SPE 86598
Inherently Safer Design; Changing Attitudes and Relationships
G. A. Dalzell, TBS-Cubed
Copyright 2004, Society of Petroleum Engineers Inc.
This paper was prepared for presentation at The Seventh SPE International Conference on
Health, Safety, and Environment in Oil and Gas Exploration and Production held in Calgary,
Alberta, Canada, 29–31 March 2004.
This paper was selected for presentation by an SPE Program Committee following review of
information contained in a proposal submitted by the author(s). Contents of the paper, as
presented, have not been reviewed by the Society of Petroleum Engineers and are subject to
correction by the author(s). The material, as presented, does not necessarily reflect any
position of the Society of Petroleum Engineers, its officers, or members. Papers presented at
SPE meetings are subject to publication review by Editorial Committees of the Society of
Petroleum Engineers. Electronic reproduction, distribution, or storage of any part of this paper
for commercial purposes without the written consent of the Society of Petroleum Engineers is
prohibited. Permission to reproduce in print is restricted to a proposal of not more than 300
words; illustrations may not be copied. The proposal must contain conspicuous
acknowledgment of where and by whom the paper was presented. Write Librarian, SPE, P.O.
Box 833836, Richardson, TX 75083-3836, U.S.A., fax 01-972-952-9435.
Abstract
There is safe design and there is safer design. With safe
design, there are active safeguards to prevent the occurrence of
hazardous events and to protect people and plant from the
effects. With safer design, there are fewer hazards, fewer
causes and fewer people to be exposed to the effects.
Currently, the majority of our designs strive to produce safe
designs but in doing so, the facilities are becoming more
complex, with increased maintenance and human exposure.
This paper argues that industry has been trying too hard, and
in doing so, has lost many of the opportunities to minimize
risk at source. This paper offers an alternative route to design
safety, an inherently safer one, through simplification,
reliability and longevity. It uses examples from offshore
facilities to illustrate these arguments.
Introduction
Thirty five years ago, the lone voice of Ralph Nader
harangued the car industry over safety. At the same time
Volvo and Saab were beginning to reinforce their vehicles.
Now safety is one of the most important facets of car design
and marketing. It is not just a case of compliance with
minimum standards, but manufacturers actively seek ways to
excel; producing not only better protected vehicles but ones
which are inherently less likely to be involved in an accident.
What would it take to move this industry to the same position?
This paper examines the changes to the design process,
attitudes and relationships between design contractor and
operator which may be needed to realise the full potential of
inherently safer design. It is not saying that individual
designers and companies do not care and that designs are not
safe, rather that the contractual relationships inhibit the search
for safer design and that the current approach does not offer
the challenge, structure or process to focus their efforts. The
paper offers a radical view of inherently safer design based on
simplicity, reliability and longevity, thereby taking people
away from the hazards rather than needing their presence to
keep them under control. It proposes a structured process
covering five areas; setting focused goals to provide a vision
of safer design, providing the infrastructure and contractual
relationships, understanding and ownership of the hazards,
concept selection and residual hazard management.
A Vision of Inherently Safer Design
The conventional vision of safe design. The oil and gas
industry, particularly the offshore sector, has progressively
increased the levels of safety through code compliance, safety
studies and the use of protection and evacuation systems. In
most cases, this has served well, with lessons learned from
disasters such as Piper Alpha (3) being incorporated into
legislation and corporate processes. Unfortunately all efforts to
improve safety add to designs, both the processes and the
equipment. There are more valves to shut the plant down
safely, better fire and gas detection systems, more instruments
to sense process deviations, bigger firepumps and deluge
systems, and evacuation systems to deal with increasingly
severe weather conditions. It has created designs which are
capable of withstanding larger hazardous events and
protecting or evacuating the people on board. It has however
created an increasingly complex plant which is more difficult
to operate, has more leak points and has more people in close
proximity to the hazards. It is better protected, but is it safer?
The chemical industry’s vision. This onshore chemical
sector has outshone all others in its efforts to define and apply
inherent safety. Of particular note are the efforts of Kletz (1)
and Hendershot (2). This industry has certain established
concepts which they endeavour to apply to the choice of
processing for new designs. These are characterised by the
guide words; elimination (of processing and hazards);
substitution (of hazardous chemicals with less hazardous
ones); attenuation (reduction of processing conditions such
as pressure to reduce the hazard effects); and intensification
(concentration of the processing to reduce hazardous
inventories). This work has been immensely valuable in
highlighting opportunities to minimize the effects of some
extremely hazardous chemicals and reactions through
fundamental choices in the plant design. While they were the
initiators of the inherent safety movement, their concepts do
not transfer easily to the oil and gas industry. Enlightened
process engineers can apply them to separation, and gas
processing but this only constitutes a portion of the risk. How
would they be applied to mechanical problems such as the
2 SPE 86598
marine stability and anchoring of a Spar platform, or to the
transfer of containers from a supply boat in the North Sea?
An alternative vision of safer design. This was outlined in a
controversial paper (4). In this work, the author examined
how conventional safety systems might increase some risks
while reducing others. It suggested that the net benefit of some
systems could be negative, increasing both the likelihood of an
event and the numbers of people who might be exposed to it.
This has been further studied on an existing platform (5) with
the results indicating that the suppositions are correct. For
example, the drawbacks listed included the increase of
underlagging corrosion caused by deluge systems, the process
upsets caused by ESD and depressurization systems, the large
number of breaches of containment and heavy lifts to service
safety systems such as relief valves, and the high module
occupancy needed to clean and maintain modern detection
systems. The paper argued that a safe plant is one that doesn’t
leak, collapse or need large numbers of people to operate and
maintain it. It is one that is so safe that it does not need
protection systems or operators.
To most people, whether safety specialists, generalists or
regulators, a plant without safety systems would be
unthinkable. We have a laudable mind set of continuous
improvement and this translates into including every safety
feature and study from the last project and adding yet further
enhancements. This is the “safety ratchet” which adds ever
increasing complexity. The alternative vision is one where
safety systems would be the very last things that would be put
on to a facility, particularly an offshore platform. That is not to
say that they would not be included but that they would be
literally the last things to be added. It would be as though their
inclusion is an admission of failure; a failure to manage the
hazards effectively without them. There would also clearly be
a hierarchy. Everyone would concede that there is a need to
shut a platform down safely without human intervention.
Wells need master and wing valves and risers need topsides
ESD valves. However, this different vision does challenge the
need for sophisticated detection, deluge and emergency
depressurization which are lower down the risk management
hierarchy and have more drawbacks.
One project which took these ideas on board was the new
gas field development in Eastern Indonesia. It started life as a
fully manned offshore platform with gas dehydration to
prevent corrosion in the pipeline from the high CO2 content. A
radical shift in thinking changed in into an unmanned
wellhead tower with a corrosion resistant pipeline and a target
visit frequency of less than a month (6). Every safety system
was challenged, until it only has the minimum of shutdown
systems and detection. It is orders of magnitude safer than the
manned processing facility simply because people are not
present to make mistakes or at risk from the consequences.
Another paper took this concept of inherently safer design
one step further. It suggested that risk in proportional to the
square of the operating cost. (7). It made a simple argument:
Risk is likelihood times consequence. Likelihood is a function
of cause which is almost always related to human error or
omission and this relates directly to the amount of activity
needed to run the plant and therefore the operating cost.
Consequence is the number of people killed or injured, which
is related to the numbers working on the site and therefore the
operating cost. Hence, RISK = (OPEX)2. As an example take
the case of paint: A poorly painted platform may require
repainting after 5 years. It is potentially one of the most
dangerous jobs on that platform. Dropped scaffold poles and
grit ingress to rotating seals can cause hydrocarbon leaks. The
scaffolding and habitats will hinder ventilation, obstruct
deluge and detection, and increase explosion overpressures.
The activity will bring many more people onto the platform
and into close proximity with the hydrocarbon hazards. Better
paint might eliminate the need to repaint at all, yet who would
have considered this as safety critical. In reality a better paint
specification might save more lives than a couple of firepumps
but how often is that comparison made?
This new vision appears to undermine years of genuine
attempts to reduce risk. There will be resistance and this
previous commitment will need to be refocused on a different
target; eliminating hazards and causes at source rather than
analysing effects and defending against them. It also brings the
management of hazards back from the specialists; the hazard
analysts and loss control engineers, and gives it back to the
core engineering disciplines of process engineering, structures,
vessels, piping and layout. This is now a matter of
empowering the whole design team by creating a new attitude.
The Creation of an Attitude
The attitude is a simple one. It is a questioning mind which
asks, at every opportunity: What is dangerous, why is it
dangerous and is there a safer way? This might be anything
from the radius at a stress concentration, the choice of a pump
or instrument, the quality of that paint, through to the layout of
the platform or the choice of a fixed structure. This is both an
individual and a team attitude. It applies the thinking as the
opportunity arises, while the design is still fluid, rather than as
a formal retrospective process. This attitude lives within
everyone at all times. It is the conversation at the coffee
machine, the opening discussions at meetings and a core
question in everything that we do.
This attitude applies not only to the individual but to
organisations as well. The oil and gas companies who are the
customers, the design companies, the drilling contractors and
the major suppliers should all be asking these questions as
well. However, they should not only ask them about the
design but about the way they do business. If the search for
safer design is not reflected in their investment decisions,
design process and resourcing, then it will become just another
initiative.
Creating this attitude needs leadership. Most major
organisations have an HSE management system with between
10 and 16 elements each with specific expectations. In almost
all cases, the first element is leadership. We get what we ask
for; from our staff, design contractors and our suppliers. If
senior management takes a direct interest in safety and it is
obviously considered in every one of their activities and
decisions, then everyone who works with them will follow by
example. As DuPont so clearly demonstrate in their factories
and operations, it works, and is good business.
But what about design? Leadership by project managers
can be as effective in delivering safer designs as it is in
ensuring safe operations. A clear statement of expectations
relating to design safety, a continuous interest in the hazards,
SPE 86598
and a demonstrable commitment to reducing risks, by
allocating time and resources, will set an example which will
spread through the entire design and supply process. But how
often does this take place and, when we do address safety, are
we seen to be more interested in accidents in the design office
than the product? On an offshore installation, new starts
routinely meet the platform manager when they arrive in order
to hear the expectations for safe operation from the top. Does
the project manager ever have such meetings in the design
office, and, if they does take place, do the discussions relate to
design or office safety? If the project manager asks about the
hazards and seeks to find safer solutions, then everyone else
will too.
Establishing New Relationships
The design process is a complex one, with possibly more than
one client, perhaps two design contractors, one for FEED and
the other for detail, a multitude of subcontractors and
suppliers. Established processes determine what is needed and
how it should be designed. All of these processes presume the
need for safety studies and systems. Almost as soon as a
contract is signed the project sets about sourcing them. These
processes create (or copy) discrete default pieces of a safety
jigsaw but fail to consider the possibility of a radically
different picture which may not need them.
If inherently safer design is to succeed, everyone needs to
be committed to the search for it. This needs a fundamentally
different relationship between the clients and the primary
design contractors. The two usual primary metrics are capital
cost and schedule. Safety is usually measured by regulatory
approval, the delivery of safety studies, safety systems and
positive, recommendation free feedback from reviews. These
are not appropriate metrics for inherent safety. The problem is
that it is difficult to measure either in the finished product or in
the design processes. How do you measure an attitude? It is an
even greater problem to write the contracts that will deliver it.
The earlier introduction to the car industry points us in the
right direction. Rather than being a contractual requirement
which is rewarded, it should be a minimum requirement for
doing business. Operators should not countenance doing
business with a design contractor who in not committed to
actively seeking a safer solution from the concept to the detail.
Reliability and longevity should be fundamental requirements
in any design and be key selection criteria for all major
components. Design contractors should actively compete
against each other, not just on cost and schedule but on their
excellence in design safety. Unlike cars where the products
cab be compared, it would be the attitudes, resourcing and
processes within the company which will sell it. The key
features of the contractual relationship are as follows:
Management time and commitment to leadership. It should
not be necessary to write this into a contractual relationship.
However, there is a long way to go before everyone
understands their role in design and it would be as well to spell
it out. It defines the requirement for personal commitment
from every senior manager in the whole design and supply
process, from the client to the equipment suppliers.
A contractual strategy to reward the search for safer
design. This would define the resources, both people and their
time, which are earmarked to identify and consider hazards
3
and to search for ways to minimize them at source. This
should cover every member of the design team, from project
directors to draughtsmen, and it should be written into their
job specification as an essential requirement.
A procurement strategy which rewards longevity and
reliability. As highlighted earlier, plant, structures and fabric
with a short lifespan or a high service requirement are major
contributors to risk. Specific agreements will be required to
guide the incremental investment to achieve the required
longevity. It may also lead to a lifetime relationship with the
vendors where they are rewarded for the durability and lower
servicing of their products.
An effective hazard and risk management process. Both the
client and design contractor should develop their own
processes to deliver inherently safer design. Both will have
different experience and can contribute to a better common
approach. This process will provide structure to the designers’
thinking. It should ensure that all opportunities are evaluated
systematically. It is one thing to inspire the whole design team
to seek safer solutions but, without structure, the whole
activity will be disorganized and without focus. There are two
key facets to any effective process; hazard understanding and
proactivity. It the design team does not understand what is
dangerous and why, it cannot design out the hazard and
causes. If that information arrives too late, then it will be
impossible to implement the majority of the ideas. An
overview of a possible process is given later.
A selection and funding process for safer options. The
design process should specifically include a method whereby
options can be evaluated against agreed criteria; i.e. deciding
whether an option is worthwhile. Conventional processes use
the concept of the Incremental Cost to Avert a Fatality
(ICAF). These are appropriate to judge the need for further
protection systems but may not be suitable for inherent safety.
The contribution which reliability and longevity make to
reducing risk cannot easily be measured. Instead, it may be
appropriate to have clearly defined project goals and
investment criteria for these specific aspects; i.e. agreed
investment levels for specific reductions in the man days to
maintain the fabric over the lifecycle. This is the criteria by
which to decide how much to spend on that better paint.
Operator input: The future operators must be happy with the
inherently safer design approach. Their perception of design
safety will probably be based on that to which they have
become accustomed. They will be used to extensive safety
systems and expect to see them. They need to be comfortable
with the concept that the facilities will be so well designed and
built that they may not be necessary. That confidence can only
come from being an integral part of the design team from day
one. Once they are on board, they can make sure that this
vision is turned into reality. They know what works and what
doesn’t. They can judge vendors claims about the reliability
and longevity of their product based on that experience. They
know what leaks and is likely to fail and can help to design
these problems out. Where they cannot do so, then they must
be happy with their responsibilities for management of the
hazards that remain. The client and contractor must decide
what authority the operations representative should have;
advisory or executive. It may be appropriate for them to have
4 SPE 86598
the casting vote on critical inherent safety investment
decisions.
Training: This new approach requires everyone to participate
both in understanding the hazards and finding a safer way. It is
common sense but it requires a different attitude and way of
working. Everyone has the potential to deliver ideas to
enhance the inherent safety, but it may need to be reawakened
and broadened into new areas. One example where this type of
training has paid off is in the example given in (6). In this
case, three days were put aside for the whole design team to be
given the vision of the inherently safer unattended platform
and to challenge everything from the concept to the detail.
This completely transformed the project with their search for
safer design challenging every item of equipment on the
facility and proposing virtually maintenance free fabric.
Specialised engineering resources. Risks can only be
eliminated at source if the hazard characteristics are fully
understood. Projects must provide whatever specialists are
required to analyse both the causes and consequences. This is
essential for new problems such as the vortex generation and
fatigue loadings on risers in deep water. Similarly, if the
causes and effects of fires and explosions are not understood
there may be unwarranted or inappropriate provision of
protection. The types of specialisms should be identified by
considering the underlying risk drivers, problem areas and
inherent safety goals early in the project.
An Inherently Safer Design Process.
There are four key parts to an inherently safer design process;
the understanding and ownership of the hazards by the design
team, choosing the right concept, minimizing the risks from
the residual hazards at source and choosing the optimum
hazard management philosophy. These depend upon the three
underlying aspects described above; creating the vision of a
safer design through the setting of project goals, the right
attitudes and a project infrastructure and relationships which
allow it to flourish.
Setting project goals: The vision of a safer design needs to be
translated into specific goals for each project. These will target
the underlying aspects of a design upon which the team should
concentrate. Typical goals may target minimizing well
intervention, live breaches of containment, or the resupply
requirements of platforms. They may go further with a
conscious decision to operate facilities unmanned with goals
to eliminate fabric maintenance altogether. Every engineer can
relate to these goals. They mean more than vague
requirements to minimize risk.
Hazard understanding: Engineers cannot minimize risks if
they don’t understand the dangers. Projects should
progressively build a living picture of risk and share it with the
whole team. Initially, it will be a listing of the inherent risks
such as the reservoir fluids and conditions, the weather, or the
difficulties of developing the reservoir. As more information
becomes available, this picture will develop into a pattern of
risk by hazard and a deeper understanding of the causes,
severity, consequences and the potential for escalation. Each
time new information is added, there should be a simultaneous
challenge to minimise the risks associated with it. Every
member of the design team should use this hazard and risk
picture as a daily reference in their search for ideas to reduce
risk. Where elimination of the hazard or cause is not possible,
each designer would identify the measures which they need to
provide to deal with the causes. If it is decided that there
should be systems to limit and protect against the
consequences, then they should also determine what is
appropriate.
This approach to risk assessment differs from conventional
“safe design” in two ways; it is proactive – the information is
in place in time to make changes; and secondly, every
designer knows exactly the role they and everyone else plays
in managing the hazards. They can stand back at the end of the
project with confidence that they have delivered a
fundamentally safer design and put together an effective
hazard management system, rather than simply taking pride in
delivering safety systems.
Concept development and selection. It is tempting to do
what has been done before and what everyone else is doing.
It’s relatively quick and free from problems but it will only
produce “safe design”. If there is to be a step change, then
radically different ideas must be considered. This may involve
new technology such as down-hole separation or two phase
subsea production. There are many similarities between
management of innovation and inherent safety (8). The
barriers are the same too; “not on my project”; “it’s too risky”
“what if the regulators don’t approve?” Every development
whether it is a small inshore platform or a large complex
project should have at least one radical challenge to
convention, which is driven by the inherent safety challenge.
Is it possible to make the development so simple and reliable
that it could be run unmanned for the majority of its working
life and thereby do without systems other than those to support
the plant, keep the oil and gas in the pipe and shut it down
safely? It may prove that this is a better economic option due
to the drastically reduced operating costs and the elimination
of capital expenditure on secondary safety systems and the
accommodation. This was clearly the case in (6). Taking this
route may require some tolerance of potential shutdowns and
delayed startups in the business case. However, the simplicity
of the development may offset these concerns in practice as
there is so little to go wrong. There are no spurious fire and
gas trips if that system is not required or is simplified.
Many developments, particularly those in deep water have
unique hazards which are poorly understood. They are also of
a scale where running unmanned is unthinkable, particularly
when the drilling programmes are considered. There are
clearly a number of potentially catastrophic hazards which
could affect larger numbers of people. For larger more
complex developments such as these, it is better to have a
series of radically different concepts developed at the same
time. Each of these will have their own particular risk drivers.
With FPSOs; storage, hull integrity and riser swivels be
critical; with twin pontoon floating facilities the focus will be
on marine stability; and on spars, well design, tensioning and
the effects of fires and explosions on the accommodation will
predominate. The differences in the concepts should not just
be confined to the choice of support structure or process, but
different production options might also be considered.
Different throughputs, target availabilities, production profiles,
partial processing and export product qualities may be viable
SPE 86598
options too. The difference between 95% and 99% uptime
might make the difference between the facility being manned
and unmanned. Each of the different concepts should be
optimized to minimize the inherent risks and then an open
minded comparison should take place.
Conventional thinking might use Quantitative Risk
Assessment (QRA) to determine the relative risks and then the
selection would consider both the risks and the relative capital
costs. This frames the usual two questions, which is safest and
can we afford it. With inherently safer design, these questions
can be framed in a different way. The first is to find out why
each one is different; which are the predominant risks and why
are they so high? It may be that the continuous variation of the
loading pattern in an FPSO in an ocean environment leads to
high fatigue loading on the hull; or that the inherently square
characteristics of a Spar topsides cause large gas clouds and
make it difficult to locate the accommodation to avoid smoke
engulfment. If we know why each one is dangerous, then it is
possible to determine how inherent safety can be used to
minimize the risks from residual hazard risks at source, for
example by changing the FPSO hull design, and thereafter to
determine what else is needed in the way of additional safety
systems to manage them. The selection process moves from
being a questionable numerical risk ranking to a pragmatic
comparison of the residual difficulty in managing what is left.
This residual difficulty is the sum of the effort to maintain
process and structural integrity and to maintain all of these
additional systems, or to put it another way, the comparison
looks at the lack of inherent safety and the extent of dependent
safety.
Reducing the risks from the residual hazards at
source. Once the concept has been chosen and the design
moves into front end engineering design, there is still immense
scope to reduce risks at source. This is totally tied to a
structured approach to hazards analysis, with the
understanding of the hazard characteristics leading
immediately to a challenge to minimize them. The simple
questions and steps are as follows:
What’s the hazard and can I design it out? The concept
selection process will have eliminated some of the core major
hazards such as bulk oil storage but there will still be many
opportunities to design out smaller hazards or hazardous
activities. If the conventional design of a structure requires
inspection by diving or entry into hazardous confined spaces,
could this activity be designed out by changing the fatigue life,
altering the stress concentrations, node design or design safety
factors.
What are the causes and can I eliminate them?
Conventional risk assessment looks at likelihood rather than a
complete examination of the causes and their manageability. If
one of the causes of hydrocarbon releases is the intervention
into the process plant for repair, there should be a challenge to
minimize the frequency of these activities through investment
in the quality of the plant. This is where the client’s input is
invaluable both from their discipline engineers experience and
the hands on knowledge of the facilities operators.
Duplication, particularly of pumps and compressors is an
indication of a failure to deliver an inherently safe plant.
Multiple arrangements, providing 3 by 50% or 2 by 100%
5
units doubles or triples the number of rotating seals. It adds a
multitude of extra flanges, piping, valves and manifolds in
order to interconnect them. There is also the inferred
hazardous maintenance procedure involving the removal of a
broken unit from a live facility with heavy lifts and module
occupancy. What would it take in terms of design
specification, investment, supplier relationships and the
acceptance of plant downtime in order to depend upon a single
unit?
Similarly in examining dropped objects such as resupply
containers, the frequency of these activities can be studied and
all future operations challenged to see if they can reduce the
numbers of containerized loads needed to run the platform.
Changing to a corrosion resistant alloy for piping not only
eliminates the possibility of corrosion, it also removes the
corrosion inhibitor pumps, the small bore injection points in
the piping, the people to run the system, the food they eat, all
of the tote tanks containing the chemicals and the lifetime of
heavy lifts to bring them on board and return them. One
change can ripple all the way through the design.
What is the severity and how can I minimize it? The
severity is the potential for harm from the hazardous event. It
might be the explosion overpressure, the size and heat of a fire
or the impact energies of dropped containers or errant supply
boats. The classic area for minimization is in fires and
explosions where smaller instrument tappings, lower
pressures, smaller inventories and less congested plant can all
reduce the potential for harm. How often is a conventional fire
and explosion analysis used as a real challenge to optimize
these aspects of the design? Ideally, the design team should
carry out these analyses so that they can see the results
immediately and act upon them. If these studied are externally
are subcontracted, we will revert to the old reactive hazard
management.
What are the immediate consequences and can I create a
design that avoids them? This examines the effect that these
errant vessels, dropped containers, fires and explosions have
on people and critical plant. In simple terms if people are not
there, they cannot be killed. Again that comes back to an
inherently reliable and long lived plant. We might not be able
to run a large platform unmanned but might it be possible to
shift our thinking such that areas which are classified as
hazardous would require so little attention, that it would be
practical to allow entry only under permit? If a wellhead tower
only requires a visit every month, the why should a wellbay on
a manned facility not be the same? As for critical plant
damage, it is a case of optimizing the layout so that the more
frequent initial events such as explosions from compressor gas
leaks do not impact on major inventories or their weaker plant
such as instruments.
What is the potential for escalation to catastrophe and
can the facilities be designed so that they are not
overwhelmed or disintegrate? This requires an examination of
the worst credible events that could realistically occur and the
arrangement of the facilities so that the primary structure,
floatation, stability and safe refuges would not be
overwhelmed or destroyed. It is the attempt to make the
facilities almost bombproof, not by containment of the event
but by the inherent layout. If the worst happens, the facility
would not need to rely on evacuation.
6 SPE 86598
Choosing the optimum hazard management
philosophy. It will not be practical to manage all hazards by
the use of inherent safety alone. The concept of a large
complex facility without safety systems is a distant vision.
Systems will be required but there is a wide variation in the
types, their reliability and their dependence upon people. If we
revert to a default provision of conventional safety systems to
manage the hazard that remain, we will still end up with the
same complex labour intensive plant. However, if active
hazard management is undertaken using the knowledge of the
hazard characteristics from the previous five questions, then
we will be in a much better position to minimize this
complexity and personnel exposure.
A structured approach to residual hazard management is
described in (9). This argues that a conscious decision should
be made on design events; that prevention on its own is a
robust strategy for many hazards and that in others, their
severity and potential for harm can be reduced to such an
extent that no protection is necessary. It also highlights the
benefits of passive systems which require no maintenance
rather than active and operational ones which are less reliable
and bring people into proximity wit hazards. The optimum
strategy is also that which is the cheapest to operate; i.e. it
doesn’t need many people or moving machinery.
Measurement
Our society is fascinated with measurement, and no more so
than within the oil and gas industry and those that regulate it.
But how do you measure inherent safety? It is measuring what
isn’t there; the accident that cannot happen, the plant that
doesn’t corrode, the well that doesn’t need workover. There
have been a number of attempts to measure inherent safety
within the chemical industry (10) and (11). One approach to
measurement might be the comparison of the final result
against the original design. The problem with that is that a true
inherently safer design culture would never have developed
the original design. The existence of an original more
hazardous option is an indication that the process is reactive
and therefore failing.
An alternative approach is being developed at Cranfield
University on behalf of the Health and Safety Executive with
cooperation from UKOOA. This does not examine the design
at all but takes the pulse of the design organisation, both client
and design contractor. It asks the question “is this
organisation capable of delivering inherently safer design?” It
interviews a diagonal slice from project directors to
draughtsmen and from designers to suppliers. It examines 11
different parameters, such as leadership, hazard understanding,
the handling of novel problems and contractual relationships.
It has been trialled several times with promising results. It
ranks the design team with five levels of excellence with the
top three equating to a reactive hazard management, proactive
and truly innovative.
The concept of RISK = (OPEX)2 mentioned earlier (7)
might be another way forward but as yet it is little more than a
concept. It would need significantly greater refinement and
accurate prediction of the lifecycle operating and maintenance
requirements of all subassemblies. However, the greater
emphasis in accurate operating cost predictions in the latest
projects might work well with this idea.
Conclusion
There is a radically different alternative way to achieving a
safe design than the current increasingly complex approaches.
However, it requires a major shift in perceptions of what
constitutes safe design by operators, designers and regulators.
It can only succeed if the whole industry is committed to it.
This commitment must be demonstrated in investment, time
leadership and processes. There will always be the argument
that plants leak so we have to protect against the effects. Let’s
challenge that notion and ask what it would take to build a
plant that didn’t leak, one that could operate on its own and
one that didn’t deteriorate. It is a design culture that moves
from “ I do therefore I comply”, to “I understand , therefore it
is safe” and yet further to “ I think, therefore it is safer”. That
is the new vision of inherently safer design.
References
1. Kletz T.A., A Handbook for Inherently Safer Design; published
by Taylor and Francis 1998
2. Hendershot D.C., “Designing Safety into a Chemical Process”; 5th
Asia Pacific Responsible Care Conference, Shanghai; 1999
3. Cullen W.D., Lees F., Ford M.F., Appleton, B., The Public
Inquiry into the Piper Alpha Disaster; HMSO 1990
4. Dalzell G.A., Chesterman A; “ Nothing, is Safety Critical”
Hazards XIII, Process Safety, The Future; I Chem E; 1997
5. Crawley F., “ALARP – How do we achieve it”; Hazards Forum
Autumn 2003 Newsletter
6. Chia S.,Walshe K., Corpuz E.; Application of an Inherent Safety
Challenge to an Offshore Platform Design for a new Gas Field
Development – Approaches and Experiences”; Hazards XVII
Process Safety – Fulfilling Our Responsibilities; I. Chem E 2003
7. Dalzell G.A., “Is Operating Cost a Direct Measure of Inherent
Safety” T 03054, Journal of Process Safety and Environmental
Protection, Autumn 2003, I. Chem. E.
8. Kletz T. A. “The Constraints on Inherently Safer Design and
Other Innovations”; Process Safety Progress Vol 18, No 1;
Spring 1999
9. Dalzell G. A., Risk Assessment of Hazard Management”; OECD
Workshop on the Education of Engineers in Risk; Montreal
September 2003
10. Khan F.I., Amyotte P.R., “Integrated Inherent Safety Index (I2SI):
A Tool for Inherent Safety Evaluation”; American Institute for
Chemical Engineers; 37th Annual Loss Prevention Symposium;
New Orleans 2003
11. Edwards D.W., Lawrence D., Rushton A.G., “Quantifying the
Inherent Safety of Chemical Process Routes”; 5th World Congress
of Chemical Engineering Vol II; San Diego 1996
12. Sharp J., Strutt J., The Design Capability Maturity Model
Developed for the Health and Safety Executive; Cranfield
University