ofcompliance with the manufacturing specification

x x


— Review the manufacturing procedure specification, (MPS), manufacturingprocedure qualification test (MPQT), if applicable

x x x

— Full time attendance during MPQT, if applicable, or first day production x

Surveillance during manufacturing and fabrication activities

— Visit-based attendance during testing, to ensure, based on spot checks, that thedelivered products have been produced in accordance with the manufacturingspecification

x x

— Visit-based attendance during manufacturing and fabrication to ensure, based onspot checks, that the delivered products have been produced in accordance withthe manufacturing specification

x


Table 3-6 Scope of work for verification of site construction


L M H

Review of the construction process

— Review of construction management systems x x x


Review of construction procedures

— Spot check of construction procedures, including erection procedures x x x


DNV GL AS


L M H

— For critical operations (identified from the FMEA and HAZOP studies or QRA)review the method statements

x x


— For critical operations, review the qualification process, e.g.— welding— non-destructive testing— site heat treatment

x x x

— Full time attendance during qualification tests x x

Surveillance during construction activities

— Visit-based attendance during start of each critical operation x x x

— Full time attendance during each critical operation x x

— Full time attendance for all construction operations x


3.4.5.4 Typical site activities to be verified during commissioning, including any contractual performancetest, are:Document review:

— commissioning schedule— checking and testing procedures for commissioning work— performance test procedures— audit of as built documentation.

Witnessing activities:

— alarm, fire and gas and shut-down systems tests in accordance with the cause and effect matrix— function and commissioning tests— performance tests— conduct of all commissioning work is carried out in accordance with procedures previously approved.

3.4.5.5 Definition of the scope of work for verification of commissioning will follow Table 3-7.

Table 3-7 Scope of work for verification of site commissioning


L M H

Review of the commissioning process

— Review of commissioning management systems x x x


Review of commissioning procedures

— Spot check of commissioning procedures x x x


DNV GL AS


L M H

— For critical operations (identified from the FMEA and HAZOP studies or QRA)review the method statements

x x

Surveillance during commissioning activities

— Visit-based attendance during start of each critical operation x x x

— Full time attendance during each critical operation x x

— Full time attendance for all commissioning operations x


3.5 Operations

3.5.1 General

3.5.1.1 All operations aspects, such as operations, maintenance and inspection, relevant to hydrocarbonfacility safety and integrity, shall be covered by the verification process.

3.5.1.2 Verification describes the individual activities undertaken by DNV GL during the operation of thehydrocarbon facility to confirm that the safety and integrity requirements of the owner continue to befulfilled.

3.5.2 Verification of overall operations management

3.5.2.1 Verification of the overall operations management is the examination of the means of controlling theoperation of the whole hydrocarbon facility.

3.5.2.2 This verification is to ensure that the necessary controls are in place to ensure information flowsbetween the various interfaces. This is especially important where separate contractors have been employedfor different aspects of operations.

3.5.2.3 Definition of the scope of work for verification of overall project management will follow Table 3-8.

Table 3-8 Scope of work for verification of overall operations management


L M H

Review of the project management process by

— review of project quality management documentation. x x x

— audit of the quality management system x x

— review of sub-contractor control x x

— review of interface controls x x


DNV GL AS


L M H

— review of methods of information flow including document control x x

3.5.3 Verification during operations

3.5.3.1 Verification during operations is carried out by means of audits, inspection or spot checks of thework, as appropriate, in sufficient detail to ensure that the specified requirements of the hydrocarbon facilitycontinue to be achieved.

3.5.3.2 Verification of these activities relates not only to the owner’s work but any work, relevant to theintegrity of the facility and the safety of personnel, carried out by contractors.

3.5.3.3 During operations verification shall consist of one, or more, of:

— reviewing the operations, maintenance and inspection processes— reviewing operations, maintenance and inspection procedures— surveillance during operations, maintenance and inspection activities— reviewing documentation of the results of these processes.

Guidance note:The operations processes, procedures and activities to be verified are only those concerned, wholly or in part, with the integrity ofthe hydrocarbon facility or the safety of personnel within or in close proximity.Operations processes, procedures and activities that are not concerned with facility integrity or personnel safety will not beverified.


3.5.3.4 Typical activities to be verified during operations are:Document review:

— integrity management strategies— operations, maintenance and inspection procedures— preventative maintenance routines

Witnessing activities:

— alarm, fire and gas and shut-down systems tests in accordance with the cause and effect matrix— function tests— conduct of all operations, maintenance and inspection work is carried out in accordance with procedures

previously approved.

3.5.3.5 Definition of the scope of work for verification of operations will follow Table 3-9.

Table 3-9 Scope of work for verification of operations


L M H

Review of the operations, maintenance and inspection processes

— Review of integrity management strategies x x x

— Review of operations, maintenance and inspection management systems x x


DNV GL AS


L M H

Review of operations, maintenance and inspection procedures

— Review of operations, maintenance and inspection procedures x x x

— Review of preventative maintenance routines x x

Surveillance during operations, maintenance and inspection activities

— Visit-based attendance during conduct of each critical operation x x x

— Full time attendance during shutdowns (or turn-arounds) x x

Review of operations, maintenance and inspection documentation x x x

3.6 Facility modifications

3.6.1 Reasons for modifications

3.6.1.1 Hydrocarbon facilities are modified or upgraded throughout their lives. Reasons for thesemodifications are varied but common reasons are:

— changes in market conditions, e.g. requirements for low-sulphur fuel— changes in source of crude oil, e.g. higher sulphur crudes have to be used instead of low-sulphur as

designed— technological change i.e. new, more efficient, processes are developed— changes in facility output, i.e. new products being made requiring new processes to be installed.

3.6.1.2 It is not common that like-for-like replacements are made due to corrosion or other degradationmechanisms.

3.6.2 Particular aspects of modifications to hydrocarbon facilities

3.6.2.1 The essential steps for verification of modifications to hydrocarbon facilities are identical to those in anew facility. However, the effects on units upstream and downstream of the new or modified unit and units inphysical proximity must be considered.

3.6.2.2 The design of these existing units may have to be reviewed to ensure that the modified unit has noharmful effects on parts of the existing facility.

3.6.2.3 Process proximity. Consideration must be given during the design of the modification to other partsof the existing hydrocarbon facility that are in process proximity to the modifications. The effects on unitsupstream or downstream must be considered in terms of, for example:

— incoming or outgoing product composition— corrosion potential of changes in product composition— changes in product:

— flowrates— temperatures— pressures.


DNV GL AS

3.6.2.4 Physical proximity. Existing units may be in physical proximity although they may have little or noprocess proximity. The effects on units in physical proximity must be considered in terms of, for example:

— fires and explosions— release of toxic vapour, i.e. HF alkylation— changes to escape routes and emergency vehicle access.

3.6.3 Verification during the design of modifications

3.6.3.1 The scope of work for verification of the design of hydrocarbon facility modifications will follow Table3-3 with the addition of specific aspects related to modifications shown in Table 3-10.

3.6.4 Verification during the construction of modifications

3.6.4.1 The scope of work for verification of the construction of hydrocarbon facility modifications will followTables 3-4, Table 3-5 and Table 3-6 with the addition of specific aspects related to modifications shown inTable 3-11.

3.6.4.2 No additional verification activities have been identified for the verification of manufacturing andfabrication of components.

Table 3-10 Scope of work for verification of design of modified facilities


L M H

Review of specifications for design

— review of the design basis including the effects on existing units x x x

Review of effects on existing units upstream and downstream

— review main documentation to ensure that the main process effects, includingthe effects on units upstream and downstream, have been considered, that thegoverning conditions are identified, and that the chosen design philosophies are inaccordance with specified codes and standards

x x x

— evaluation of the main methods used during this consideration with spot checks ofthe input data and the calculation results

x x


Review of effects on existing units in physical proximity

— review main documentation to ensure that the main physical proximity effectshave been considered, that the governing conditions are identified, and that thechosen design philosophies are in accordance with specified codes and standards

x x x

— evaluation of the main methods used during this consideration with spot checks ofthe input data and the calculation results

x x



DNV GL AS

Table 3-11 Scope of work for verification of site construction of modified facilities


L M H

Surveillance during construction activities

— Spot checks of physical effects on existing units, paying particular attention toaspects that may not have been readily apparent during design, such as:

— access ways and escape routes— valve access.

x x x

3.6.5 Verification during the commissioning of modifications

3.6.5.1 The scope of work for verification of the commissioning of hydrocarbon facility modifications willfollow Table 3-3 with the addition of specific aspects related to modifications shown in Table 3-12.

Table 3-12 Scope of work for verification of site commissioning of modified facilities


L M H

Surveillance during commissioning activities

— Spot-checks during commissioning, paying particular attention to the continuedproper operation of safety systems in existing units, such as fire and gas andemergency shutdown systems

x x x


DNV GL AS

APPENDIX A SELECTION OF VERIFICATION LEVEL

A.1 Introduction

A.1.1 General principles

A.1.1.1 The selection of the level of verification depends on the criticality of each of the elements that havean impact on the management of risks to the hydrocarbon facility.

A.1.1.2 Verification shall direct greatest effort at those elements of the hydrocarbon facility where the riskis highest and whose failure or reduced performance will have the most significant impact on the safety andintegrity of the facility. Other risks such as:

— environmental risks— economic risks

may be considered if required by the owner.

A.1.1.3 Suitable selection factors include, but are not limited to, the:

— overall safety objectives for the facility— assessment of the risks associated with the facility and the measures taken to reduce these risks— degree of technical innovation in the facility or any of its equipment— experience of the contractors in carrying out the work— quality management systems of the owner and its contractors.

A.1.1.4 Due to the diversity of various hydrocarbon and petrochemical facilities, their contents, their degreeof innovation, the geographic location, etc., it is not possible to give precise guidelines on how to decide whatlevel of verification is appropriate for each particular facility.

A.1.1.5 In view of the complexity of most hydrocarbon facilities, DNV GL recommends strongly that theverification level be derived from the results of a quantitative risk assessment of the facility.

Guidance note:Only in the simplest of hydrocarbon facilities, with consequently lower levels of risk, would DNV GL consider that simplifiedqualitative verification planning using the trigger questions set out in part [A.3] is justifiable.


A.2 Quantitative risk assessment

A.2.1 Use of a quantitative risk assessment

A.2.1.1 The outcome of a quantitative risk analysis (QRA) should be a ranking of the risks associated withparticular parts or equipment of the hydrocarbon facility.

A.2.1.2 This ranking shall be used to set the verification level for particular parts of the facility as well as forthe facility as a whole as shown in Figure A-1.


DNV GL AS

Figure A-1 Risk ranking versus verification effort

A.2.2 Scope of a quantitative risk assessment

A.2.2.1 The scope of quantitative risk assessment (QRA) shall include tasks typically required to assess risksfrom hazard events to human life, facility equipment and environment. It shall include:

— hazard identification— frequency estimation— consequence criteria— consequence analysis— domino effect analysis— risk summation and evaluation— sensitivity analysis— assessment of inherent safety, detection, prevention, control, mitigation and emergency response

measures.

A.2.3 Risk assessment

A.2.3.1 Risk assessment should be carried out using event tree analysis and probabilistic analysis and basedon the following requirements:

— The results of the probabilistic analysis should be utilized in the event tree analysis to estimate thefrequencies associated with different hazardous outcomes.

— A probability analysis should then conducted to estimate the fatality probability associated with ahazardous consequence.

— Risk summation should be conducted using modern computer programs.

A.2.3.2 The results of the study should be presented in terms of individual risk and societal risk from thefacilities as follow:

— The individual risk should be presented in the form of iso-contours.— Societal risk should be provided in terms of F-N curves.— Potential loss of life will be utilized in assessing the relative risk contribution of different facilities.

A.2.3.3 Risk criteria or guidelines shall identify a level of risk, which is:

— unacceptable or intolerable— acceptable or negligible.


DNV GL AS

A.2.3.4 The ALARP area, lying between two ranges above, is the area within which risks must be reduced tolevels As low as reasonably practicable.

A.2.3.5 The reasonable practicality of risk reduction should be established by consideration of cost versusrisk reduction achieved. Preliminary selection of conceptual measures will be effected by consideration oftechnical practicality.

A.2.3.6 The project documents to be reviewed for risk assessment are:

— PFDs, UFDs and P&IDs— stream composition, inventory of hazard substances, operating and design conditions in different

equipment or piping items, failure of which can result in one of the identified hazardous events— scale plan of the site showing location of all identified failure sources— description of the processes or storage involving the hazardous substances— area distribution of on-site population— other document deemed necessary by the verifier to review for risk assessment.

A.2.4 Hazard identification

A.2.4.1 The hazard identification should include the:

— review of previous safety studies or hazard assessment reports— review of hazardous material data sheets— identification of hazard locations— identification of the ways which hazards from every location could become a reality (failure mode

analysis)— classification and ranking of hazardous events in terms of accident potential.

A.2.5 Frequency estimation

A.2.5.1 This task has to involve the estimation of the frequency of each representative event identified.Frequency estimation should comprise two basic steps:

— quantification of the frequency of the initiating events (different failures)— quantification of the frequency of the various hazardous outcomes (e.g. BLEVE, toxic releases, flash fire,

pool fire, jet fire, tank fire, explosion, etc.).

A.2.6 Consequence criteria

A.2.6.1 Consequence criteria should be determined for all effects. More than one criterion determination foran effect should be carried out where possible.

A.2.7 Consequence analysis

A.2.7.1 An accurate assessment of the consequences resulting from a hazard event shall be provided asan important element of risk assessment. The impacts on surrounding population of each identified hazardevents shall be determined considering consequences arising from hazard events.

A.2.7.2 Advanced models shall be used for investigation of consequences of each identified hazardous event.

A.2.7.3 The results of the major failure events having high damage potential must be representedgraphically to depict potential hazard zones.


DNV GL AS

A.2.7.4 Significant hazard distances (hazard diagrams) with respect to surrounding areas shall be providedin both tabular and illustrative forms.

A.2.8 Domino effect analysis

A.2.8.1 The analysis of domino effect events (i.e. escalation of initial events to cause more widespread andserious consequences) shall cover the potential on-site escalation and off-site escalation.

A.2.9 Risk summation and evaluation

A.2.9.1 The risks shall be summarised and assessed in three parts:

— individual risks— group risks— other, non-personnel, risks.

A.2.9.2 Individual risks shall be expressed in terms of location-specific and individual-specific risks, bymeans of:

— individual risks per year— fatal accident rate.

A.2.9.3 Group risks shall be expressed in terms of:

— FN curves, showing the relationship between the cumulative frequency (F) and number of fatalities (N).— Annual fatality rates, in which the frequency and fatality data is combined into a convenient single

measure of group risk.

A.2.9.4 Other risks, depending on the owner’s requirements, may be expressed in terms of:

— damage risks— deferred production— oil spills.

A.2.10 Sensitivity analysis

A.2.10.1 A sensitivity analysis shall be conducted on the risk assessment results to determine howsignificantly any particular estimate is concerning the overall risk calculation.

A.2.11 Assessment of risk mitigation measures

A.2.11.1 A preliminary identification and analysis of possible risk mitigation measures, i.e. inherent safety,prevention, detection, control, mitigation and emergency response, shall be carried out in accordance withALARP principle. Practical and cost-effective risk mitigation measures based on the risk assessment resultsshall be identified. Societal risk concerns should be incorporated if appropriate taking into considerationaggregate risk posed to the hydrocarbon facility neighbouring community.

Guidance note:App.D gives typical refinery hazards and the interface with safety-critical elements and risk mitigation measures.


A.2.11.2 This assessment shall be reported by means of a cost-benefit analysis.


DNV GL AS

A.3 Trigger questions

A.3.1 Use of trigger questions

A.3.1.1 In the simplest of hydrocarbon facilities, with consequently lower levels of risk DNV GL consider thatsimplified qualitative verification planning using the trigger questions may be justifiable.

A.3.1.2 Guidance is given as a series of questions that should be answered when deciding the appropriatelevel of verification for a simple hydrocarbon facility. This list is not exhaustive and other questions should beadded to the list if appropriate for a particular facility.

A.3.1.3 It must be emphasised that the contribution of each element should be judged qualitatively and/orquantitatively.

A.3.1.4 Depending of the stage of the project, the activities may not have taken place yet in which case thequestions can also be posed in another form, i.e. Is …. planned to be?.

A.3.2 Overall safety objective— Does the safety objective address the main safety goals?— Does the safety objective establish acceptance criteria for the level of risk acceptable to the owner?— Is this risk (depending on the type of facility and its location) measured in terms of human injuries?

Guidance note:Environmental, economic and political risks, amongst others, may be considered if required by the owner.


A.3.3 Assessment of risk— Has a systematic review been carried out to identify and evaluate the probabilities and consequences of

failures in the hydrocarbon facility?— Has this review judged the contribution of each element qualitatively and/or quantitatively and used,

where possible, quantified risk assessment data to provide a justifiable basis for any decisions made?— Does the extent of the review reflect the criticality of the facility, the planned operation and previous

experience with similar facilities?— Does this review identify the risk to the operation of the facility and to the health and safety of personnel

associated with it or in its vicinity?— Has the extent of the identified risks been reduced to a level as low as reasonably practicable by means of

one or both of:

— reduction in the probability of failure?— mitigation of the consequences of failure?

— Has the result of the systematic review of the risks been measured against the owner’s safety objective?

— Has the result of this review been used in the selection of the appropriate verification activity level?

A.3.4 Technical innovation— Has the degree of technical innovation in the facility been considered?— Has it been considered that risks to the facility are likely to be greater with a high degree of technical

innovation than with a facility designed, manufactured and installed to well-known criteria in well-knownlocations?


DNV GL AS

— Have factors been considered in the selection of the appropriate verification level such as:

— degree of difficulty in achieving technical requirements?— knowledge of similar facilities?— effect of the new facility on the surrounding area?

A.3.5 Contractors’ experience— Has the degree of risk to the facility been considered where design, construction or installation contractors

are inexperienced?— Has the degree of risk been considered where the contractors are experienced but not in similar work?— Has the degree of risk been considered where the work schedule is tight?

A.3.6 Quality management systems— Have all parties involved in the facility implemented an adequate quality management system to ensure

that gross errors in the work are limited?— Do these parties include the:

— owner?— design contractor?— construction contractors?

— Do the factors being considered when evaluating the adequacy of the quality management systeminclude:

— whether or not an ISO 9001 or equivalent certified system is in place?— results from external audits?— results from internal audits?— experience with contractors’ previous work?— project work force familiarity with the quality

management system?


DNV GL AS

APPENDIX B VERIFICATION DOCUMENTS

B.1 Purpose of appendix

B.1.1 Introduction

B.1.1.1 This appendix defines the documents used by DNV GL in the verification (and certification) ofhydrocarbon refineries and petrochemical facilities.

B.1.1.2 The following documents are included, with samples where necessary:

— certificate of conformity— statement of conformity— verification comments sheet— verification report— visit report.

B.1.1.3 Guidance in the use of quality management systems during verification activities is given also.

B.1.2 Issue and filing of certificates

B.1.2.1 The DNV GL regional office is responsible for preparation and issue of the certificates. The certificateshall be given a unique regional number and be signed according to DNV GL’s chart of authority.

B.1.2.2 The regional office is responsible also for archiving of the certificate and maintaining overview ofcertificates issued.

B.1.3 Validity of verification documents

B.1.3.1 Verification documents are, in principle, documents confirming that an examination has been carriedout, and are valid only at the time of issue.

B.2 DNV GL certificate of conformity

B.2.1 Definition

B.2.1.1 The DNV GL certificate of conformity confirms that, after performing verification according to a DNVGL defined scope of work, DNV GL has found the hydrocarbon facility to conform to a given DNV GL standardor acceptable international standard.

B.2.1.2 Table B-1 below shows the essential differences between a DNV GL certificate of conformity and astatement of conformity.

B.2.1.3 An example of a typical certificate of conformity is shown at the end of this appendix.


DNV GL AS

B.2.2 Scope of Verification to obtain a DNV GL certificate of conformity

B.2.2.1 The scope and depth of the verification necessary to obtain a DNV GL certificate of conformity shallbe as defined in this service specification. The basis for the DNV GL certificate of conformity shall always be averification plan tailor-made to the project and in accordance with this service specification.

B.2.2.2 Part of the plan may be that DNV GL relies on independent review certificates to document the workperformed by others.

B.2.2.3 The issue of a DNV GL certificate of conformity shall be based on a dedicated verification report.

Table B-1 Certificates and statements issued by DNV GL

Certificate of conformity Statement of conformity

Use Shall be used when the scope and depth of theverification is defined in this service specification(DNVGL-SE-0469); or defined by the legislation ofnational authorities

To be used in all instances wherecertificate of conformity is notapplicable

Scope responsibility Scope defined by DNV GL and/or a nationalauthority. Scope defined by customer

Scope execution DNV GL normally performs the complete scope.

However, DNV GL may accept an externalindependent review certificates: this shall bereflected in the certificate text

The preferred option when DNVGL accepts an independent reviewcertificate from an external party.

Objects covered Complete hydrocarbon refineries or petrochemicalfacilities

Standalone equipment, or equipment in self-contained packages

As for certificate of conformity

B.3 Statement of conformity

B.3.1 Definition

B.3.1.1 A statement of conformity is issued in all instances where certificate of conformity is not applicable.

B.3.1.2 A statement of conformity can be issued on completion of each particular project phase, or a partthereof, and shall be based on a dedicated verification report.

B.3.2 Scope of verification to obtain a statement of conformity

B.3.2.1 A statement of conformity shall be issued as a formal statement confirming that verification ofdocuments and/or activities, has found that the hydrocarbon facility, a part thereof, complies with therequirements applicable for that particular scope of work.

B.3.2.2 An example of a typical statement of conformity is shown at the end of this appendix.


DNV GL AS

B.4 Other verification documents

B.4.1 Verification reports

B.4.1.1 Verification reports are issued to confirm that the verification of the relevant hydrocarbon facility hasbeen completed in accordance with specified requirements.

B.4.1.2 The report shall include information such as:

— hydrocarbon facility description and unit or equipment number, if relevant— application (operational limitations and conditions of use) for which the hydrocarbon facility is intended— codes and standards in conformance with the hydrocarbon facility has been verified— clear statement of the conclusion from the verification (does it or does it not meet the specified

requirements)— codes and standards used as reference— documentation on which the verification report is based (documents, drawings, correspondence, including

revision numbers)— project-specific scope of work tables— any comments— identification of any non-conformances.

B.4.1.3 The verification report shall always be dated and have two signatures, the originator and the DNV GLinternal verifier.

B.4.2 Verification comments sheets

B.4.2.1 Reviews of documents shall be reported using verification comment sheets (often called VerComs).These documents give details to the client of aspects of hydrocarbon facility design and construction thatDNV GL:

— considers do not meet the specified requirements— does not have enough information to make a decision— offers advice based on its own experience.

Guidance note:Verification comments sheets shall be issued, stating, DNV GL has no comments to this document, when DNV GL has no commentsto make. This will provide evidence that verification of the document has been carried out.


B.4.2.2 Only in the first two instances does DNV GL expect a response from the owner or its contractors.

B.4.2.3 Comments criticality:

— NC – Non conformance. May be critical with respect to safety and/or integrity of the hydrocarbon facilityand is not in accordance with the referred rules, standards or specifications. Needs to be closed before thedocument can be accepted.

— TQ – Technical query. May be critical with respect to safety and/or integrity of the hydrocarbon facility.Needs to be closed before the document can be accepted.

— A – Advice. Does not need any action.


DNV GL AS

B.4.2.4 Comment status:

— O – Open comment: The comment has not been answered or not answered satisfactorily and thecomment is still open.

— C – Closed comment: The comment has been closed.— CN – Conditionally closed: The comment has been closed based on a reply from the owner. The comment

is to be implemented (e.g. document revision) or the acceptance is based on applicable conditions (e.g.site inspection).

B.4.2.5 An example of a typical verification comment sheet is shown at the end of this appendix.

B.4.3 Visit reports

B.4.3.1 Visit reports are the documentation of attendance activity by DNV GL.Guidance note:Visit reports may be called by different names, such as survey report, inspection report, site report, or others.


B.4.3.2 A visit report shall contain enough information to identify clearly the hydrocarbon facility, or partthereof, that has been examined, the operating conditions or specifications to which it has been examinedand the conclusion reached by DNV GL.

B.4.3.3 The visit report shall be printed on the relevant form and shall contain as much information aspossible in accordance with the standard headings in the form. In addition, the report number shall beshown.

B.5 Use of quality management systems

B.5.1 General

B.5.1.1 The assurance of hydrocarbon facility safety and integrity requires that gross errors during design,construction and commissioning be minimised. The likelihood of such gross errors shall be reduced in asystematic manner by the operation of a quality management system adequate for the work being carriedout.

B.5.1.2 Quality management systems frequently are documented at three levels:

— The quality manual and related procedures document how the organisation, as a whole, manages thequality of all its products and services.

— The quality plan documents the specific procedures related to a particular project.— The inspection and test plan documents how the quality control activities for a particular project shall be

carried out and recorded.

B.5.1.3 Guidelines on the formation of quality plans may be found in ISO 10005 2005 Quality ManagementSystems – Guidelines for Quality Plans, see [1.5].Guidance on the use of quality management documentation in general may be found in ISO TR 10013 2001Guidelines for Quality Management System Documentation see [1.5].


DNV GL AS

B.5.2 Quality plans

B.5.2.1 The basic function of a quality plan is to be a memory aid in the management of a project. In anorganisation with many quality procedures for a variety of functions, the quality plan states those thatare applicable to that particular project. The quality plan acts as a route map through the complexities ofmanagement of the project and highlights those activities relevant to quality management.

B.5.2.2 The project quality plan normally consists of two parts; firstly, a narrative description of the meansof controlling the project, and secondly, a tabular description of the inspections and tests to be carried outduring the work.

B.5.3 Inspection and test plans

B.5.3.1 The tabular description of the inspections and tests to be carried out during the work frequently isknown as the inspection and test plan.

B.5.3.2 The following items should be checked for inclusion within the inspection and test plan:

— Each inspection and test point and its relative location in the production cycle should be shown.— The characteristics to be inspected and tested at each point should be identified.— The use of sub-contractors should be indicated and details of how the verification of sub-contractor’s

quality shall be carried out should be shown.— Hold points established by the constructor, the operator or a third party, where witness or review of the

selected inspection or test is required, should be shown.

B.5.4 Review of quality management programme

B.5.4.1 The contractor’s quality manual shall be reviewed for compliance with ISO 9001. The contractor’soperations should be audited to establish compliance with the documented system.

B.5.4.2 If the contractor has a quality system certified by an accredited third party certification body for thescope of work to be undertaken, this may be taken as evidence of a satisfactory quality system provided thecertificate is relevant to the contractor’s scope of work for the project. However, the last two years’ periodicalaudit reports shall be reviewed to identify if any recurring non-conformities have been revealed.

B.5.4.3 Any weaknesses revealed during this audit, or review of periodical audit reports, shall be consideredwhen planning the contractor monitoring activities.

B.5.4.4 Surveillance of the continuing acceptability of the contractor’s quality management system is carriedout by observing a selection of audits carried out by the contractor as part of its internal audit system. Theaudits to be observed should be selected over the length of the project at suitable intervals and should coveras wide a selection of activities as possible.

B.5.4.5 Contractor’s inspection and test plans for the various activities undertaken during their scope of workfor the hydrocarbon facility shall be reviewed and accepted, if adequate.


DNV GL AS

B.6 Verification forms

B.6.1 Specimen forms

B.6.1.1 Specimen forms are shown overleaf. These forms may be modified to suit specific projects, providingthat these modified forms contain the minimum information shown here.

B.6.1.2 The forms are:

— certificate of conformity— statement of conformity— verifications comments sheet


DNV GL AS

B.6.2 Certificate of conformity

EXAMPLE


DNV GL AS

B.6.3 Statement of conformity

EXAMPLE


DNV GL AS

B.6.4 Verification comments sheet


DNV GL AS

APPENDIX C GENERIC DETAILED VERIFICATION SCOPES OF WORKTABLES

C.1 Purpose of appendix

C.1.1 Introduction

C.1.1.1 This appendix gives the format of the generic detailed scope of work tables for all types ofhydrocarbon facility.

C.1.1.2 The detailed project-specific scope of work tables for the chosen level of verification shall be basedon these tables.

C.1.1.3 For hydrocarbon facilities with aspects or components not covered in this appendix, similar tables,with the same degree of detail, shall be developed.

C.2 Description of terms used in the scope of work tables

C.2.1 Abbreviations and terms

C.2.1.1 The following abbreviations have been used:

A = auditS = surveillanceH = hold pointR = review.

C.2.1.2 These abbreviations are DNV GL’s preferred terms and will be used in DNV GL-generated documents.However, other terms, for example monitoring or witnessing, will be used by DNV GL if these are the termscommonly used in documents, such as Inspection and test plans, generated by others. In that case, it isexpected that these other terms will be defined in these documents.

C.2.2 Audit

C.2.2.1 Systematic, independent and documented process for obtaining audit evidence and evaluating itobjectively to determine the extent to which audit criteria are fulfilled. (ISO 9000:2005) see [1.5].

Guidance note:This activity differs from the surveillance by being focused on the adherence to procedures including their completeness androbustness and not a detailed review of the results of the procedures (although this is not ignored). Further, the audit is normally a‘one-off’ activity as opposed to the continuity of surveillance.


C.2.2.2 Note that the activity Audit of quality management system may be omitted if there exists a qualitymanagement system in accordance with ISO 9001, certified by an accredited third party for the scope ofwork being carried out in the project.


DNV GL AS

C.2.3 Surveillance

C.2.3.1 Continual monitoring and verification of the status of an entity and analysis of records to ensure thatspecified requirements are being fulfilled (ISO 8402:1994) see[1.5].

Guidance note:Other commonly used terms for surveillance are monitoring or witnessing.


C.2.3.2 The amount of work involved in surveillance is not described in detail in the tables. This shall be partof the final contractual scope of work, which shall define the frequency of surveillance based on the overallsurveillance and the quality control performed by other parties as well as DNV GL’s experience.

C.2.3.3 The following shall are typical descriptions of the frequencies, if nothing else is defined specifically:

S1 = Surveillance on a visit basisS2 = Surveillance frequency minimum once per dayS3 = Surveillance frequency minimum once per shift

Guidance note:These surveillance frequencies may be modified to correspond with production work flow.


C.2.4 Hold point

C.2.4.1 A point, defined in an appropriate document, beyond which an activity must not proceed without theapproval of a designated organization or authority (ISO 8402:1994).

C.2.5 Review

C.2.5.1 Systematic examination of reports and documentation. The depth of review will depend both on thetype of document and the level of involvement.

C.2.5.2 The following shall be used to describe the extent of the review if nothing else is defined specifically:

I = for information only1 = review of principles and general aspectsR2 = comprehensive review.

C.2.5.3 A recommended depth of verification (I, R1, R2, S1, S2, S3) is specified for each generic verificationitem is given in Table C-1 for the three verification levels low, medium and high described in [C.4.2], [C.4.3]and [C.4.5].

Guidance note:The verification level of low, medium high defines the overall verification effort for the project. The verification depth defines thedepth of the verification effort for each identified verification activity.


C.2.5.4 Documents that are reviewed by DNV GL will not be signed and stamped, unless otherwise agreed.


DNV GL AS

C.3 Overall project management

C.3.1 Availability of documents

C.3.1.1 The project quality management documentation shall be available at the early stages of the project,preferably before design is underway, to ensure that the necessary controls are in place

C.3.2 Detailed scope of work for overall project management

C.3.2.1 A detailed scope of work for the overall project management is given in Table C-1.

Table C-1 Overall project management

LevelItem Description

Low Medium High

1. Review of project quality management documentation R1 R2 R2

2. Audit of project quality management system A A A

3. Review of sub-contractor control R1 R2 R2

4. Review of interface controls R1 R2 R2

5. Review of methods of information flow - - R2

C.4 Design

C.4.1 General

C.4.1.1 For design verification, a list similar to that given in Table C-4 to Table C-30 shall be made for thespecific hydrocarbon facility.

C.4.1.2 It is preferred that the documentation of the items in Table C-4 shall be available at the early stagesof the design.

C.4.2 Design verification

C.4.2.1 Design of a hydrocarbon facility shall cover all development phases including construction,commissioning and operation.

C.4.2.2 Table C-5 to Table C-29 describe the issues to be verified and Table C-30 identifies the extent ofindependent analyses/calculations included in the three verification levels. Sections [D.3], [D.4] and [D.5]following, describe the verification for each of the levels.

C.4.3 Low level design verification

C.4.3.1 Low level design verification consists of a detailed document review of the design basis, riskassessment and analysis documentation, quality management documentation and design method or design


DNV GL AS

philosophy documents. The presumed critical aspects of the project shall be identified by DNV GL fromthe initial review and conveyed to the owner and designer for discussion and agreement on a commonunderstanding.

C.4.3.2 The subsequent verification consists of a document review of the calculations and analysis methodsused to conclude the critical aspects. Other design documents are used as information and a few will be spot-checked for confirmation of the quality control.

C.4.3.3 Implementation of the transfer of conclusions from design calculations and reports into drawings andspecifications is not included.

C.4.4 Medium level design verification

C.4.4.1 Medium level design verification consists of a review of all main design documents related to thesafety and integrity of the hydrocarbon facility. Less critical aspects will be spot-checked. The review willbe detailed for all critical aspects and if deemed necessary independent calculations may be performed tosupport findings.

C.4.4.2 Implementation of the conclusions from design calculations and reports into drawings andspecifications will be included on a spot check basis.

C.4.5 High level design verification

C.4.5.1 High level design verification consists of a full review of most of the produced documents relatedto the safety an integrity of the hydrocarbon facility. The review will be detailed for all critical aspects andindependent checks will be performed.

C.4.5.2 Implementation of the conclusions from design calculations and reports into drawings andspecifications is included.

C.4.5.3 The main specifications are also checked for clearness and ambiguity.

C.4.6 Safety-critical elements and components

C.4.6.1 Based on the results of the HAZID, HAZOP or other safety assessments, hydrocarbon refinery andpetrochemical facilities are likely to have many or most of the following safety-critical elements present.

C.4.6.2 Verification of design is broken down into consideration of these safety-critical elements andcomponents in isolation but the many interactions between them must not be forgotten.

C.4.6.3 Typical safety-critical elements for a hydrocarbon facility are shown in Table C-2. These safety-criticalelements shall be modified to suit a specific facility.

Table C-2 Refinery and petrochemical plants - typical SCEs and Components

Function Safety critical elements (SCE) Component

Layout AllInherent safetymeasures Hydrocarbon inventory/ leak

source minimisation All


DNV GL AS


Single point mooring (SPM)

Flexible riser

Crude oil pipelines (including pig launcher/receiver andany manifolds)

Jetties

Offloading and loading facilitiesintegrity

Loading and unloading arms

Process system

Relief valves and relief system

Structural integrity

Above ground storage tanks

Process facilities integrity

Control systems

Vehicles

Fired heaters, hot surfaces and exhaust

Electrical itemsControl of ignition

Lightning protection, static and earthing

Hazard preventionmeasures

Dropped object and impactprotection All

Smoke and gas detection for site buildings

Fire and gas detection - external areas

Fire and gas detection - machinery enclosures

Fire and gas control (part of ICS)

Fire and gas fetection

Personal toxic gas detection and protection

Visual monitoring CCTV

ESD control systemEmergency shutdown system(ESD) Emergency shutdown valves (ESDVs)

Blowdown header and flaresystem All

Control room All

Fire water storage

Firewater pumps

Firewater distribution ring main

Firewater and foam supply

Gaseous fire fighting systems

Hazard Detection andControl Measures

Active fire fighting systems

Fire-fighting vehicles


DNV GL AS


Passive fire protection All

Bunding and drainage All

Emergency powerEmergency services

Emergency communications and alarms

Internal and externalcommunications All

Personnel toxic gas protection All

Uninterruptible power source All

Hazard

Mitigation Measures

HVAC All

Escape routesEgress and evacuation system

Muster areaEmergency ResponseMeasures

Emergency services Emergency lighting

C.4.7 Scope of work for design

C.4.7.1 Detailed scopes of work for design are given in Table C-4 to Table C-30.

Table C-3 Summary table – design review

Table no. Table description

C-3.2 General design matters

C-3.3 Safety, environmental or other functional requirements

C-3.4 Layout

C-3.5 Hydrocarbon inventory and leak source minimisation

C-3.6 Pressure vessels

C-3.7 Offloading and loading facilities

C-3.8 Jetties

C-3.9 Loading and unloading arms

C-3.10 Process system

C-3.11 Relief valves and relief system

C-3.12 Structural integrity

C-3.13 Above ground storage tanks

C-3.14 Control systems

C-3.15 Control of ignition

C-3.16 Dropped object and impact protection


DNV GL AS


C-3.17 Fire and gas detection

C-3.18 Emergency shutdown system

C-3.19 Blowdown header and flare system

C-3.20 Control room

C-3.21 Active fire fighting systems

C-3.22 Passive fire protection

C-3.23 Bunding and drainage

C-3.24 Emergency power and uninterruptible power supply

C-3.25 Communications and alarms

C-3.26 HVAC

C-3.27 Egress and evacuation system

Independent calculationC-3.28

i) Blow-down

ii) Piping flexibility

iii) Pressure vessels and storage tanks

Table C-4 General design matters


Low Medium High

1. Safety objective - R1 R2

2. Confirmation that the various contractors and sub-contractors’ qualitysystems meet the requirements of ISO 9001 - R1 R2

3. Description of hydrocarbon facility and overall project organisation - R1 R1

4.Risk assessment and identification of critical aspects

(see Table D-1)R1 R2 R2

5. Document register - - -

6.

Design philosophies for the facilities, typically;

— active and passive fire protection— safety systems (FGS/ESD/PSD/PCS)— shutdown logic— process design— piping design— relief and blowdown— material selection and corrosion management— etc.

R1 R2 R2


DNV GL AS

Table C-5 Safety, environmental or other functional requirements


Low Medium High

1. Quantitative risk assessment R1 1) R1 1) R2 1)

2. Fire and explosion analysis R1 R1 R2

3. Emergency system survivability analysis R1 R1 R2

4. Fire mapping and detection R1 R1 R2

5. Computational fluid dynamics analysis for gas detection R1 R1 R2

6. Environmental impact assessment - - R1

1) In cases where DNV GL has not carried out the quantitative risk assessment itself.

Table C-6 Layout


Low Medium High

1.Confirm by review of the QRA that the adequacy of the site layout has beendemonstrated to show that the level of risk is within the owner’s acceptablerisk criteria

- R1 R2

2. Confirm by review of the QRA that the risk of exposure outside the facilityhas been reduced to ALARP - R1 R2

3.Confirm by review of equipment layout drawings, bases of design andformal safety assessments that equipment separation within the facility isadequate in terms of the acceptable risk criteria

R1 R2 R2

4.

Confirm by document review that the facility layout demonstrates:

— segregation of different hazards within the plant— minimisation of pipe runs between units— containment of spills and leaks— limitation of risk exposure within and outside plant— access/egress for emergency services— provision of secure site entrance points— access and lay down areas to enable safe construction, operation and

maintenance— adequate provision of escape and evacuation routes to safe muster

areas— safe location of control building.

R1 R2 R2

5.

Review plot plan, equipment location plan drawings to confirm locationof plant buildings (control room, administration, maintenance workshop,warehouse, laboratories, etc), flare and equipment spacing in accordancewith codes and specifications

R1 R2 R2


DNV GL AS

Table C-7 Hydrocarbon inventory and leak source minimization


Low Medium High

1. Verify the location and size of hydrocarbon and chemical storage facilities - R1 R2

2. Verify that potential leak sources have been challenged and justifiedthrough the risk management process - R1 R2

3.The adequacy of the inventory management system and philosophy is tobe demonstrated in the QRA to show that the level of risk is within thecorporate risk acceptable criteria

- R1 R2

4. Confirm that storage facilities and operating philosophy are in line withmaximum allowable inventories - R1 R2

5.Pipe stress analysis philosophy, guidelines and work instructions to identifyneed for additional information not outlined in the specified piping code orproject standards

R1 R1 R2

6.

Selection of pipe stress analysis reports and pipe stress isometrics toensure that the analysis meet the requirement outlined in the specificpiping code, project standards and project pipe stress analysis philosophy

Note 1: A typical selection may be based on large pipe size, largetemperature differential and piping with high pressure.

Note 2: Piping line list, piping critical line list and project P&IDs normallywill be used as the basis for this selection.

R1 R2 R2

7.

Review of a selected number of piping classes in the piping materialspecification. Typical this work will consist of spot check of tabulated wallthickness against temperature, pressure, corrosion allowance, impacttesting and fitness for service.

Note 1: Relevant material data sheets will also be considered

Note 2: The selection may be based on materials not widely used, such assuper duplex, 6Mo, titanium and composite.

R1 R2 R2

8.

Design calculations to confirm pressure vessel design in accordance withapplicable codes, standards and specifications.

Note 1: See Table C-8 for more detailed requirements for pressure vesseldesign verification

R1 R2 R2


DNV GL AS


Low Medium High

9.

Design calculations to confirm piping system design is in accordance withapplicable codes, standards and specifications, including:

— design and fabrication specifications— piping specifications— mechanical flow diagrams— process and instrumentation diagrams for:

— all process piping— all drilling piping— all utilities piping— summary of piping flexibility analyses including description of

computer programs, methods of analysis and flexibility analysis of afew selected pipe runs

— drawings of non-standard components— welding procedure specifications.

R1 R2 R2

10.

Design calculations to confirm pumps and compressors design is inaccordance with applicable codes, standards and specifications, including:

— design specification— general arrangement drawings including foundation design— cross-sectional drawings— detailed drawings of rotating and pressure retaining parts— auxiliary system drawings— calculations of pressure retaining parts in both operating and pressure

test conditions— calculations for rotating parts— lateral and torsional vibration analysis— bill of materials— fabrication specification— welding procedure specifications.

R1 R2 R2

11.

Design calculations to confirm gas turbine and combustion engine designis in accordance with applicable codes, standards and specifications,including:

— technical specification— arrangement drawings— detailed sectional and part drawings— rotor bearing drawings— system drawings— safety systems— turbine hood ventilation philosophy— lateral and torsional vibration analysis— material specifications— fabrication specification— testing procedures.

- R1 R2


DNV GL AS

Table C-8 Pressure vessels


Low Medium High

Guidance note:There are many different types of reactors, heat exchangers, boilers and other types of pressure vessels in hydrocarbonfacilities and it is not possible to give detailed verification requirements for each one. However, verification of their designwill follow the same general path in considering:

— design pressures

— design temperatures

— characteristics of contents

— structural stability.

This table lists verification activities that are common to most types of pressure vessels but these activities may be modifiedto suit specific types of vessels.


Materials and corrosion

1. Material specification R1 R1 R2

2. Corrosion protection R1 R1 R2

Pressure containment

3. Design stress R1 R2 R2

4. Spherical/cylindrical shell - internal and/or external pressure R1 R2 R1

5. Domed ends - internal and/or external pressure R1 R2 R2

6. Conical ends/truncated cones - internal and/or external pressure R1 R2 R1

7. Cylindrical/spherical/conical shell combined loading R1 R2 R2

8. Local loads on pressure vessel shell R1 R2 R1

9. Flat ends/flat plates R1 R2 R2

10. External pressure stiffening rings R1 R2 R1

11. Flat heat exchanger tube sheet R1 R2 R2

12. Spherically domed/bolted ends R1 R2 R1

13. Openings/branch connection R1 R2 R2

14. Overpressure/vacuum protection R1 R2 R1

15. Manholes R1 R2 R2

16. Jacketed vessel R1 R2 R1

17. Supports (saddles, lugs or foundations) R1 R2 R2

18. Bolted flange connections R1 R1 R1

General design

19. Construction category - R1 R2


DNV GL AS


Low Medium High

20. Weld design R1 R2 R2

21. Fatigue R1 R2 R2

Construction

22. Heat treatment extent - R1 R2

23. NDT extent I R1 R2

24. Shop/site hydro test pressure I R1 R2

25. Welding procedure specification requirements I R1 R2

26. Nameplate data - R1 R1

Table C-9 Offloading and loading facilities


Low Medium High


1.Confirm by document review that the SPM (or its equivalent) has beendesigned in accordance with DNVGL-OS-E403 Offshore loading units oranother code or standard giving an equivalent level of safety

R1 R1 R1

Flexible riser

2.Confirm by review of documents, such as independent design reviews andproduct certification, that the flexible riser (if fitted) has been designed inaccordance with a suitable code or standard

R1 R1 R1

Crude oil pipelines (including pig launcher/receiver and any PLEMs or manifolds)

3.Confirm by document review that any pipelines have been designed inaccordance with DNVGL-ST-F101 Submarine pipeline systems or anothercode or standard giving an equivalent level of safety

R1 R1 R1

Table C-10 Jetties


Low Medium High

1.

Jetty design has taken account of:

— geotechnical considerations— environmental loads (including dynamic response of the structures to

cyclic loads)— operational loads.

R1 R2 R2

2. Corrosion assessment report and corrosion monitoring system R1 R2 R2

3. Structural design - R1 R2

4. Construction and inspection procedures R1 R2 R1


DNV GL AS

Table C-11 Loading and Unloading arms


Low Medium High

1. Pressure containment, thermal, structural and fatigue calculations R1 R2 R2

2. ESD system, including quick disconnect facilities R1 R2 R2

3. Specifications and data sheets - R1 R1

Table C-12 Process system


Low Medium High

Materials

1. Systems description manual and material selection diagram I R1 R2

2.

Materials selection report,

Corrosion protection report

Coating and insulation specification (e.g. coating procedures)

R1 R2 R2

3.Internal corrosion assessment, calculation and assessment of corrosion ratewhere applicable (or spot check)

Corrosion monitoring systemR1 R2 R2

4.

Materials specification

welding specification

NDT-specification

for critical components

R1 R2 R2

Process equipment

5.

Design of all process equipment and facilities shall account for all identifiedoperating, testing, start-up and upset conditions (pressure, temperature,flow, composition, internal and external corrosion, erosion), throughout thelife of the field without loss of containment

R1 R2 R2

6.

Refinery process equipment and facilities shall be designed, fabricated andmaintained to account for all foreseeable internal and external corrosioneffects by way of material selection, external coating and corrosioninhibition

R1 R2 R2

7.Process equipment integrity is to be maintained in the event of fire bycombination of design layout, ESD, passive fire protection, pressure reliefvalves, blowdown and inherent strength

R1 R2 R2

8. Pumps handling main process hydrocarbon fluids shall be designed tominimise the risk of leakage, e.g. seal-less or dual seals - R1 R2


DNV GL AS


Low Medium High

9.

P&IDs and associated documentation to confirm:

Appropriate safety devices are specified according to codes and projectspecifications

Adequate margins between operating and design conditions

Trip settings are suitable for the intended level of protection

The status or position of valves does not impair system safety (lockedopen/closed; fail open/close/fixed; interlocking; etc.)

R1 R2 R2

10.P&IDs to confirm that shutdown valves are located such that systems canbe clearly segregated and give suitable segment boundaries and conformsto the assumptions and basis of the risk analysis.

R1 R2 R2

11. P&IDs showing block valves, isolating devices, etc. required formaintenance operations. - R1 R2

12. Specifications and data sheets for equipment such as pressure vessels,valves, heat exchangers, pumps, compressors and turbines - R1 R2

13.Manufacturers design documentation to verify that project specificationsand applicable standards are implemented correctly with respect toequipment integrity

- R1 R2

Electrical and instrumentation equipment

14. Instrument-based overpressure protection facilities shall meet therequirements specified e.g. SIL rating R1 R2 R2

15.

Design documents to confirm electrical equipment design in accordancewith applicable codes, standards and specifications, including arrangementdrawings showing location of:

— generators— transformers— main distribution and emergency switchboards— large motors— main and emergency cable runs— all electrical equipment in hazardous areas.

The separation between main and emergency power source and distributionshould be clearly shown

R1 R2 R2

16.Schedule of type of electrical equipment used in hazardous areas, havingregard to the particular area classification, i.e. cable type and make, typeand protection of all equipment

- R1 R2

17.One-line diagrams for the complete installation

Information concerning full load, cable type, cross-section and make, typeand rating of fuse and switchgear for all distribution circuits

- R1 R2

18.One-line diagrams for intrinsically safe circuits showing part in safe area,part in hazardous area, type of cable and make and type of intrinsicallysafe relays, barriers and apparatus

- R1 R2


DNV GL AS


Low Medium High

19.

Complete multi-wire diagrams, preferably as schematic diagrams forall control and instrumentation circuits of main switchboards, givinginformation on:

— cable types— cable and bus bar cross-sections and make— type and rating of all equipment.

- - R1

20.

Arrangement drawings showing:

— front of switchboard panels with equipment and sectional drawings anddetails of bus bar supports

— personnel protection for high voltage switchboards— battery rooms and their ventilation systems.

- - R1

21. Short circuit calculations showing rms and peak short circuit currents forevaluation of making and breaking capacity for all switchgear R1 R2 R2

22. Information concerning emergency power supply including connections tobasic board, chargers and all consumers R1 R2 R2

Table C-13 Relief valves and relief system


Low Medium High

1.Confirm that the relief philosophy and design for relief valves, systemsuch as flare and vents is in accordance with good industry practice andinternational standards

R1 R2 R2

2. At least one relief path shall be available to each hydrocarbon vessel at alltimes R1 R2 R2

3. Evaluation of possible cases of overpressure leading to determination ofworst case R1 R2 R2

4.Process design calculations for the relieving devices (relief valve, rupturedisc, etc.), to confirm the sizing case (full flow, gas blow by, fire, thermalrelief, etc.) is appropriate and the specified capacity adequate

- R1 R2

5.

Process design calculations focusing on:

— inlet conditions at design relief condition— specific heats— average molecular weight— pressure and temperature— required mass flow through valve— relieving device inlet line pressure drop— outlet line size and backpressure.

R1 R1 R2

6. Sizing calculations for every pressure safety valve and rupture disc - R1 R2

7. Data sheets to confirm sizing case, set pressure, backpressure and valvetype R1 R2 R2


DNV GL AS


Low Medium High

8. Confirm by review of P&IDs that isolation valves for relieving devices arelocked open for active devices and locked closed for stand-by devices R1 R2 R2

Table C-14 Structural integrity


Low Medium High

Equipment and pressure vessel supports and foundations

1.

Equipment support and foundation design has taken account of:

— geotechnical considerations— environmental loads, including the effects of dynamic loads, where

applicable— operational loads

R1 R2 R2

2. Corrosion assessment report and corrosion monitoring system R1 R2 R2

3. Structural design - R1 R2


Piping

5.Bases of design for piping and mechanical and specifications or data sheetsspecify the appropriate loadings for the design of piping supports and piperacks

R1 R2 R2

6. Where concrete pipe racks are being used, check design of concrete mixand reinforcement - R1 R2


Table C-15 Above ground storage tanks


Low Medium High

Foundations

1.

Tank foundation design has taken account of:

— geotechnical considerations, including any soil improvement— environmental loads— operational loads.

R1 R2 R2

2. Design of foundations R1 R2 R2

3. Construction and inspection procedures for foundations R1 R2 R2

Tanks

4. Tank pressure containment design R1 R2 R2


DNV GL AS


Low Medium High

5.

Materials selection report,

Corrosion protection report

Coating and insulation specification (e.g. coating procedures)

R1 R2 R2

6.Internal corrosion assessment, calculation and assessment of corrosion rate

Corrosion monitoring systemR1 R2 R2

7.

Materials specification

welding specification

NDT specification

R1 R2 R2

Table C-16 Control systems


Low Medium High

1. Control logic and philosophy is clearly stated and any relationship with theESD system is clearly defined R1 R2 R2

2.All major process hazards have been assessed and protective managedthrough the control system functionality as appropriate

Note: Where necessary, high integrity protective system may be provided.R1 R2 R2

3.

Design documents to confirm control system design in accordance withapplicable codes, standards and specifications, including:

— process flow diagram— process and instrumentation diagrams for the total hydrocarbon and

utility facilities— process shutdown logic and philosophy— list of set points of safety switches— failure modes of relevant components of system— statement of closing time of the total process shutdown system— statement of quickest pressure build up expected, assuming blockage in

the process or utilities systems— functional description of the facilities for testing the process shutdown

system.

R1 R2 R2

4. Pressurized equipment and associated pipework are fitted with protectivedevices R1 R2 R2

5.

Cause and effect diagrams, or similar, covering the following aspects:

— PSD; shutdown according to codes and project specifications— PSD; avoid unacceptable cascading effects— PSD; high level shutdown to include lower levels/individual shutdown

levels— FGS; initiation of relevant fire extinguishing systems, shutdown actions,

ignition prevention, alarm systems, blowdown (as applicable)— ESD; shutdown of production plants, ESDVs/SDVs as appropriate and

initiation of blowdown

R1 R2 R2


DNV GL AS

Table C-17 Control of ignition


Low Medium High

1. Confirm that the location of ignition sources meets API separationrequirements from process plant R1 R2 R2

2. Confirm that fired heaters and boilers have suitable purge facilities prior tostart-up to prevent internal explosions - R1 R2

3. Confirm that fired heaters and boilers have been designed in accordancewith the mechanical basis of design - R1 R2

4.

Hazardous area classification drawings and source of release schedule toverify the extent and type of zones, location of ventilation inlets/outlets,overpressure/air locks for local equipment rooms: cross check againstP&IDs to confirm classification of vents, segregation of drainage systemetc.

R1 R2 R2

5.

Ensure all vehicles comply with industry standards: where required,vehicles used for maintenance access or emergency access on the site shallconform to suitable industry standards for petrochemical plants: this shallinclude selection of engines with spark arrestors and emergency stops

- R1 R2

6. Verify that electrical equipment is suitable rated and certified for thehazardous area classification within which it is located R1 R2 R2

7. The refinery electrical equipment shall be in accordance with the basis ofdesign - R1 R2

8.Confirm that any external electrical equipment required to operate in amajor accident event shall be appropriately certified and meets codes andstandard

R1 R2 R2

9. Review hazardous area layout drawings and review specifications to ensurecompliance R1 R2 R2

10. Review basis of design for safety shutdown for suitability, and review causeand effect drawings R1 R2 R2

11. Review specifications for appropriate shutdown requirements. - R1 R2

12. Review specifications and confirm certification requirements. - R1 R2

13.

The refinery lightning protection, static protection and earthing on processand electrical equipment shall be in accordance with the basis of design:the site shall be provided with an adequate number of lightning rods toattract and deflect lightning in order to prevent ignition

R1 R2 R2

14. Confirm by review of calculations and studies that a suitable earthing gridis to be provided in accordance with the required standard - R1 R2

15.

A system of bonding and earthing is to be provided to maintain asufficiently low resistance between equipment enclosures, skids and earth.This system is to be designed in accordance with the basis of design forearthing, bonding and lightening protection

- R1 R2


DNV GL AS

Table C-18 Dropped object and impact protection


Low Medium High

1.Confirm that equipment along roads and in-unit access ways is protectedfrom vehicle impact through the use of curbing, barriers, or by virtue of itsdistance from the road

- R1 R2

2. Confirm that the design of the plant aims to minimise lifting operationsover operational vessels or piping - R1 R2

3.Confirm that adequate dropped object protection has been provided forequipment and piping in vulnerable areas (heat exchanger bundles, gasturbines, catalyst containers, jetties, etc.)

- R1 R2

Table C-19 Fire and gas detection


Low Medium High

General

1. Review layout and types of fire and gas detectors R1 R2 R2

2. Review connection between fire and gas detection panels and platformshutdown system R1 R2 R2


3.Confirm that adequate gas detection is provided on the HVAC inlets withsufficient detection time to ensure that functioning of the dampers willoccur before impairment of the protected space

R1 R2 R2

4. Confirm that response times are in accordance with the HVAC study formigration times and damper closure times - R1 R2

5. Confirm that detector types will provide the required detection times - R1 R2

6. Confirm by review of the design report that an adequate fire and gassystem is to be implemented R1 R2 R2

7. Confirm by review of the alarm and detection study that smoke and gasdetectors are suitably protected and can adequately detect the hazard R1 R2 R2


8. Confirm by design review that the fire and gas detector coverage is inaccordance with the fire area layouts and gas risk volume layouts R1 R2 R2

9. Confirm by review of the design report that an adequate fire and gasdetection system is to be implemented - R1 R2

10. Confirm the specification of cables meet required standards R1 R2 R2

11. Confirm from review of layouts and study that cable routing is appropriate - R1 R2

12.Type (suitability), number and location of detectors taking into accountvoting philosophy and alarm levels. Review location and number of manualfire alarm stations

R1 R2 R2


DNV GL AS


Low Medium High


13.

Confirm sufficient detection coverage is provided to detect releasesof flammable hydrocarbons, including oil mist/vapour, and excessivetemperature rise in machinery enclosures

R1 R2 R2

14.

Confirm sufficient detection coverage is provided to detect the presence ofgas:

— at the air inlet to continuously operated machinery enclosures, (maingas turbine enclosures)

— at the air exhaust to machinery enclosures containing a source of gas,(main gas turbines only)

— in the vicinity of not normally operated machinery within buildings orenclosures (emergency generators, fire pump enclosures, etc.).

R1 R2 R2


15.

Confirm that in the event of fire, smoke and/or gas detection, the fire andgas system initiates alarms and executive actions (i.e. Initiate ESD, plantaudible and visual alarms, and firewater pumps) appropriate to the incident

R1 R2 R2

16. Confirm that suitable audible and visual, local and central annunciation ofdetection occurs R1 R2 R2


17.

Confirm that personal toxic gas detectors are suitable to detect the rangeof toxic gases within the plant (typically H2S, SO2, CO and high/low O2levels)

- R1 R2

Table C-20 Emergency shutdown system


Low Medium High

1. Confirm by design review that the emergency shutdown logic andphilosophy is adequate R1 R2 R2

2.

General arrangement drawings showing location of:

— emergency shutdown valves— manual emergency shutdown stations and panels

- R1 R1

3. Detailed description of the facilities for testing the emergency shutdownsystem during normal operations - R1 R2

4.Confirm that in the event of an emergency situation, the emergencyshutdown system initiates alarms and executive actions appropriate to theincident

R1 R2 R2

5.

Confirm by design review that the ESD control system, is protected bylocation from all credible major accidental events, and from the effects ofall credible major accidental events for 30 minutes thereafter, by review ofdesign documentation

- R1 R2


DNV GL AS


Low Medium High

6. Confirm that maximum allowable valve closure times for ESD valves shallbe in accordance with the emergency response philosophy R1 R2 R2

7. Confirm by review of basis of design that explosion scenarios have beenconsidered during the design of ESD valves, actuators and supports - R1 R2

8. Confirm by review of specification that status of ESD is to be provided atoperator stations R1 R2 R2

9. Confirm by review of layouts that ESDVs are to be suitably protected frompotential vehicular impact - R1 R2

Table C-21 Blowdown header and flare system


Low Medium High

1. Review P&IDs showing pressure safety valves and rupture discs R1 R1 R1

2.P&IDs to confirm that isolatable sections are provided with remoteoperated blowdown possibilities as required by the flare and blowdownphilosophy

R1 R2 R2

3.Review pressure drop calculations based on an analysis of number ofsafety valves, rupture discs and depressurising valves likely to be operatingsimultaneously or within a short interval

- R1 R2

4. Review calculations showing capabilities of knock-out drum R1 R2 R2

5. Review back pressure calculations for headers and other piping - R1 R2

6. Review calculated gas outlet temperature for every relevant pressuresystem - R1 R2

7. Confirm that specifications require the appropriate maximum allowableopening time for the blowdown valves R1 R2 R2

8.

Flare and blowdown documentation to confirm that:

— time to depressurise is appropriate— calculated flow rates do not exceed the system capacity— calculated backpressures do not exceed the system limits— flare system is separated into appropriate systems (e.g. high and low

pressure, hot and cold, wet and dry flare systems)— minimum temperature and material choice is acceptable

R1 R2 R2

9.P&IDs to confirm that flare, relief and blowdown lines are self draining,and where low points are unavoidable these have an appropriate drainconnection with locked open isolation valve

R1 R2 R2

10. Flare knock-out drum sizing calculations and drawings to confirm that therewill be no liquid carry over to the flare tip R1 R2 R2

11.P&IDs to confirm a suitable purge gas system to prevent air ingress isspecified for the flare system (including alarms for low flow, back-upsystems, etc.)

R1 R1 R2


DNV GL AS


Low Medium High

12. Flare radiation calculations (for worst case flow and wind conditions) toconfirm these are acceptable - R1 R2

13. Flare noise calculations to confirm compliance with noise requirements ofthe verification basis (as applicable) - I R1

14. P&IDs to confirm ‘snuffing’ package is specified for cold vent tip whereappropriate R1 R2 R2

15. Flare ignition system to confirm that acceptable reliability of ignition will beachieved during all possible scenarios R1 R2 R2

16.

Reliability documentation to confirm that any overpressure protectionsystem is independent of other systems and have the same or better safetyreliability as a system using pressure relief devices: alternatively, confirmcompliance with IEC 61508 and that specified SIL level is achieved inaccordance with overpressure protection specification

R1 R1 R2

17. System documentation to confirm that requirements for online testing havebeen accounted for - R1 R2

18.Process design calculations to confirm that the specified response times ofprotective systems are sufficiently short to prevent unacceptable processconditions

R1 R2 R2

Table C-22 Control room


Low Medium High

1.Confirm that design features of the control room shall be available at alltimes including major accident events where the control functions will be ofsignificant benefit

- R1 R2

2. Confirm that the location and orientation of the control room is such that itis protected from credible worst case fire, blast and toxic events R1 R2 R2

3. Confirm that CCTV coverage is such that all necessary angles of the areasin questions can be viewed at a central protected location - R1 R2

Table C-23 Active fire fighting systems


Low Medium High

Fire water storage

1. Confirm by review of fire studies and design calculations that sufficient firewater storage is provided - R1 R2

Firewater pumps


DNV GL AS


Low Medium High

2.

Review arrangement of power supply to fire pumps including:

— type of supply— support system for driver— power transfer from driver to pump.

R1 R2 R2

3. Confirm that fire pump start requirements are in accordance withperformance standard R1 R2 R2


4.Confirm that the firewater distribution ring main is designed toaccommodate the maximum shut-in head of the fire pumps plus anyelevation allowance

R1 R2 R2

5. Confirm that isolating valves are provided adjacent to the ring main, onbranch lines feeding fire fighting equipment other than single fire hydrants R1 R2 R2


6.

Confirm that every area of the process system is covered by at least 2monitors and 2 hydrants in diverse locations and fed by separate sectionsof the ring main. Confirm that this equipment is accessible in credible firescenarios such that they can be operated in an emergency

R1 R1 R2

7. Confirm that foam injection points are accessible in credible fire scenariossuch that they can be operated in an emergency R1 R1 R2

8.Layout drawings to confirm adequacy of firewater main routing andadequate number and location of manual fire fighting equipment such asfire extinguishers, hydrants, hoses and monitors

R1 R1 R2

9. Adequacy of selected manual fire fighting equipment R1 R1 R2

10. Sizing basis for firewater demand to cover process areas R1 R1 R2

11. Firewater P&IDs to confirm requirements for supply to equipment andareas, separation of supplies, bypass and isolation possibilities R1 R1 R2

12. Firewater hydraulic calculations to confirm adequate capacity and pressureto all discharge points - R1 R2

13. Layout drawings to confirm adequate location of deluge valves, choice ofareas to be protected and identification of dedicated equipment protection. R1 R1 R2

14. Nozzle type and density in each area I R1 R1

15. Foam and other fire extinguishing systems with respect to application,type, concentration and capacity R1 R1 R2

Gaseous fire-fighting systems

16.

Confirm that gaseous fire-fighting systems are deployed on enclosedequipment which will be damaged beyond repair or will cause escalationif water is applied such as computer server rooms, gas turbine hoods andbattery rooms

- R1 R2


DNV GL AS


Low Medium High

17.Confirm that the extinguishing system is linked to an automatic earlydetection and initiation system which includes a visible and audible warningto personnel in the area before deployment

R1 R1 R2

Fire-fighting vehicles

18.

Confirm that sufficient fire-fighting vehicles are available to support allcredible fire scenarios onsite including the consideration of mutual aid andoutside agencies where applicable: down time for maintenance should alsobe considered

- R1 R2

Table C-24 Passive fire protection


Low Medium High

1. Confirm by review of passive fire protection (PFP) specification thatadequate PFP is to be provided of suitable rating R1 R1 R2

2.PFP on vessels, piping, supports and structure and withhold this withassumptions in risk analysis (if relevant), design accidental loads in eachspecific area, vessel integrity requirements, blowdown time etc.

R1 R1 R2

3.PFP drawings versus specified criteria for heat loads and exposure time,and withhold this against material approval certificates with respect tothickness and application requirements

- R1 R2

4.Separation by fire divisions of individual process areas for compliance withproject requirements and conforming to the assumptions in risk analysisand active fire fighting philosophy

R1 R1 R2

5. Requirements for passive fire protection resulting from the project specificdesign philosophy and risk analysis R1 R1 R2

Table C-25 Bunding and drainage


Low Medium High

1. Confirm by review of calculations that sufficient bunding is provided at allrelevant areas and sized for credible leaks. - R1 R2

2.Confirm by review of plans and layouts that the drainage valve shall remainaccessible in the event of a bund fire. Adequate separation shall allow forclosure after the liquid has been spilt and ignited

- R1 R2


DNV GL AS

Table C-26 Emergency power and uninterruptible power supply


Low Medium High

1.

Review information concerning emergency power supply including:

— connections to basic switchboard— chargers— all consumers.

R1 R1 R2

2.

Confirm that uninterruptible power is provided for all critical equipmentwith an emergency function which would otherwise cease to functionincluding:

— ESD systems— control systems— emergency lighting— emergency communication systems.

R1 R2 R2

3.

Confirm by review that the capacity shall be sufficient for the followingusers:

— integrated control system supply— emergency lighting including— emergency communication system— other systems required for emergency response.

R1 R2 R2

4. Confirm that emergency power is provided by diverse sources such asbattery systems, generators and redundant outside sources R1 R1 R2

Table C-27 Communications and alarms


Low Medium High


1. Confirm by review of specifications that an alarm system is to be providedthroughout the site R1 R1 R2

2. Confirm by review of specifications that appropriate equipment protectionis provided in the event of flammable gas ingress R1 R1 R2

Internal and external communications

3.

Confirm that adequate external and internal telephone and fax lines areavailable at all times during an emergency giving the emergency controlcentre the capability to handle two-way communications with all relevantparties

R1 R1 R2

4.Confirm that the routing of cabling and location of marshalling and powersupplies is such that the system is protected from credible fire, explosionand seismic and weather events

R1 R1 R2


DNV GL AS

Table C-28 HVAC


Low Medium High

1. Review flow diagrams showing supply and extract and showing separationbetween any hazardous and non-hazardous systems R1 R1 R2

2.

D&IDs showing location of:

— inlets and outlets— fire dampers— control dampers— air treatment units and fans.

R1 R1 R2

3.

D&IDs and associated documentation to confirm:

— system is designed according to codes and project specifications— adequate heat bridges exist where ducting penetrates fire boundaries.

- R1 R2

4. Particulars of capacity including air change rates - R1 R2

5. Confirm that HVAC systems physically isolate (dampers) the air supply onflammable or toxic gas, or smoke detection at the HVAC inlet R1 R2 R2

Table C-29 Egress and evacuation system


Low Medium High

Escape routes

1.Drawings showing layout of internal escape routes marked with direction ofescape; the drawings to include location of major equipment R1 R1 R2

2. Description of marking system - R1 R2

3. Confirm by document review that escape routes have a minimum heightand width - R1 R2

4. Confirm by document review that escape routes will allow easy transit ofstretcher teams - R1 R2

Muster area

5. Confirm by review of studies that sufficient mustering capacity is to beprovided - R1 R2

Emergency lighting

6. Confirm by review of emergency lighting drawings that lighting is to beprovided on all escape routes and at critical locations R1 R1 R2


DNV GL AS

Table C-30 Independent analyses/calculations


Low Medium High

Blow-down

i.Prepare a simplified model of the process plant in order to review criticalblow-down design features such as the flare headers, flare KO Drum andflare radiation

(x) x

Piping flexibility

ii. Prepare a model of critical lines to evaluate pipe stress and support layoutin accordance with ASME B31.3 Part 5 Flexibility and Support (x) x

Pressure vessels and storage tanks

iii.Prepare a structural model of important pressure vessels and storagetanks to evaluate the structural capacity of critical areas for normal and/oraccidental loads as found critical during the design of design review

(x) x

x = analysis/check shall be included in the scope of work

(x) = analysis/check shall be included in the scope of work if the issue is identified as critical or highlyutilised. Then final decision of inclusion in the scope of work will be a result of the document review ofsimple analysis.

C.5 Construction

C.5.1 General

C.5.1.1 Construction consists of a number of different site activities and their associated documentation.

C.5.1.2 Table E-1 gives summaries of the scope of work tables included in this section for variousconstruction activities.

C.5.2 Construction verification

C.5.2.1 For verification of hydrocarbon facilities, construction activities are considered as:

— initial activities,— inspection activities— final activities.

C.5.2.2 The initial activities include the review of procedures, attendance during qualification of proceduresand personnel and other start-up activities. The inspection activities are the site attendance and the finalactivities are the continuous review of production results and records and the completion of documentationand reports.

C.5.2.3 Sections [E.3], [E.4] and [E.5] following, describe the verification activities for each of the threeverification levels.


DNV GL AS

C.5.3 Low level construction verification

C.5.3.1 For low level verification, the procedure review consists of a review of the construction managementprocedures and confirmation that the most important aspects of the main specifications have been includedin the procedures. For the qualification of procedures and personnel, DNV GL will not attend the actualqualification, but will review the results.

C.5.3.2 During construction, DNV GL’s verification will be performed during site visits. The verification willfocus on the critical items and aspects identified in the detailed scope of work tables.

C.5.3.3 The subsequent verification of the final activities will be by spot-checks of the production recordsincluding non-conformance logs, mechanical completion reports and results from audits, both contractors’internal audits or audits performed by other parties.

C.5.3.4 Implementation of the transfer of design information from drawings and reports into fabrication orshop drawings is not included.

C.5.4 Medium level construction verification

C.5.4.1 For medium level verification, the procedure review consists of a detailed review of constructionmanagement procedures. Other important procedures will be spot checked to confirm that the mostimportant aspects of the specifications have been included.

C.5.4.2 For the qualification of procedures and personnel, DNV GL will visit the main qualifications andreview the results.

C.5.4.3 During construction, DNV GL’s verification will be performed by full time attendance at the main site.The verification will focus on the critical items and aspects as identified in the detailed scope of work tables.

C.5.4.4 Verification of the final activities will be by review of the production records including non-conformance logs, mechanical completion reports and results from audits, both contractors’ internal auditsor audits performed by other parties, from the main sites and spot checks of the same from other importantsites relevant to the main construction site.

C.5.4.5 Implementation of the transfer of design information from drawings and reports into fabrication orshop drawings is included on a spot check basis

C.5.5 High level construction verification

C.5.5.1 For high level verification, the procedure review consists of a detailed review of constructionmanagement procedures. Other procedures will be reviewed to confirm that important aspects of thespecifications have been included.

C.5.5.2 For qualification of procedures and personnel, DNV GL will attend the main qualifications, spot-checkother qualifications and review the results.

C.5.5.3 During construction, DNV GL’s verification will be performed by full time attendance at the main siteand by visits to the other important sites. Verification will focus on the critical items and aspects as identifiedin the detailed scope of work tables.

C.5.5.4 Verification of the final activities will be by detailed review of the production records including thenon-conformance log, mechanical completion reports and results from audits, both contractors’ internal


DNV GL AS

audits or audits performed by other parties, from the main sites and spot checks of the same from otherimportant sites relevant to the main construction site.

C.5.5.5 Implementation of the transfer of design information from drawings and reports into fabrication orshop drawings is included.

C.5.6 Verification of work in progress

C.5.6.1 The monitoring by the owner during construction relates to the activities of the contractor. Themonitoring of these activities by DNV GL relates not only to the contractors’ activities but also to themonitoring of these activities carried out by the owner.

C.5.6.2 The emphasis placed on the various activities in the verification plan varies depending on:

— any areas of concern revealed during design verification— any areas of concern revealed during the audit of the owner’s or contractor’s quality management systems— the progress of construction— the findings of the contractor surveillance personnel.

C.5.6.3 Many contractors have adequate quality control systems and quality control departments, withcompetent personnel to perform, for example, inspection at pressure vessel manufacturers.

C.5.6.4 In that case, not all certification work need be done by DNV GL personnel. Where applicable, thevarious inspections may be carried out by competent contractor personnel. In that situation, DNV GL’scertification activities may comprise:

— reviewing the competence of the contractor’s personnel— auditing their working methods and their performance of that work— reviewing the documents produced by them.

C.5.6.5 In addition, materials may be ordered with certificates of independent third-party verification(e.g. 3.2 according to EN 10204). This can this be integrated in the overall verification activities, so not toduplicate work.

C.5.6.6 Furthermore, credit may be given to components that are CE-marked, providing that the appropriateconformity assessment modules have been used, e.g. for equipment for which verification of design isrequired by the verification plan, module H is insufficient and Module H1 is required, irrespective of therequirement of the particular directive.

C.5.6.7 DNV GL personnel will spend more time in areas where problems have occurred, or are consideredlikely to occur. Conversely, less time is spent in areas where the likelihood of problems is considered lower.

C.5.7 DNV GL final report

C.5.7.1 All the scopes of work tables for construction activities end with a hold point entitled Issue of DNVGL report. This item is not related to the production process as a normal hold point would be, see [B.4].This item is intended as a reminder to the DNV GL (or other) inspection personnel that a final report of theirverification activities is required to finish the work.

C.5.7.2 This report may in the form of a visit report for an activity that is completed irregularly, such as avisit to a manufacturer’s works or a monthly report of site activities where DNV GL’s presence is continuous.


DNV GL AS

C.5.8 Scope of work for construction

C.5.8.1 Detailed scopes of work for the verification of construction are given in Table C-32 to Table C-55.

C.5.8.2 Initial and final activities that are common to all construction verification are shown in Table C-32and are not repeated in the tables for individual safety-critical elements.

Table C-31 Summary table - construction


C-4.2 Common construction activities

C-4.3 Layout

C-4.4 Hydrocarbon inventory and leak source minimisation


C-4.6 Jetties












C-4.18 Control room






C-4.24 HVAC

C-4.25 Egress and evacuation system


DNV GL AS

Table C-32 Common construction activities


Low Medium High

Initial activities

1. Review quality management system documents R1 R2 R2

2. Quality system audit at relevant manufacturers and sub-suppliers 1) - A A

3. Review of specifications and procedures R1 R2 R2

4. Technical meeting /kick-off meeting and review of construction ormanufacturing documents R1 R1 R2

5. Verify the performance and testing during the procedure and personnelqualification testing - S1 S3

Inspection activities

6. As detailed in Tables C-33 to Table C-53 - - -

Final activities

7. Review of manufacturing and testing records R1 R2 R2

8. Issue of DNV GL report H H H

1) May be omitted if requirements in [3.2.2.2] are complied with

Table C-33 Layout


Low Medium High

1.

Confirm that the facility layout conforms to the Plot Plans, especially:

— equipment spacing— location of control buildings— access/egress for emergency services— provision of secure site entrance points— access and laydown areas to enable safe construction, operation and

maintenance— adequate provision of escape and evacuation routes to safe muster

areas.

S1 S2 S3

Table C-34 Hydrocarbon inventory and leak source minimisation


Low Medium High

1.Confirm that all equipment, pipes and associated equipment which containhazardous materials are fabricated and installed in accordance with designdrawings

S1 S2 S3

2. Confirm the pipe supports are of the type and are in the locations shown onthe drawings shown in the pipe stress analysis S1 S2 S3


DNV GL AS


Low Medium High

3. Conform that pipework is constructed in accordance with the piping classes S1 S2 S3

4.

For pressure vessels, review:

— report of pressure testing— facsimile of completed vessel name plate— pressure vessel certificate as required by the specified design code.

R1 R1 R2

5.For piping systems, review:

— report of pressure testing.R1 R1 R2

6.

For pumps and compressors, review:

— records of pressure testing— records of performance testing.

R1 R1 R2

7.

For gas turbines and combustion engines, review:

— certification and testing reports of safety devices— records of performance testing.

- R1 R1



Low Medium High


1.

Confirm by document review that the SPM (or its equivalent) has beenconstructed and installed in accordance with DNVGL-OS-E403 Offshoreloading units or another code or standard giving an equivalent level ofsafety

R1 R1 R1

Flexible riser

2.Confirm by review of documents, such as independent design reviews andproduct certification, that the flexible riser (if fitted) has been constructedand installed in accordance with a suitable code or standard

R1 R1 R1


3. Confirm by document review that any pipelines have been constructed andinstalled in accordance with a suitable code or standard R1 R1 R1

Table C-36 Jetties


Low Medium High

1. Confirm by inspection that jetty construction has been carried out inaccordance with construction and inspection procedures S1 S2 S3

2. Confirm by witnessing tests that strength of designed concrete mix is beingachieved S1 S2 S3


DNV GL AS


Low Medium High

3. Review records of concrete construction, installation and inspection I R1 R2

Table C-37 Loading and unloading arms


Low Medium High

1.

Confirm by document review that all loading or unloading arms have beenconstructed and installed in accordance with DNVGL-ST-F101 Submarinepipeline systems or another code or standard giving an equivalent level ofsafety

R1 R2 R2



Low Medium High

1. Confirm that the process system has been constructed in accordance withthe P&IDs S1 S2 S3

2. Confirm that materials and fabrication are in accordance with the pipingand valve material specification, and vendor specifications S1 S2 S3

3.

Confirm for critical components that the followed documents, approvedduring design, have been complied with:

— materials specification— welding specification— NDT-specification.

S1 S2 S3

4. Confirm by review of equipment on site that equipment is supplied andinstalled in accordance with the design parameters S1 S2 S3

5.Confirm that the fabrication testing and commissioning of all tanks,pressure vessels and spheres are in accordance with the design drawingsand fabrication specification i.e. welding, NDT, dimensional control

S1 S2 S3

6.

Confirm by review of Vendor’s documentation that the procured equipmenthas been designed, fabricated and tested in accordance with the relevantdesign documents.Note: attention shall be paid to requirements of national authorities,where appropriate, for technical passports and permits for use or otherrequirement.

- R1 R2

7. Review vendor documentation to confirm that appropriately sealed pumps(seal-less or dual seal) as required are supplied - R1 R2

8. Confirm by review that relief valve certification is in order and that theappropriate relief valve have been fitted as per the P&IDs S1 S2 S3

9. P&IDs showing block valves, isolating devices, etc. required formaintenance operations


DNV GL AS


Low Medium High

10. Confirm from coating reports that the specified coating has been providedin accordance with the specification S1 S2 S3

11. Confirm by inspection that appropriate PFP is applied as required byanalysis S1 S2 S3

12.

Review for electrical equipment:

— certification for all explosion protected equipment— reports of function testing of alarms and disconnections in pressurised

equipment— reports of testing of protective devices in switchboards and generators— reports of testing of automatic start of emergency generator— reports of insulation resistance measurements.

R1 R2 R2



Low Medium High

1. Confirm that the relief system has been constructed in accordance with theP&IDs S1 S2 S3

2. Confirm that relief valves conform to the data sheets regarding setpressure, backpressure and valve type S1 S2 S3

3. Confirm that isolation valves for relieving devices are locked open for activedevices and locked closed for stand-by devices S1 S2 S3

4. Confirm by review of inspection and test records that relief valves aretested in accordance with API 520 and 521 R1 R2 R2



Low Medium High

Equipment and pressure vessel supports and foundations

1.Confirm by inspection that construction of equipment and pressurevessel supports and foundations has been carried out in accordance withconstruction and inspection procedures

S1 S2 S3

2. Confirm by witnessing tests that strength of designed concrete mix is beingachieved S1 S2 S3

3. Review records of concrete construction, installation and inspection - R1 R2

Piping

4.Confirm by inspection that construction of piping supports and pipe rackshas been carried out in accordance with construction and inspectionprocedures

S1 S2 S3


DNV GL AS


Low Medium High

5. Where concrete pipe racks are being constructed, confirm by witnessingtests that strength of designed concrete mix is being achieved S1 S2 S3

6. Review records of concrete construction, installation and inspection - R1 R2



Low Medium High

Tank foundations

1. Confirm by inspection that construction of tank foundations has beencarried out in accordance with construction and inspection procedures S1 S2 S3

2. Confirm by inspection that compacting of tank foundations is carried out inaccordance with design and construction documents S1 S2 S3

3. Review records of construction and inspection - R1 R2

Tanks

4. Confirm by inspection that fabrication and erection of tanks has beencarried out in accordance with construction and inspection procedures S1 S2 S3

5.

Confirm that the followed documents, approved during design, have beencomplied with:

— materials specification— welding specification— NDT-specification.

S1 S2 S3



Low Medium High

1. Confirm that control system has been constructed and installed inaccordance with design documents S1 S2 S3

2. Confirm by review that all protective devices are suitably calibrated fortheir intended pressure, temperature, etc R1 R1 R2

3. Confirm that control system software has been tested and thatdocumentation confirms that it conforms to design requirements R2 S1 S1

4.Confirm that integration testing of control system and at least one of eachinitiating device has been carried out and that documentation confirms thatthe system conforms to design requirements

R2 S1 S1

5. Confirm that control system (panels, displays, etc.) has been installed inaccordance with design documents and drawings S1 S2 S3

6. Confirm by inspection that the status of control systems has been providedat operator stations S1 S2 S3


DNV GL AS



Low Medium High

1. Confirm that fired heaters and boilers have been constructed in accordancewith the design documents S1 S2 S3

2. Confirm that fired heaters and boilers have suitable purge facilities prior tostart-up to prevent internal explosions S1 S2 S3

3. Confirm during installation that all fired heaters, combustion source aresuitably located and rated for their zone of operation S1 S2 S3

4.

Confirm that construction conforms to the equipment shown of the designhazardous area classification drawings and source of release scheduleregarding location of ventilation inlets/outlets, overpressure/air locks forlocal equipment rooms, location of vents and segregation of drainagesystem

S1 S2 S3

5. Confirm that all vehicles comply with the design documents regardingpotential for ignition, including spark arrestors and emergency stops, etc S1 S2 S3

6. Confirm that electrical equipment is installed in accordance with designdocuments and drawings S1 S2 S3

7. Ensure equipment is installed in accordance with the appropriatespecification. S1 S2 S3

8. Confirm that the lightning rods are installed as per the design documentsand drawings S1 S2 S3

9.Confirm by inspection and review of fabrication details that sufficientearthing and bonding arrangements are in place in accordance with thedesign documents and drawings

S1 S2 S3



Low Medium High

1.

Confirm that equipment along roads and in-unit access ways for protectedfrom vehicle impact through the use of curbing, barriers, or by virtue ofits distance from the road in are installed in accordance with the designdrawings

S1 S2 S3

2. Confirm by inspection that appropriate barriers are in place. S1 S2 S3

3.

Confirm that dropped object protection has been provided in accordancewith design documents and drawings for equipment and piping invulnerable areas (heat exchanger bundles, gas turbines, catalystcontainers, jetties, etc.)

S1 S2 S3


DNV GL AS



Low Medium High


1. Confirm by inspection of installation that the smoke and gas detection insite buildings is in accordance with the design S1 S2 S3

2. Confirm that detector types are installed as per the design documents anddrawings S1 S2 S3

3. Confirm during installation that the cables meet required specifications S1 S2 S3

4. Confirm by inspection that cable routing is in accordance with the designand is protected by location where possible. S1 S2 S3

5.Confirm that adequate gas detection is provided on the HVAC inlets withsufficient detection time to ensure that functioning of the dampers willoccur before impairment of the protected space

S1 S2 S3


6. Confirm by inspection of installation that the fire and gas system inexternal areas is in accordance with the design S1 S2 S3





10. Confirm by inspection of installation that the fire and gas system inmachinery enclosures is in accordance with the design S1 S2 S3





14. Confirm that fire and gas control system (panels, displays, etc.) has beeninstalled in accordance with design documents and drawings S1 S2 S3

15. Confirm by inspection that the status of fire and gas system has beenprovided at operator stations S1 S2 S3


DNV GL AS



Low Medium High

1. Confirm by inspection that the emergency shutdown system has beeninstalled in accordance with the design S1 S2 S3

2. Confirm by inspection that control system (panels, displays, etc.) has beeninstalled in accordance with design documents and drawings S1 S2 S3

3. Confirm by inspection that the status of ESD has been provided at operatorstations S1 S2 S3

4. Confirm by inspection and review of vendor data that adequate protectionof ESD valves is provided. S1 S2 S3

5. Confirm by inspection that ESDVs are suitably protected from potentialvehicular impact. S1 S2 S3

6.Confirm by review of certification that ESD valves, actuators and supportsare designed to withstand explosion overpressure drag loads as defined inthe project specification

- R1 R2



Low Medium High

1. Confirm by inspection that the blowdown header and flare system has beeninstalled in accordance with the design S1 S2 S3

2.Confirm by inspection that flare, relief and blowdown lines are self drainingand where low points are unavoidable these have an appropriate drainconnection with locked open isolation valves in accordance with the P&IDs

S1 S2 S3



Low Medium High

1. Confirm by inspection that the control room has been constructed inaccordance with the design drawings S1 S2 S3

2. Confirm by inspection that CCTV coverage is such that all necessary anglesof the areas in questions can be viewed at a central protected location S1 S2 S3



Low Medium High

Fire water storage

1. Confirm by inspection that fire water storage has been provided inaccordance to design documents and drawings S1 S2 S3


DNV GL AS


Low Medium High

Firewater pumps

2. Confirm by inspection that fire pumps have been installed in accordancewith design drawings S1 S2 S3

3. Confirm by review of manufacturer’s documentation the fire pump capacityand discharge rates are in accordance with design R1 R2 R2

4. Confirm by inspection that fire pump start requirements are in accordancewith design S1 S2 S3


5. Confirm by inspection that the firewater distribution ring main is fabricatedin accordance with the design drawings S1 S2 S3

6. Confirm that firewater distribution ring main isolation valves have beeninstalled in accordance with the P&IDs S1 S2 S3


7. Confirm by inspection that the firewater and foam supply systems havebeen installed in accordance with the design drawings S1 S2 S3

8. Confirm by inspection that the monitors and hydrants have been installedin accordance with the design documents and drawings S1 S2 S3


9. Confirm by inspection that the gaseous fire-fighting systems have beeninstalled in accordance with the design drawings S1 S2 S3

10. Confirm by inspection that status indicators are provided at all enclosuresentrances protected by gaseous fire-fighting systems S1 S2 S3

Fire-fighting vehicle

11. Confirm by review of manufacturing documentation that any fire-fightingvehicles conform to the requirements of the design documents R1 R2 R2



Low Medium High

1. Confirm by inspection that passive fire protection (PFP) has been providedin accordance with the design on vessels, piping, supports and structures S1 S2 S3

2.

Confirm by inspection that application of PFP has been carried out inaccordance with manufacturer’s instructions and guidance, including:

— maximum thickness per coat— inter-coat curing time— depth and type of reinforcement.

S1 S2 S3


DNV GL AS


Low Medium High

3.Confirm by witnessing of application and by review of application recordsthat PFP has been applied in accordance with manufacturer’s instructionsand guidance

R1 S1 S2

4. Confirm by inspection that penetrations in PFP have been installed inaccordance with manufacturer’s instructions S1 S2 S3

5.

Review certification of:

— fire rating of construction, including doors— penetration methods for ventilation ducting, piping or cable

penetrations.

R1 R2 R2



Low Medium High

1. Confirm by inspection that bunding and drainage has been installed isaccordance with the design drawings S1 S2 S3



Low Medium High

1.Confirm by inspection that emergency power and uninterruptible powersupply (UPS) has been installed in accordance with design documents anddrawings

S1 S2 S3

2. Confirm by review of records that the supplied UPS batteries are inaccordance with the design documents - R1 R2

3. Confirm by inspection that UPS battery load test demonstrate UPS capacityin accordance with the design S1 S2 S3

4. Confirm by inspection that automatic changeover of UPS battery banksoperates in accordance with the design S1 S2 S3



Low Medium High


1. Confirm by inspection that all communication and alarm systems have beeninstalled in accordance with design documents and drawings S1 S2 S3

2.

Confirm by inspection that the routing of cabling and location ofmarshalling and power supplies is such that the system is protected fromcredible fire, explosion and seismic and weather events as per the AFCdrawings.

S1 S2 S3


DNV GL AS


Low Medium High

3. Confirm by inspection that appropriate equipment protection is provided inthe event of flammable gas ingress S1 S2 S3


4.

Confirm by inspection that adequate external and internal telephoneand fax lines are available at all times during an emergency giving theemergency control centre the capability to handle two-way communicationswith all relevant parties

S1 S2 S3

5.Confirm that the routing of cabling and location of marshalling and powersupplies is such that the system is protected from credible fire, explosionand seismic and weather events

S1 S2 S3

Table C-54 HVAC


Low Medium High

1. Confirm by inspection that the HVAC system has been installed inaccordance with the D&IDs S1 S2 S3

2. Confirm by inspection that adequate heat bridges exist where ductingpenetrates fire boundaries S1 S2 S3

3. Confirm by review of certification that all HVAC dampers are fire ratedaccording to recognised industry practice and local regulations. S1 S2 S3

4. Confirm by review of vendor data and test results that damper closureoccurs within the required limits. - R1 R2



Low Medium High

Escape routes

1. Confirm by inspection that escape routes have been constructed inaccordance with the design documents and drawings S1 S2 S3

2. Confirm by inspection that escape routes have the minimum height andwidth specified in the design S1 S2 S3

3. Confirm by inspection that escape routes will allow easy transit of stretcherteams as specified in the design S1 S2 S3

4. Confirm by inspection that escape routes are marked in accordance withdesign S1 S2 S3

Muster area

5.Confirm by inspection that muster areas have been constructed inaccordance with the design documents and drawings S1 S2 S3


DNV GL AS


Low Medium High

6. Confirm by inspection that muster areas are marked in accordance withdesign S1 S2 S3

7. Confirm by inspection that muster areas have facilities to take muster andreport findings to emergency control centre S1 S2 S3

Emergency lighting

8.Confirm by inspection that escape routes and muster areas are adequatelyilluminated during periods of operation of emergency lighting to thespecified minimum level

S1 S2 S3

C.6 Commissioning

C.6.1 General

C.6.1.1 Commissioning consists of a number of different site activities and their associated documentation.

C.6.1.2 Table F-1 gives summaries of the scope of work tables included in this section for variouscommissioning activities.

C.6.2 Commissioning verification

C.6.2.1 For verification of hydrocarbon facilities, commissioning activities are considered as:

— initial activities— inspection activities— final activities.

C.6.2.2 The initial activities include the review of procedures, attendance during qualification of proceduresand personnel and other start-up activities. The inspection activities are the site attendance and the finalactivities are the continuous review of production results and records and the completion of documentationand reports.

C.6.2.3 Sections [F.3], [F.4] and [F.5] following, describe the verification activities for each of the threeverification levels.

C.6.3 Low level commissioning verification

C.6.3.1 For low level verification, the procedure review consists of a review of the commissioningmanagement procedures and confirmation that the most important aspects of the main specifications havebeen included in the procedures. For the qualification of procedures and personnel DNV GL will not attend theactual qualification, but will review the results.

C.6.3.2 During the commissioning, DNV GL’s verification will be performed during site visits. The verificationwill focus on the critical items and aspects identified in the detailed scope of work tables.


DNV GL AS

C.6.3.3 The subsequent verification of the final activities will be by spot-checks of the production recordsincluding non-conformance logs, commissioning completion reports and results from audits, both contractorsinternal audits or audits performed by other parties.

C.6.4 Medium level commissioning verification

C.6.4.1 For medium level verification, the procedure review consists of a detailed review of commissioningmanagement procedures. Other important procedures will be spot checked to confirm that the mostimportant aspects of the specifications have been included.

C.6.4.2 For the qualification of procedures and personnel DNV GL will visit the main qualifications and reviewthe results.

C.6.4.3 During commissioning, DNV GL’s verification will be performed by full time attendance at the site.The verification will focus on the critical items and aspects as identified in the detailed scope of work tables.

C.6.4.4 Verification of the final activities will be by review of the production records including non-conformance logs, commissioning completion reports and results from audits, both contractor’s internalaudits or audits performed by other parties.

C.6.5 High level commissioning verification

C.6.5.1 For high level verification, the procedure review consists of a detailed review of commissioningmanagement procedures. Other procedures will be reviewed to confirm that important aspects of thespecifications have been included.

C.6.5.2 For qualification of procedures and personnel DNV GL will attend the main qualifications, spot-checkother qualifications and review the results.

C.6.5.3 During commissioning, DNV GL’s verification will be performed by full time attendance at the site.Verification will focus on the critical items/aspects as identified in the detailed scope of work tables.

C.6.5.4 Verification of the final activities will be by detailed review of the production records including thenon-conformance log, commissioning completion reports and results from audits, both contractors internalaudits or audits performed by other parties

C.6.6 Verification of work in progress

C.6.6.1 The monitoring by the owner during commissioning relates to the activities of the contractors.The monitoring of these activities by DNV GL relates not only to the contractor’s activities but also to themonitoring of these activities carried out by the owner.

C.6.6.2 The emphasis placed on the various activities in the verification plan varies depending on:

— any areas of concern revealed during design and construction verification— any areas of concern revealed during the audit of the owner’s or contractor’s quality management systems— the progress of commissioning— the findings of the contractor surveillance personnel.

C.6.6.3 DNV GL personnel will spend more time in areas where problems have occurred, or are consideredlikely to occur. Conversely, less time is spent in areas where the likelihood of problems is considered lower.


DNV GL AS


C.6.7.1 All the scopes of work tables for commissioning end with a hold point entitled Issue of Visit Report.This item is not related to the production process as a normal hold point would be, see [B.4]. This item isintended as a reminder to the DNV GL inspection personnel that a final report of their verification activities isrequired to finish the work.

C.6.7.2 This report may in the form of a visit report for an activity that is completed irregularly, such as avisit to a manufacturer’s works or a monthly report of site activities where DNV GL’s presence is continuous.

C.6.8 Scope of work for commissioning verification

C.6.8.1 Detailed scopes of work for the verification of commissioning are given in Table C-57 to Table C-70.

C.6.8.2 Initial and final activities that are common to all commissioning verification are shown in Table C-57and are not repeated in the tables for individual safety-critical elements.

Table C-56 Summary table - commissioning


C-5.2 Common commissioning activities









C-5.11 Control room



C-5.14 Communications

C-5.15 HVAC

Table C-57 Common commissioning activities


Low Medium High

Initial activities



DNV GL AS


Low Medium High

2. Quality system audit at relevant contractors and sub-contractor 1) - A A

3. Review of specifications and procedures R1 R2 R2

4. Technical meeting/kick-off meeting and review of commissioningdocuments R1 R1 R2

5. Confirm by review that there are no outstanding safety critical issues fromthe mechanical completion punch lists R1 R2 R2


6. As detailed in Table C-58 to Table C-69 - - -

Final activities

7. Review of commissioning records R1 R2 R2

8. Confirm by review that there are no outstanding safety critical issues fromthe commissioning completion punch lists R1 R2 R2


1) May be omitted if requirements in [3.2.2.2] are complied with



Low Medium High

Single point mooring

1.Confirm by document review that the SPM (or its equivalent) has beencommissioned in accordance with DNVGL-OS-E403 Offshore loading unitsor another code or standard giving an equivalent level of safety

R1 R1 R1

Flexible riser

2.Confirm by review of documents, such as independent design reviews andproduct certification, that the flexible riser (if fitted) has been has beencommissioned in accordance with a suitable code or standard

R1 R1 R1


3.Confirm by document review that any pipelines have been has beencommissioned in accordance with DNVGL-ST-F101 Submarine pipelinesystems or another code or standard giving an equivalent level of safety

R1 R1 R1



Low Medium High

1.Confirm by inspection during commissioning that the loading and unloadingarms ESD system, including quick disconnect facilities, is commissioned inaccordance with the commissioning procedures

R1 S1 S2


DNV GL AS



Low Medium High

1. Confirm during commissioning that the equipment is commissioned inaccordance with the commissioning procedures S1 S2 S3

2.Confirm by inspection and function test that each field device is integratedwith the control system based on commissioning acceptance testprocedures.

S1 S2 S3

3.

Confirm by review of vendor’s documentation and relevant punch liststhat requirements of national authorities, where appropriate, for technicalpassports and permits for Use or other requirements have been compliedwith

I R1 R2



Low Medium High

1. Confirm by inspection during commissioning that the control system iscommissioned in accordance with the commissioning procedures S1 S2 S3

2. Confirm by witnessing of a selection of tests that the control systemfunctions in accordance with design S1 S2 S3

3. Confirm by inspection that the status of control systems has been providedat operator stations S1 S2 S3



Low Medium High

1.Confirm by witnessing a selection of tests that non-certified equipment isisolated in the event of a local loss of containment as per the Cause andEffects matrix

S1 S2 S3

2. Confirm by witness and review of test results that shutdowns occur inaccordance with the design requirements. S1 S2 S3

3. Confirm by review of records that the commissioning of the lightning rodshas been carried out as per the project specifications - R1 R2

4. Confirm by review of records that the commissioning of the earthing gridhas been carried out as per the project specifications - R1 R2

5. Confirm by review of records that the commissioning of the bonding andearthing has been carried out as per the project specifications - R1 R2


DNV GL AS



Low Medium High


1.Confirm by inspection during commissioning that the smoke and gasdetection in site buildings is commissioned in accordance with thecommissioning procedures

S1 S2 S3

2. Confirm by witnessing of a selection of tests that the smoke and gasdetection in site buildings functions in accordance with design S1 S2 S3


3.Confirm by inspection during commissioning that the fire and gas systemin external areas is commissioned in accordance with the commissioningprocedures

S1 S2 S3

4. Confirm by witnessing of a selection of tests that the fire and gas system inexternal areas functions in accordance with design S1 S2 S3

5. Confirm by witnessing tests and a review of test reports that loss of cableintegrity provides alarm condition in the control room. - S1 S2


6.Confirm by inspection during commissioning that fire and gas systemin machinery enclosures is commissioned in accordance with thecommissioning procedures

S1 S2 S3

7. Confirm by witnessing of a selection of tests that the fire and gas system inmachinery enclosures functions in accordance with design S1 S2 S3


8. Confirm by inspection during commissioning that the fire and gas controlsystem is commissioned in accordance with the commissioning procedures S1 S2 S3

9. Confirm by witnessing of a selection of tests that the fire and gas controlsystem functions in accordance with design S1 S2 S3

10. Confirm by inspection that the status of fire and gas system has beenprovided by panels, displays or other means at operator stations S1 S2 S3


11.Confirm by inspection that personal toxic gas detectors are suitable todetect the range of toxic gases within the plant (typically H2S, SO2, CO andhigh/low O2 levels)

S1 S2 S3

12.Confirm by witnessing tests that installed respiratory protective equipmentprovides protection for the time it takes to don and proceed the maximumpotential distance to a safe up-wind area.

S1 S2 S3


DNV GL AS



Low Medium High

1. Confirm by inspection during commissioning that the emergency shutdownsystem is commissioned in accordance with the commissioning procedures S1 S2 S3

2. Confirm by witnessing of a selection of tests that the emergency shutdownsystem functions in accordance with design S1 S2 S3

3. Confirm by witnessing tests that ESDVs maximum closure times are inaccordance with the design requirements S1 S2 S3

4. Confirm by inspection that the status of emergency shutdown system hasbeen provided by panels, displays or other means at operator stations S1 S2 S3

5. Confirm by review of test results that interference does not occur betweenthe various systems. - R1 R2



Low Medium High

1.Confirm by inspection during commissioning that the blowdown headerand flare system is commissioned in accordance with the commissioningprocedures

S1 S2 S3

2. Confirm by witnessing of a selection of tests that the blowdown header andflare system functions in accordance with design S1 S2 S3

3.Confirm by witnessing tests and a review of records that the blowdownsystem is capable of reducing pressure to the required amount in therequired time as specified in the design documents

S1 S2 S3

4. Confirm by review of test results that flare noise and radiation are withinthe limits specified in the design documents R1 R2 R2



Low Medium High

1. Confirm by inspection that the control room has been commissioned inaccordance with the commissioning procedures S1 S2 S3

2.Confirm that safety functions associated with the control room arecommissioned in accordance with the commissioning procedures (i.e. airlocks if fitted)

S1 S2 S3



DNV GL AS



Low Medium High

Firewater pumps

1. Confirm by inspection that the fire pumps have been commissioned inaccordance with the commissioning procedures S1 S2 S3

2. Confirm by witnessing tests that the fire pumps capacity and dischargerates are in accordance with design. S1 S2 S3

3. Confirm by witnessing tests that fire pump start arrangements are inaccordance with design S1 S2 S3

4.

Review:

— certification and commissioning reports of pump driver— certification and commissioning reports of safety devices— records of performance testing.

R1 R2 R2


5. Confirm by witnessing tests that flow rates in the firewater distribution ringmain are in accordance with the firewater hydraulic analysis S1 S2 S3

6. Confirm by inspection that the firewater distribution ring main isolationvalves operate as designed S1 S2 S3


7. Confirm by inspection that the firewater and foam supply systems havebeen commissioned in accordance with the commissioning procedures S1 S2 S3

8.

Confirm by witnessing tests that the firewater and foam supply systemsare capable of delivering sufficient extinguishing to all necessary locationsto deal with credible worst case fire scenario as required by the designdocuments

S1 S2 S3

9. Confirm by review of records that foam is supplied with appropriatecertification R1 R2 R2


10. Confirm by inspection that the gaseous fire-fighting systems have beencommissioned in accordance with the commissioning procedures S1 S2 S3

11.Confirm by witnessing tests that the firewater and foam supply systems arecapable of delivering sufficient extinguishing gas to all necessary locationsas required by the design documents

S1 S2 S3

12.Confirm by witnessing of tests that status indicators provided at allenclosures entrances protected by gaseous fire-fighting systems function asintended to give personnel sufficient warning to evacuate the enclosure

S1 S2 S3


13.Confirm by witnessing tests that the fire-fighting vehicle is capable ofdelivering sufficient extinguishing to all necessary locations as required bythe design documents

S1 S2 S3


DNV GL AS

Table C-68 Emergency power and wninterruptible power supply


Low Medium High

1. Confirm by inspection that the emergency power and UPS systems havebeen commissioned in accordance with the commissioning procedures S1 S2 S3

2.

Confirm during testing that the emergency power supply capacity issufficient for the following users:

— integrated control system supply— communication systems— emergency communication system— any other systems required for emergency response.

S1 S2 S3



Low Medium High


1. Confirm by inspection that the emergency communications and Alarmshave been commissioned in accordance with the commissioning procedures S1 S2 S3

2. Confirm by witnessing tests that emergency communications and Alarmsare audible over the whole facility. S1 S2 S3

3. Confirm by witnessing tests that in noisy areas personnel are alerted toEmergency Alarms by flashing beacons or other suitable means S1 S2 S3


1. Confirm by inspection that the internal and external communications havebeen commissioned in accordance with the commissioning procedures S1 S2 S3

2.

Confirm by inspection that adequate external and internal telephoneand fax lines are available at all times during an emergency giving theemergency control centre the capability to handle two-way communicationswith all relevant parties

S1 S2 S3

Table C-70 HVAC


Low Medium High

1. Confirm by inspection that the HVAC system has been commissioned inaccordance with the commissioning procedures S1 S2 S3

2.Confirm by witnessing tests that HVAC systems physically isolate bydampers the air supply on flammable or toxic gas, or smoke detection atthe HVAC inlet

S1 S2 S3

3. Confirm by witnessing tests that the control room HVAC is shutdown anddampers are closed on confirmed gas at the HVAC inlet. S1 S2 S3


DNV GL AS


Low Medium High

4. Confirm by witnessing tests that commissioning reports that damperclosure occurs within the required limits upon gas detection. S1 S2 S3

5.

Review measurements of:

— capacity— pressure differential.

- R1 R2

C.7 Operations

C.7.1 General

C.7.1.1 Operations consists of operating the hydrocarbon facility for the purpose for which it was designedand includes the ancillary activities of maintenance and inspection.

C.7.1.2 Table C-71 gives summaries of the scope of work tables included in this section for variousoperations activities.

C.7.2 Operations verification

C.7.2.1 For verification of hydrocarbon facilities, operations activities are considered as:

— initial activities— inspection activities— final activities.

C.7.2.2 The initial activities include the review of strategies and procedures. The inspection activities are thesite attendance and the final activities are the review of operations, maintenance and inspection records andthe completion of documentation and reports.

C.7.2.3 Sections [G.3], [G.4] and [G.5] following, describe the verification activities for each of the threeverification levels.

C.7.3 Low level operations verification

C.7.3.1 For low level verification, the procedure review consists of a review of the integrity managementstrategies and confirmation that the most important aspects of these strategies have been included in theprocedures.

C.7.3.2 During operations, DNV GL’s verification will be performed during site visits. The verification willfocus on the critical items and aspects identified in the detailed scope of work tables.

C.7.3.3 The subsequent verification of the final activities will be by spot-checks of the operations,maintenance and inspection records including non-conformance logs, operations reports and results fromaudits, both internal audits and audits performed by other parties.


DNV GL AS

C.7.4 Medium level operations verification

C.7.4.1 For medium level verification, the procedure review consists of a detailed review of integritymanagement strategies. Other important operations, maintenance and inspection procedures will be spotchecked to confirm that the most important aspects of the strategies have been included.

C.7.4.2 During operations, DNV GL’s verification will be performed during site visits. The verification willfocus on the critical items and aspects identified in the detailed scope of work tables.

C.7.4.3 Verification of the final activities will be by a review of the operations, maintenance and inspectionrecords including non-conformance logs, operations reports and results from audits, both internal audits andaudits performed by other parties.

C.7.5 High level operations verification

C.7.5.1 For high level verification, the procedure review consists of a detailed review of integritymanagement strategies and operations, maintenance and inspection procedures.

C.7.5.2 During operations, DNV GL’s verification will be performed by performed during site visits and by fulltime attendance at the site during facility shutdowns or turn-arounds. Verification will focus on the criticalitems/aspects as identified in the detailed scope of work tables.

C.7.5.3 Verification of the final activities will be by a detailed review of the operations, maintenance andinspection records including non-conformance logs, operations reports and results from audits, both internalaudits and audits performed by other parties


C.7.6.1 All the scopes of work tables for commissioning end with a hold point entitled Issue of DNV GLReport. This item is not related to the production process as a normal hold point would be, see [B.4]. Thisitem is intended as a reminder to the DNV GL inspection personnel that a final report of their verificationactivities is required to finish the work.

C.7.7 Scope of work for operations verification

C.7.7.1 Detailed scopes of work for the verification of commissioning are given in Table C-72 to Table C-94.

C.7.7.2 Initial and final activities that are common to all operations verification are shown in Table C-72 andare not repeated in the tables for individual safety-critical elements.

Table C-71 Summary table - operations


C-6.2 Common operations activities

C-6.3 Layout


C-6.5 Jetties



DNV GL AS












C-6.17 Control room






C-6.23 HVAC

C-6.24 Egress and evacuation systems

Table C-72 Common operations activities


Low Medium High

Initial activities


2. Quality system audit at relevant contractors 1) - A A

3. Review of integrity management strategies R1 R2 R2

4. Review of procedures for operations 2), maintenance and inspection R1 R2 R2

5. Review of preventative maintenance routines - R1 R2

6. Technical meeting/kick-off meeting - S1 S2

7. Confirm by review that there are no outstanding safety critical issues fromthe mechanical and commissioning completion punch lists R1 R2 R2


8. As detailed in Table C-73 to Table C-94 - - -

Final activities


DNV GL AS


Low Medium High

9. Review of operations, maintenance and inspection records R1 R2 R2


1) May be omitted if requirements in [3.2.2.2] are complied with2) Only those operations procedures wholly or partly related to integrity management or personnel safety will be

reviewed

Table C-73 Layout


Low Medium High

1. Confirm by inspection that the facility layout continues to conform to theplot plans S1 S2 S3



Low Medium High

Single point mooring

1. Confirm by inspection that the SPM (or its equivalent) remains in goodcondition with no leaks or mechanical damage observed S1 S2 S3

2. Confirm by document review that communication systems between theSPM and the refinery control room operate as designed R1 R1 R1

3. Confirm by document review of maintenance and inspection records thatSPM remains in good condition R1 R2 R2

Flexible riser

4. Confirm by review of documents that the flexible riser (if fitted) remains ingood condition with no leaks or mechanical damage observed R1 R1 R1


5. Confirm by inspection of the above-ground portions that any pipelinesremain in good condition with no leaks or mechanical damage observed S1 S2 S3

6.Confirm by document review of maintenance and inspection records thatany pipelines remain in good condition with no leaks or mechanical damageobserved

R1 R1 R1

7. Confirm by document review of potential readings that the pipelinescathodic protection systems are effective R1 R1 R1


DNV GL AS

Table C-75 Jetties


Low Medium High

1. Confirm by inspection that jetties remains in good condition with nomechanical damage observed S1 S2 S3

2. Confirm by document review of maintenance and inspection records thatjetties remain in good condition and continue to operate as designed S1 S2 S3



Low Medium High

1. Confirm by inspection that all loading or unloading arms remain in goodcondition with no leaks or mechanical damage observed S1 S2 S3

2.Confirm by review of maintenance and inspection records that loading andunloading arms ESD system, including quick disconnect facilities continueto operate as designed

R1 R2 R2



Low Medium High

1. Confirm by inspection that the process system remains constructed inaccordance with the P&IDs S1 S2 S3

Piping systems

2.

Inspect for general condition and mechanical damage:

— check for obvious damage— check for incorrectly position, damaged or disturbed supports— check for bending and shearing of support foundation bolts, cracking of

welded foundations or displacement of supports— check saddle, sliding or roller bearing supports.

S1 S2 S3

3. Inspect surface coating or insulation to confirm that it is sealed atdiscontinuities S1 S2 S3

4. Inspect for signs of water ingress, where equipment potentially is liable tocorrosion under insulation S1 S2 S3

5. Inspect small bore connections to confirm that they are adequatelysupported and not vibrating S1 S2 S3

6. Inspect the electrical insulation of non-ferrous pipework for deterioration S1 S2 S3

7. Inspect insulating gaskets between dissimilar metals for deterioration S1 S2 S3

8.Confirm by document review of maintenance and inspection records thatpiping systems remain in good condition with adequate wall thickness forthe pressures contained within them

R1 R2 R2


DNV GL AS


Low Medium High

Pressure vessels

9.


— check for damage to shell, especially at attachments— check for damage to supports, especially at welds between supports

and vessel and between supports and main beams.

S1 S2 S3



12. Inspect fitting and support of instruments to the vessel to confirm they areadequately supported and not vibrating S1 S2 S3

13. Inspect that the locking open or closed of isolation valves in relief and drainsystems is in accordance with the process and instrumentation diagrams S1 S2 S3

14.Confirm by document review of maintenance and inspection records thatpressure vessels remain in good condition with adequate wall thickness forthe pressures contained within them

R1 R2 R2

Mechanical equipment

15.

Inspect general condition and mechanical damage:

— check for obvious damage— check for damaged or disturbed supports— check for bending and shearing of base plate and anchor bolts, cover

plate bolts, cracking of welded foundations or displacement of supports— check condition of associated pipework and valves— check condition of accessories.

S1 S2 S3

16.

Confirm by document review of maintenance and inspection records thatmechanical equipment set up remains satisfactory:

— check measurements of clearances, alignment and bolt torques— check results of measurements of vibration.

R1 R2 R2

17. Confirm by document review of the results of tests of governing, alarm andsafety systems that mechanical equipment protection remains satisfactory R1 R2 R2

18. Confirm by document review of maintenance and inspection records thatmechanical equipment remains in good condition R1 R2 R2



Low Medium High

1. Confirm by inspection that the relief system remains constructed inaccordance with the P&IDs


DNV GL AS


Low Medium High

2. Confirm by inspection that isolation valves for relieving devices are lockedopen for active devices and locked closed for stand-by devices S1 S2 S3

3. Confirm by review of documents that relief valves are tested in accordancewith the requirements R1 R2 R2



Low Medium High

1.

Inspect for general condition and mechanical damage of steel structures:

— check straightness and buckling of panels and columns— check for cracking in welds and parent metal— check main connections of cantilevered sections— check cut outs or penetrations— check attachments (potential crack initiators)— check bolted connections (loose or missing bolts, corrosion, deformation

to protective cover or surrounding structure)— check interface between steel and concrete structural parts— check coating damage (including passive fire and cryogenic protection).

S1 S2 S3

2.

Inspect for general condition and mechanical damage of concretestructures:

— check straightness and buckling of columns and beams— check for rust marks and signs of reinforcement corrosion— check for spalling of concrete.

S1 S2 S3

3. Confirm by document review of maintenance and inspection records thatsteel and concrete structures remain in good condition R1 R2 R2



Low Medium High

Tank foundations

1. Inspect for general condition and mechanical damage of tank foundations S1 S2 S3

2. Inspect for signs of tank movement that may indicate unstable foundationsor soil conditions S1 S2 S3

3. Confirm by document review of maintenance and inspection records thattank foundations remain in good condition R1 R2 R2

Tanks


DNV GL AS


Low Medium High

4.


— check for damage to shell, especially at attachments— check for damage to supports, especially at welds between supports

and tank and between supports and main beams.

S1 S2 S3



7. Inspect fitting and support of instruments to the tank to confirm they areadequate supported and not vibrating S1 S2 S3

8. Inspect that the locking open or closed of isolation valves in relief and drainsystems is in accordance with the process and instrumentation diagrams S1 S2 S3

9. Confirm by document review of maintenance and inspection records thattanks remain in good condition with adequate wall thickness R1 R2 R2



Low Medium High

1. Confirm by inspection that the control system remains constructed inaccordance with the P&IDs S1 S2 S3

2. Confirm by document review of records that all protective devices aresuitably calibrated for their intended pressure, temperature, etc. R1 R1 R2

3. Confirm by witnessing of a selection of tests that the control systemfunctions in accordance with design S1 S2 S3

4.Confirm by document review of maintenance records of control systemtesting that the control system continues to function in accordance withdesign

R1 R1 R2

5. Confirm by inspection that the status of control systems continues to beprovided at operator stations S1 S2 S3



Low Medium High

1. Confirm by inspection that fired heaters and boilers remain constructed inaccordance with the design documents S1 S2 S3

2.Confirm by document review of maintenance records that start-uppurge facilities have been tested and remain suitable to prevent internalexplosions

R1 R1 R2


DNV GL AS


Low Medium High

3. Confirm by inspection that all fired heaters, combustion source are suitablylocated and rated for their zone of operation S1 S2 S3

4.Confirm by inspection and review of hazardous area classification drawingsand source of release schedule that equipment remains suitably protectedfor its location

S1 S2 S3

5.Confirm by inspection that all vehicles comply with the design documentsregarding potential for ignition, including spark arrestors and emergencystops, etc

S1 S2 S3

6. Confirm by inspection that the lightning rods remain installed as per thedesign documents and drawings S1 S2 S3

7. Confirm by inspection that sufficient earthing and bonding arrangementsremain in place in accordance with the design documents and drawings S1 S2 S3

8.Confirm by witnessing a selection of tests that non-certified equipment isisolated in the event of a local loss of containment as per the cause andeffects matrix

S1 S2 S3

9. Confirm by witness and review of test results that shutdowns occur inaccordance with the design requirements. S1 S2 S3

Electrical equipment

10. Confirm by inspection that all electrical equipment remain in good conditionwith no mechanical or other damage observed S1 S2 S3

11. Confirm by document review of the results of function test alarms anddisconnections that pressurised equipment (Ex p) remains satisfactory R1 R2 R2

12.

Inspect condition of flameproof equipment (Ex d):

— check mechanical strength, corrosion of joint flanges and bolts, missingbolts, general corrosion, cracks, etc.

— dimensions of joint gaps (flame path); if surface of flame path affectedby corrosion then equipment to be scrapped

— check that flame path surfaces are covered with a thin layer of non-hardening grease

— check that no external obstructions exist for flame paths.

S1 S2 S3

13.

Inspect condition of increased safety equipment (Ex e) and Ex nEquipment:

— check internally and check entry for cleanliness, corrosion, signs ofdamage, etc.

— check function of flameproof switch— check setting of protective relays for Ex e motors.

S1 S2 S3

14.

Inspect condition of Intrinsically Safe Equipment (Ex i):

— check connections to earth bars— check separation between intrinsically safe and non-intrinsically safe

circuits— inspect barriers and relays for cleanliness and signs of damage.

S1 S2 S3


DNV GL AS


Low Medium High

15. Confirm by document review of the results of function test alarms anddisconnections that pressurised rooms remain satisfactory R1 R2 R2



Low Medium High

1. Confirm by inspection that appropriate barriers remain in place for impactprotection from vehicles. S1 S2 S3

2. Confirm by inspection that dropped object protection remains in place forequipment and piping in vulnerable areas S1 S2 S3



Low Medium High


1. Confirm by inspection that the smoke and gas detection in site buildingsremains in accordance with the design S1 S2 S3

2. Confirm by witnessing of a selection of tests that the smoke and gasdetection in site buildings functions in accordance with design - S1 S2

3. Confirm by document review of maintenance records that smoke and gasdetection in site buildings continues to function in accordance with design R1 R1 R2


4. Confirm by inspection that the fire and gas system in external areasremains in accordance with the design S1 S2 S3

5. Confirm by witnessing of a selection of tests that the fire and gas detection- external areas functions in accordance with design S1 S2 S3

6. Confirm by document review of maintenance records that fire and gasdetection - external areas continues to function in accordance with design R1 R1 R2

7. Confirm by document review of maintenance records that loss of cableintegrity provides alarm condition in the control room. R1 R1 R2


8. Confirm by inspection that the fire and gas system in machinery enclosuresremains in accordance with the design S1 S2 S3

9. Confirm by witnessing of a selection of tests that the fire and gas system inmachinery enclosures functions in accordance with design - S1 S2

10.Confirm by document review of maintenance records that fire and gassystem in machinery enclosures continues to function in accordance withdesign

R1 R1 R2


DNV GL AS


Low Medium High


11. Confirm by inspection that fire and gas control system (panels, displays,etc.) remains installed in accordance with design documents and drawings S1 S2 S3

12. Confirm by inspection that the status of fire and gas system has beenprovided at operator stations S1 S2 S3


13.Confirm by inspection that personal toxic gas detectors are suitable todetect the range of toxic gases within the plant (typically H2S, SO2, CO andhigh/low O2 levels)

S1 S2 S3

14. Confirm by document review of maintenance records that respiratoryprotective equipment continues to function in accordance with design R1 R1 R2



Low Medium High

1. Confirm by inspection that the emergency shutdown system remainsinstalled in accordance with the design S1 S2 S3

2. Confirm by inspection that control system (panels, displays, etc.) remaininstalled in accordance with design documents and drawings S1 S2 S3

3. Confirm by inspection that the status of ESD remains provided at operatorstations S1 S2 S3

4. Confirm by inspection that adequate protection of ESD valves remainsprovided S1 S2 S3

5. Confirm by inspection that ESDVs remain suitably protected from potentialvehicular impact S1 S2 S3

6. Confirm by witnessing of a selection of tests that the emergency shutdownsystem functions in accordance with design S1 S2 S3

7. Confirm by witnessing tests that ESDVs maximum closure times are inaccordance with the design requirements S1 S2 S3

8. Confirm by document review of maintenance records that emergencyshutdown system continues to function in accordance with design R1 R1 R2



Low Medium High

1. Confirm by inspection that the blowdown header and flare system remaininstalled in accordance with the P&IDs S1 S2 S3


DNV GL AS


Low Medium High

2.Confirm by witnessing tests and a review of records that the blowdownsystem is capable of reducing pressure to the required amount in therequired time as specified in the design documents

S1 S2 S3

3.Confirm by document review of maintenance and inspection records thatthe blowdown header and flare system continues to function in accordancewith design

R1 R1 R2



Low Medium High

1. Confirm by inspection that the control room remains constructed inaccordance with the design drawings S1 S2 S3

2.Confirm by inspection that safety functions associated with the controlroom remain in accordance with the commissioning procedures (i.e. airlocks if fitted)

S1 S2 S3




Low Medium High

Fire water storage

1. Confirm by inspection that fire water storage remains provided inaccordance to design documents and drawings S1 S2 S3

2. Confirm by document review of maintenance and inspection records thatthe fire water storage continues to function in accordance with design - R1 R2

Firewater pumps

3. Confirm by inspection that fire pumps remain installed in accordance withdesign drawings S1 S2 S3

4. Confirm by witnessing tests that the fire pumps capacity and dischargerates remain in accordance with design. - S1 S2

5. Confirm by witnessing tests that fire pump start arrangements remain inaccordance with design S1 S2 S3

6. Confirm by document review of maintenance and inspection records thatthe fire pumps continue to function in accordance with design R1 R1 R2


7. Confirm by inspection that the firewater distribution ring main remainsprovided in accordance with the design drawings S1 S2 S3


DNV GL AS


Low Medium High

8. Confirm that firewater distribution ring main isolation valves remaininstalled and operate in accordance with the P&IDs S1 S2 S3

9.

Confirm by witnessing tests that the firewater and foam supply systemsare capable of delivering sufficient extinguishing to all necessary locationsto deal with credible worst case fire scenario as required by the designdocuments

- S1 S2

10. Confirm by review of records that foam is supplied with appropriatecertification R1 R2 R2

11. Confirm by document review of maintenance and inspection records thatthe fire pumps continue to function in accordance with design R1 R1 R2


12. Confirm by inspection that the firewater and foam supply systems remaininstalled in accordance with the design drawings S1 S2 S3

13. Confirm by inspection that the monitors and hydrants remain installed inaccordance with the design documents and drawings S1 S2 S3

14.

Confirm by witnessing tests that the firewater and foam supply systemscontinue to be capable of delivering sufficient extinguishing to all necessarylocations to deal with credible worst case fire scenario as required by thedesign documents

S1 S2 S3

15.Confirm by document review of maintenance and inspection records thatthe firewater and foam supply systems remain in good condition withadequate wall thickness

R1 R1 R2


16. Confirm by inspection that the gaseous fire-fighting systems remaininstalled in accordance with the design drawings S1 S2 S3

17. Confirm by inspection that status indicators remain provided at allenclosures entrances protected by gaseous fire-fighting systems S1 S2 S3

18.Confirm by witnessing tests that the firewater and foam supply systemscontinue to be capable of delivering sufficient extinguishing gas to allnecessary locations as required by the design documents

S1 S2 S3

19.

Confirm by document review of maintenance records that status indicatorsprovided at all enclosures entrances protected by gaseous fire-fightingsystems continue to function as intended to give personnel sufficientwarning to evacuate the enclosure

- R1 R2

20.Confirm by document review of maintenance and inspection records thatthe gaseous fire-fighting systems remain in good condition and continue tofunction in accordance with design

R1 R1 R2


21. Confirm by inspection that any fire-fighting vehicles continue to conform tothe requirements of the design documents S1 S2 S3


DNV GL AS


Low Medium High

22.Confirm by witnessing tests that any fire-fighting vehicles remain capableof delivering sufficient extinguishing to all necessary locations as requiredby the design documents

S1 S2 S3

23.Confirm by document review of maintenance and inspection records thatthe any fire-fighting vehicles remain in good condition and continue tofunction in accordance with design

R1 R1 R2



Low Medium High

1. Confirm by inspection that passive fire protection (PFP) remains provided inaccordance with the design on vessels, piping, supports and structures S1 S2 S3

2. Confirm by inspection that penetrations in PFP remain installed inaccordance with manufacturer’s instructions S1 S2 S3



Low Medium High

1. Confirm by inspection that bunding and drainage remains installed isaccordance with the design drawings S1 S2 S3



Low Medium High

1.Confirm by inspection that emergency power and uninterruptible powersupply (UPS) remains installed in accordance with design documents anddrawings

S1 S2 S3

2. Confirm by review of records that the supplied UPS batteries remain inaccordance with the design documents - R1 R2

3. Confirm by inspection that automatic changeover of UPS battery bankscontinues to operate in accordance with the design S1 S2 S3

4. Confirm by document review of maintenance records that UPS remains ingood condition and continue to function in accordance with design R1 R1 R2


DNV GL AS



Low Medium High


1. Confirm by inspection that all communication and alarm systems remaininstalled in accordance with design documents and drawings S1 S2 S3

2. Confirm by witnessing tests that emergency communications and alarmsare audible over the whole facility S1 S2 S3

3. Confirm by witnessing tests that in noisy areas personnel are alerted toemergency alarms by flashing beacons or other suitable means S1 S2 S3

4.Confirm by document review of maintenance records that communicationand alarm systems remain in good condition and continue to function inaccordance with design

R1 R1 R2


5. Confirm by inspection that the internal and external communicationsremain installed in accordance with the commissioning procedures S1 S2 S3

6.

Confirm by inspection that adequate external and internal telephone andfax lines remain available at all times during an emergency giving theemergency control centre the capability to handle two-way communicationswith all relevant parties

S1 S2 S3

7.Confirm by document review of maintenance records that internal andexternal communications remain in good condition and continue to functionin accordance with design

R1 R1 R2

Table C-93 HVAC


Low Medium High

1. Confirm by inspection that the HVAC system remains been installed inaccordance with the D&IDs S1 S2 S3

2.Confirm by witnessing tests that HVAC systems physically isolate bydampers the air supply on flammable or toxic gas, or smoke detection atthe HVAC inlet

- S1 S2

3. Confirm by witnessing tests that the control room HVAC is shutdown anddampers are closed on confirmed gas at the HVAC inlet. - S1 S2

4. Confirm by witnessing tests that commissioning reports that damperclosure occurs within the required limits upon gas detection. S1 S2 S3

5.Confirm by document review of maintenance records that HVAC systemsremain in good condition and continue to function in accordance withdesign

R1 R2 R2


DNV GL AS



Low Medium High

Escape routes

1. Confirm by inspection that escape routes remain constructed in accordancewith the design documents and drawings S1 S2 S3

2. Confirm by inspection that escape routes remain marked in accordancewith design S1 S2 S3

Muster area

3. Confirm by inspection that muster areas remain marked in accordance withdesign S1 S2 S3

4. Confirm by inspection that muster areas have facilities to take muster andreport findings to emergency control centre S1 S2 S3

Emergency lighting

5.Confirm by inspection that escape routes and muster areas are adequatelyilluminated during periods of operation of emergency lighting to thespecified minimum level

S1 S2 S3

General

6.Confirm by document review of maintenance and inspection records that allcomponents of the egress and evacuation system remain in good conditionand continue to function in accordance with design

R1 R2 R2

C.8 Modifications or upgrades

C.8.1 General principles

C.8.1.1 The verification of the design, construction and commissioning of modifications or upgrades toexisting hydrocarbon facilities shall be carried out in accordance with [C.3], [C.4], [C.5] and [C.6] previouslyin this appendix as if a new facility was being built on a new site.

C.8.1.2 However, unlike a green-field project, modifications or upgrades may have compatibility issues withexisting units in facility.

C.8.1.3 The verification scope of work in this section deals with these possible compatibility issues bothwith other units in process proximity, i.e. upstream or downstream of the new or modified unit, and units inphysical proximity, which may, or may not, be the same units.

C.8.2 Verification of design of modifications

C.8.2.1 Detailed scopes of work for the verification of the design of modifications are given in Table C-95.


DNV GL AS

Table C-95 Design of modifications - compatibility with existing facility


Low Medium High

1.Confirm by review of the QRA that the modifications to site layout havebeen demonstrated to show that the level of risk remains within thecorporate risk acceptance criteria

- R1 R2

2.Confirm by review of equipment layout drawings, bases of design andformal safety assessments that equipment separation within the modifiedfacility remains adequate in terms of the risk acceptance criteria

- R1 R2

3.

Confirm by review of bases of design that the effects on units upstream ordownstream have been considered in terms of, for example:

— incoming or outgoing product composition— corrosion potential of changes in product composition— changes in product:

— flowrates— temperatures— pressures.

R1 R2 R2

4.Confirm by review of the fire and explosion analysis that existing units orequipment close to the modifications are not affected by fires, explosions orthe release of toxic vapour beyond their original design criteria

R1 R2 R2

5.Confirm by review of drawings that where changes to escape routes andemergency vehicle access result from the modifications, that routes andaccesses to an equivalent level of safety are to be provided

R1 R2 R2

6.

Confirm by review of design documents that any modifications do notadversely affect existing systems, such as:

— process control— fire and gas detection— emergency shutdown.

R1 R2 R2

7.

Confirm by review of design documents that existing and modified processcontrol, fire and gas detection and emergency shutdown systems arecapable of effective communication with each other and act as onecomplete system

R1 R2 R2


DNV GL AS

C.8.3 Verification of construction of modifications

C.8.3.1 Detailed scopes of work for the verification of the construction of modifications are given in TableC-96.

Table C-96 Construction of modifications


Low Medium High

1. Confirm by inspection that the layout of the modifications is in accordancewith the design documents S1 S2 S3

2. Confirm by inspection that there are no layout considerations that were notreadily apparent during design S1 S2 S3

3.Confirm by inspection that process control, fire and gas detection andemergency shutdown systems have been constructed in accordance withdesign documents

S1 S2 S3

4. Confirm by inspection that escape routes and emergency vehicle accesseshave been constructed in accordance with design documents S1 S2 S3

5. Confirm by inspection that there are no escape routes and emergencyvehicle access considerations that were not readily apparent during design S1 S2 S3

6. Confirm by inspection that there are no personnel accesses considerations,such as valve accesses, that were not readily apparent during design S1 S2 S3

C.8.4 Verification of commissioning of modifications

C.8.4.1 Detailed scopes of work for the verification of the commissioning of modifications are given in TableC-97.

Table C-97 Commissioning of modifications


Low Medium High

1.Confirm by witnessing of tests that existing and modified process control,fire and gas detection and emergency shutdown systems are capable ofeffective communication with each other and act as one complete system

S1 S2 S3

2. Confirm by witnessing of tests that no interference occurs between newand existing systems such that their operation is adversely affected S1 S2 S3


DNV GL AS

APPENDIX D MAJOR ACCIDENT HAZARDS VERSUS SAFETY-CRITICAL ELEMENTS

D.1 Purpose of appendix

D.1.1 Introduction

D.1.1.1 The purpose of this appendix is to show typical refinery hazards and the interface with safety-criticalelements and risk mitigation measures.

D.1.1.2 A preliminary identification and analysis of possible risk mitigation measures, i.e. inherent safety,prevention, detection, control, mitigation and emergency response, shall be carried out in accordance withALARP principle. Practical and cost-effective risk mitigation measures based on the risk assessment resultsshall be identified.

D.1.1.3 However, major accident hazards and their related safety-critical elements are specific to a specifichydrocarbon facility as they related to the particular risks to that facility and its personnel. Other similarfacilities may have similar risks (and similar major accident hazards) but each list of major accident hazardsand their related safety-critical elements must be specific to each installation and its specific risks.

Table D-1 Major accident hazards versus safety-critical elements

Safety critical element

Flam

mab

le p

roce

ss li

quid

rel

ease

Flam

mab

le p

roce

ssva

pour

rel

ease

Toxi

c pr

oces

s liq

uid

rele

ase

Toxi

c pr

oces

s va

pour

rel

ease

Pipe

line

rele

ase

Ves

sel r

uptu

re/

pres

sure

pul

se

Tank

rel

ease

Str

uctu

ral c

olla

pse

Rel

ease

of da

nger

ous

subs

tanc

e

Dro

pped

obj

ect

Erra

nt v

esse

l im

pact

Veh

icle

impa

ct

Inherent safety a) b) c) d) e) f) g) h) i) j) k) l)

Layout M M M M M M M P P P

Hydrocarbon inventory/leaksource minimisation P/M P/M P/M P/M P/M P/M P/M

Hazard prevention measures

Process facilities integrity/process system P P P P P P P P

Process facilities integrity/reliefvalves and relief system P P P P P P P P

Process facilities integrity/structural integrity P

Process facilities integrity/control systems P P P P P P


DNV GL AS


Flam

mab

le p

roce

ss li

quid

rel

ease

Flam

mab

le p

roce

ssva

pour

rel

ease

Toxi

c pr

oces

s liq

uid

rele

ase

Toxi

c pr

oces

s va

pour

rel

ease

Pipe

line

rele

ase

Ves

sel r

uptu

re/

pres

sure

pul

se

Tank

rel

ease

Str

uctu

ral c

olla

pse

Rel

ease

of da

nger

ous

subs

tanc

e

Dro

pped

obj

ect

Erra

nt v

esse

l im

pact

Veh

icle

impa

ct

Control of ignition/vehicles P P P P P

Control of ignition/fired heaters,hot surfaces and exhausts P P P P

Control of ignition/electricalitems P P P P

Control of ignition/lightning,static and earthing P P P P

Pipeline integrity/onshorepipeline P

Pipeline integrity/offshorepipeline/SPM P

Pipeline integrity/third partyinterference protection P P P P P P P P P P P

Dropped object and impactprotection P P P P P P P P P P P P

Hazard detection/control measures

Fire and gas detection/smokeand gas detection for sitebuildings

D D D D D D

Fire and gas detection/fire andGas-external areas D D D D D D

Fire and gas detection/fire andgas-machinery enclosures D D D D D D

Fire and gas detection/fire andgas control (forming part of theintegrated control system)

D D D D D D

Leak detection/pipeline leakdetection D D D D D D D

Visual monitoring/CCTV D D D D D D D D D D D

Emergency shutdown system/ESD control system C C C C C M C


DNV GL AS


Flam

mab

le p

roce

ss li

quid

rel

ease

Flam

mab

le p

roce

ssva

pour

rel

ease

Toxi

c pr

oces

s liq

uid

rele

ase

Toxi

c pr

oces

s va

pour

rel

ease

Pipe

line

rele

ase

Ves

sel r

uptu

re/

pres

sure

pul

se

Tank

rel

ease

Str

uctu

ral c

olla

pse

Rel

ease

of da

nger

ous

subs

tanc

e

Dro

pped

obj

ect

Erra

nt v

esse

l im

pact

Veh

icle

impa

ct

Emergency shutdown system/emergency shutdown valves(ESDVs)

C C C C C M C

Blowdown header and flaresystem C C C C C M

Control room C C C C C C C C C C C C

Active fire fighting systems/fireeater storage M M M M M

Active fire fighting systems/firewater pumps M M M M M

Active fire fighting systems/firewater distribution ring-main M M M M M

Active fire fighting systems/firewater and foam supply M M M M M

Active fire fighting systems/gaseous fire fighting systems M M M M

Active fire fighting systems/firefighting vehicle M M M M M M

Passive fire protection M M M M M P M

Bunding and drainage C C C C

Hazard mitigation measures

Emergency services/emergencypower M/C M/C M/C M/C M/C M/C M M

Emergency services/emergencycommunications and alarms M M M M M M M M M M M M

Internal and externalcommunication M M M M M M M M M M P/

C/MP/C/M

Personnel toxic gas protection M M

Uninterruptible power supply(UPS) M/C M/C M/C M/C M/C M/C M M

HVAC M M M M M M M


DNV GL AS


Flam

mab

le p

roce

ss li

quid

rel

ease

Flam

mab

le p

roce

ssva

pour

rel

ease

Toxi

c pr

oces

s liq

uid

rele

ase

Toxi

c pr

oces

s va

pour

rel

ease

Pipe

line

rele

ase

Ves

sel r

uptu

re/

pres

sure

pul

se

Tank

rel

ease

Str

uctu

ral c

olla

pse

Rel

ease

of da

nger

ous

subs

tanc

e

Dro

pped

obj

ect

Erra

nt v

esse

l im

pact

Veh

icle

impa

ct

Emergency response

Egress and evacuation system/escape routes M M M M M M M M M M M

Egress and evacuation system/muster area M M M M M M M M M M M

Emergency lighting M M M M M M M M M M M

a) Flammable liquid releases result in pool fires, flash fires through evaporation and jet fires if pressurised. Canescalate to BLEVEs if conditions are right.

b) Flammable vapour/gas release result in jet fires if ignition is immediate and vapour cloud explosions if ignition isdelayed. Escalation in local area is likely from jet fires and is almost inevitable for VCEs.

c) Toxic liquid release can subsequently flash although typically easily contained if recognised. Liquid releases inaerosol form may be more problematic.

d) Toxic gas releases result can result in large drifting clouds with significant hazard ranges including offsite impact.Most likely scenario to result in large numbers of casualties.

e) Pipeline releases are generally difficult to detect unless in a frequently visited area or ignited.f) Vessel rupture can result from internal overpressure such as from an internal explosion or uncontrolled increase in

pressure. The pressure pulse at rupture can have blast overpressure levels equivalent to VCEs.g) Tank releases are historically due to overfilling or structural collapse of the tank due to a fire. Full face crude tank

fires have a 30-50% chance of escalating to a boil-over with significant impact to a large area around the tank.h) Structural collapse can result from loss of integrity due to impact, deterioration, subsidence or fire impingement.

May escalate to process releases. Structure includes buildings, pipe and vessel supports, jetty trestle and flarestacks.

i) Dangerous substances include high pressure steam, and stored chemicals and gases. Impact will tend to belocalised. Unlikely to escalate.

j) Dropped objects originate from crane operations in process areas, and mooring operations at jetty and SPM. Canescalate to structural collapse or process releases.

k) Errant vessel impact at the SPM or jetty may be due to loss of control of near by vessels. Can escalate to structuralcollapse or process releases.

l) Vehicle impact within the process area can escalate to structural collapse or process releases.


DNV GL AS

Type Release Fluids Ignition Consequences

Flammable events

Small/mediumjet fire

Continuous releaseof flammable fluidwith significantmomentum from a25 mm or smallerleak

Hydrocarbongases, two phasemixtures andliquids: fluid needsto be pressurised

Immediate ignitionvia auto-ignition,static build-up insome leak scenarios,or other form atsource of leak

P - Fatalities very improbable: minorinjury possible

A – Minor damage to equipment

E – Minimal impact.

Large jetfire

Continuous releaseof flammable fluidwith significantmomentum froma 50 mm or largerleak

Hydrocarbongases, two phasemixtures andliquids: fluid needsto be pressurised

Immediate ignitionvia auto-ignition,static build-up insome leak scenarios,or other form atsource of leak

P – Serious injury/fatalities probablefor those nearby

A – Localised but substantialdamage, including structural failureof equipment

E – Minimal impact

Flash fire Continuous releaseof flammable fluid

Evaporation of C4+components frompool spill

Delayed ignitionsome distance fromthe source of theleak. Flame frontburns back to sourcedepending upon theair fuel ratio

P – Can cause flash burns toindividuals: Fatality possible butunlikely.

A – Negligible damage to equipment.

E – Spill may have impact

Esc – May escalate to pool fire whenburn back ignites originating pool

Pool fire Release offlammable fluid

Fluids of C4+components: maybe static or runningpools

Ignition of flashing/evaporating vapourby external source

P – Fatalities unlikely whereopportunity to escape exists

A – Potentially widespread impact ifnot contained

E – Can have significant localenvironmental impact due to largequantities of smoke

Esc – Can escalate to BLEVE in someunder vessel/pipe rack fires

Boil-over

Sudden release oflarge quantities ofburning fluid froman atmospherictank, caused bywater boiling in thebase of the tank dueto a surroundingpool fire or a tank-top fire heating upthe contents of thetank

Crude oil andhydrocarbon productliquids

Ignition fromexisting tank top fire

P – Unlikely to result in injury orfatality as there is plenty of warningof event

A – Potential widespread impact asthe contents of the tank can expandby 400 times due to frothing: mayoverspill the bund wall

E - Can have significant localenvironmental impact due to largequantities of smoke

Esc - Rain-out of burning dropletscan cause secondary fires up to5 tank diameters away: thermalradiation can peak well above thevalue required to start secondaryfires at distances up to 200m


DNV GL AS

Type Release Fluids Ignition Consequences

Boilingliquidexpandingvapourexplosion(BLEVE)

Catastrophic failureof pressure vesselresulting in a suddenrelease of vapour:failure is due to theinternal pressure ofboiling liquid andvapour exceedingthe reduced tensilestrength of rapidlyheated vessel wall

Pressurisedfluids with C4+components ifabove boiling point:affects overheadaccumulators andvessels, but notcolumns whereflanges fail first

Ignition due to heatsource applied tovessel (pool fire, jetfire etc.)

P – Take time to develop so fatalitiesshould be unlikely if signs arerecognised

A – Massive damage over large areadue to projectiles, overpressure andfire balls


Esc – May result in other events dueto damage caused

Vapourcloudexplosion(VCE)

Release offlammable fluid:very unlikelyif volumes areless that 10t (forgeneral hydrocarbonservice): it is morelikely for Hydrogenand Propylene cloud,e.g. 100 kg

Typically C3, C4 andC5 in storage or anyhydrocarbon fluid inprocess if above itsboiling point

Ignition by externalsource resultingin an explosion:confinement levelaffect the probabilityof VCE

P – Fatalities a probable outcome

A – Pressure wave causes significantdamage. Extent depends on sizeof release but considered a majorimpact.


Esc – Escalation almost inevitable

Toxic events

Toxicrelease

Release of toxicfluids

Toxic gases such asH2S, SO2 and CO Not applicable

P – Extent of CO toxicity dependsupon original concentration andpressure: potential for offsiteimpacts

A – No impact

E – May have impact on local faunaand flora but unlikely

Esc – No escalation

P = Personnel

A = Assets (plant and equipment)

E = Environment

Esc = Escalation


DNV GL AS

APPENDIX E GUIDANCE ON THE DEVELOPMENT OF VERIFICATIONPLANS

E.1 Purpose of appendix

E.1.1 Introduction

E.1.1.1 The purpose of the verification plan is to describe the philosophy and methods used to ensurethat an independent and competent scrutiny is carried out on the parts of the hydrocarbon facility that areconsidered to be critical to its safety and integrity to confirm their initial suitability.

E.1.1.2 Verification plans are specific to a specific hydrocarbon facility as the plan is related to the particularrisks to that facility and its personnel. Other similar facilities may have similar risks (and similar verificationplans) but each plan must be specific to each installation and its specific risks.

E.2 The verification plan’s part in facility risk management

E.2.1 Risk reduction in principle

E.2.1.1 Risk reduction for hydrocarbon facilities follows three main steps:

Figure E-1 Management of safety

E.2.1.2 ALARP is not defined in any legislation but has arisen from case law through the English courts. Theconcept is that the degree of risk from any particular activity can be balanced against the cost, time andtrouble of the measures to be taken to reduce the risk. Thus, the greater the risk the more reasonable itwould be to incur substantial cost, time and trouble in its mitigation. Conversely, the smaller the risk the lessreasonable it would be to expect great expense or trouble to be taken in reducing it.

Figure E-2 Risk reduction and verification


DNV GL AS

E.2.2 The major accident hazard process and integrity management

E.2.2.1 Major accident hazards are identified in a formal safety assessment by an analysis of the risks to thehydrocarbon facility’s integrity and the safety of personnel using suitable definitions of such accidents. Thedefinitions of these accidents may be set by national authorities.

E.2.2.2 Prevention, control and mitigation measures are the measures that have been identified to reducethese identified risks by preventing their occurrence, controlling them when they have occurred or mitigatingthe effects of their occurrence.

E.2.2.3 Safety-critical elements are those items of hardware that perform the prevention, control andmitigation measures to reduce risks. It must be noted that in this instance computer software is consideredhardware. Furthermore, it should be realised that the identification of safety-critical elements is solelyconsequence-based with no consideration of the probability of occurrence.

E.2.2.4 Performance standards are the definition of the methods by which the safety-critical elementsperform their risk reduction functions. Thus, performance standards are the basis to which the safety-criticalelements are designed, constructed, commissioned and operated. Their formulation is not stand-alonebut integral part of design process and must include assumptions in FEED, QRAs, other safety studies anddetailed design. Formulation of performance standards is function-based and conventionally lists essentialparameters relevant to functionality, availability, reliability and survivability.

E.2.2.5 Verification scheme is an independent examination of the safety-critical elements to confirm thatthey are suitable for the purpose for which they were designed, constructed, commissioned and operated. Itis carried out by personnel independent of the owner in order to have an external opinion of the effectivenessof owner’s and their contractors’ integrity management procedures and practices.

E.2.2.6 Verification activities usually will fall under three categories:

— visual examination— witnessing of construction, commissioning and inspection activities— review of documents.

E.3 Independent third-party verification

E.3.1 What is verification?

E.3.1.1 Verification is a system of independent and competent scrutiny of elements identified as critical tothe integrity of the hydrocarbon facility and the safety of personnel working in it. When requested by theowner verification may be extended to personnel located outside the facility.

E.3.1.2 Verification is in addition to routine design checks, construction and commissioning checks andinspections and maintenance and inspection during operation.

E.3.1.3 Verification is expected to:

— be an independent and competent scrutiny of the hydrocarbon facility’s safety-critical elements,performance standards and risk assessments’ assumptions and conclusions

— identify errors or failures in the selection of safety-critical elements and the specification of theirperformance standards

— include examination of the design, procurement, construction, commissioning and operation of thefacility’s safety-critical elements.


DNV GL AS

E.3.1.4 Verification activities are carried out at any place where a hydrocarbon facility is being designed,constructed, commissioned or operated. Such places would include design offices, fabrication sites, thefacility itself, the owner’s premises or any of its contractor’s premises.

E.3.2 How verification is carried out

E.3.2.1 DNV GL’s role is to provide an independent examination of the suitability of the safety-criticalelements. This includes the adequacy of the selection of these safety-critical elements and the adequacy oftheir performance standards.

E.3.2.2 DNV GL also provides findings and required remedial actions after completion of these examinations.

E.3.2.3 Examination of safety-critical elements involves activities, such as inspection, testing, review ofdocuments and audit, in order to assess whether these safety-critical elements comply, or confirm that theydo not comply, with their performance standards.

E.3.3 Content of verification plan

E.3.3.1 Various aspects of verification must be included in the verification scheme, namely the:

— principles for selecting persons to perform functions under the scheme and to keep the scheme underreview

— arrangements for the communication of information necessary to the persons referred to above— arrangements for review and revision of the scheme— nature and frequency of examination and testing— arrangements for the making and preservation of records showing;— examination and testing carried out— findings— remedial action recommended and— remedial action performed— arrangements for communicating the records above to an appropriate level in the owner— arrangements for taking of appropriate action following such reports.

E.3.4 Formal Guidance on verification plans and practices

E.3.4.1 The philosophy of verification of safety-critical elements and their accompanying performancestandards arises from the United Kingdom’s The Offshore Installations (Safety Case) Regulations 2005,Statutory Instrument 2005 number 3117, see [1.5].

E.3.4.2 Guidance on the United Kingdom’s implementation of verification may be found in A Guide to theOffshore Installations (Safety Case) Regulations 2005, see Sec.1 E.

E.4 Verification plan

E.4.1 Development of the verification plan

E.4.1.1 The verification plan shall be formulated to provide a written record during its development andimplementation of the independent and competent scrutiny of the design, construction, commissioningand operation of the hydrocarbon facility. Although presented as a single flow of activities, it is recognisedthat there will be a continuous feedback of modifications and improvements as the project develops. The


DNV GL AS

development of the verification plan therefore will be an ongoing activity, subject to appropriate formalchange control.

E.4.1.2 The requirement for the verification plan will be to establish that, for the selected SCEs, the PSsbring together the safety and integrity-related performance goals and requirements in such a mannerthat will allow DNV GL to demonstrate suitability. Suitability is defined as appropriate for intended use,dependable and effective when required.

E.4.2 Development of examination scope of work documents

E.4.2.1 The verification task list will define specific examination activities to be performed by DNV GL toconfirm the initial suitability of the SCEs. This initial and suitability will be confirmed against the specificperformance criteria given in the PS.

E.4.2.2 Each verification task will contain the following information:

— details of each SCE relevant to the task— against each SCE details of each PS relevant to the task— against each PS a list of examination activities to be completed by DNV GL— against each examination activity the following details are required:

— activity No. – a unique identification number for the examination activity described— a description of the examination activity to be performed,— the timing of the examination activities— nature of the examination activity— phase of the hydrocarbon facility life-cycle in which the activities occur— reference documents – suggested generic documents required to close or facilitate the examination

activity (the specified documents will not necessarily be an exhaustive list).

E.4.3 Methods of examination

E.4.3.1 The detailed methods of examination will be identified within the verification tasks. However, theexamination methods will fall into one of these four categories:

Inspection Visual inspection of the SCE in question

Test Witness or carry out functional testing of the SCE

Audit A documentation check with regard to the effectiveness of assurance activities undertakenby the owner or its contractors

Review A documentation check with regard to adequacy

E.4.4 Project phase

E.4.4.1 The phase of the hydrocarbon project cycle in which the activities occur will be identified within theverification tasks. However, the project phase will fall into one of these four categories:


DNV GL AS

Design Design of the facility or any of its components

Procurement

Procurement of the materials and items of plant intended for the facility

Guidance note:This activity may include design of components if this is a contractual requirement from the owner tothe Vendor.


Construction

The onsite activities of construction and assembly of the facility

Guidance note:Construction may take place at multiple sites before integration at the main site.


Commissioning The onsite activities of commissioning the facility

Operations Operation of the facility for the purpose for which it was designed

E.4.5 Control of verification

E.4.5.1 It is recommended that management and control of verification activities is undertakenelectronically, preferably using a database but other suitable methods may be used.

E.4.5.2 The database (or other means of control) should contain the following input fields:

Table E-1 Verification control database – suggested input fields

Input field Description

Safety-criticalelement Safety-critical element

Performancestandard

Numbered performance criteria detailed in each performance standard document. Each ofthese will be linked to a SCE within the database. The database architecture shall enablemultiple PS to be linked to each SCE.

Examination activity

Description of the examination activity to be undertaken. As part of this input field thefollowing information is also required:

— type of examination (e.g. review, inspect, etc.)— lifecycle phase (design, construction, etc.)— details of documents required to assist with the verification activity.

Each examination activity will be linked to a PS within the database. The database architectureshall enable multiple activities to be linked to each PS.

Reporting

Description of the examination undertaken. As part of this input field the following informationis required:

— description of the verification work undertaken— details of outstanding actions to be completed— date of the examination— details of the individual verifier completing the examination.

Each report will be linked to a verification activity within the database. The databasearchitecture shall enable multiple reports to be linked to each examination activity.


DNV GL AS

Input field Description

Findings

Description of findings from the verification work undertaken. As part of this input field thefollowing information is required:

— verifier’s findings (comment on whether the activity is closed, the PS is met, etc.)— remedial actions recommended by the verifier— finding close-out date— report/finding status code— report/finding update details.

Each finding will be linked to a report within the database. The database architecture shallenable multiple findings to be linked to each report.

E.5 Verification reporting

E.5.1 Control of verification reports

E.5.1.1 A uniquely numbered verification activity report (VAR) shall be produced for each for each activitylisted in the verification task list by the individual verifier undertaking the examination. Each VAR will beproduced by entering the appropriate information into the verification database described previously. EachVAR will include the following information:

— safety-critical element— performance standard— unique examination activity identifier and description— description of the examination completed— details of any outstanding activities— findings of the examination (e.g. has the performance standard been met?)— remedial actions recommended to the owner.

E.5.1.2 All records shall identify clearly the individual(s) undertaking the examination.

E.5.2 Verification status reporting

E.5.2.1 Each VAR will specify the activity status code as described below:A - Performance Standard satisfiedB - Performance Standard not met or demonstratedC - Further verification activities to be completed or additional information required which is not available

E.5.2.2 Status A: issued after any comments relating to the activity have been resolved and it is confirmedthat the requirements of the relevant performance standard have been met.

E.5.2.3 Status B: issued after it is agreed with the owner that outstanding comments cannot be resolved andthat DNV GL cannot confirm that the requirements of the relevant performance standard have been met, orcan confirm that the requirements have not been met.

Guidance note:Where VARsStatus B is issued by DNV GL, it is up to the owner to justify to himself, and where necessary to the nationalauthorities, his basis for acceptance of the deviation from his previously stated requirements.DNV GL’s final report will simply state that the VAR has been issued at status B and give the reasons for this.



DNV GL AS

E.5.2.4 Status C: not normally issued but the status recorded for progress reporting, if required by theowner.

E.6 Review and revision of the verification plan

E.6.1 Continuous review of the plan

E.6.1.1 The verification plan will remain live for the lifetime of the design, construction and commissioning ofthe hydrocarbon facility. It is essential that there is a continuous feedback of modifications and improvementsas the project develops. The development of the verification plan therefore will be an ongoing activity,subject to appropriate formal change control.

E.6.1.2 The owner should ensure that all persons completing activities relevant to the design, constructionand commissioning of the hydrocarbon facility are given the opportunity to comment on the adequacy andpossible improvement of the verification plan.

E.6.2 Events initiating revisions

E.6.2.1 The verification plan may require changes that are triggered by events such as:

— major design changes during the design, construction or operations phase— verification plan is incorrect, deficient or requires improving— change of record of SCEs (e.g. revised methodology for identifying SCEs)— change of performance standards (e.g. current PS inappropriate, or due to technical advances)— inability to confirm that SCE meets the requirements of its PS— major revision to supporting safety documentation (QRA, FERA, etc.)— damage or incidents— change in record-keeping systems— change in responsibilities/accountabilities— change in reporting requirements.

E.6.2.2 When one or more of the above occurs, the owner shall review, and where deemed necessaryupdate, the plan. These reviews will be conducted in consultation with DNV GL, together with anycontractor’s personnel as appropriate.

Cha

nges

– h

isto

ric


DNV GL AS

CHANGES – HISTORICThere are currently no historical changes for this document.

About DNV GLDriven by our purpose of safeguarding life, property and the environment, DNV GL enablesorganizations to advance the safety and sustainability of their business. We provide classification,technical assurance, software and independent expert advisory services to the maritime, oil & gasand energy industries. We also provide certification services to customers across a wide rangeof industries. Operating in more than 100 countries, our experts are dedicated to helping ourcustomers make the world safer, smarter and greener.

SAFER, SMARTER, GREENER