ALARP Demonstration

for existing offshore facilities- Case study of Panna

Riser

By Samir Thakkar
ATA-Process
28th December 2016
 LEGAL Disclaimer

The following presentation may contain forward-looking statements concerning BG Group

plc’s/Royal Dutch Shell plc’s strategy, operations, financial performance or condition, outlook,
growth opportunities or circumstances in the countries, sectors or markets in which BG
Group plc/Royal Dutch Shell plc operates. By their nature, forward-looking statements
involve uncertainty because they depend on future circumstances, and relate events, not all
of which can be controlled or predicted. Nothing in this presentation should be construed as
a profit and no part of this presentation constitutes or shall be taken to constitute, an
invitation of inducement to invest in BG Group plc/Royal Dutch Shell plc or any other entity,
and must not be relied upon in any way in connection with any investment decision. BG
Groups plc/Royal Dutch Shell plc undertakes no obligation to update any forward-looking
statements. No representation or warranty, express or implied, is or will be made in relation
to the accuracy or completeness of the information in this presentation and no responsibility
or liability is or will be accepted by BG Group plc/Royal Dutch Shell plc or any of its
respective subsidiaries, affiliates and associated companies ( or by any of their respective
officers, employees or agents) in relation to it.

2
AGENDA

What is ALARP?
When the risk is ALARPed
ALARP determining Process
Barriers and ALARP
How to demonstrate ALARP- Case study for Panna pipeline
Conclusion
Q &A

3
 WHAT IS ALARP?
Can we eliminate all Hazards and risks in oil and gas industry?
NO

What we can do to Manage risks?;

 Where reasonably practicable, eliminate hazards or substitute hazards that have lower
risk.
 Identify and implement controls and recovery measures for hazards to reduce the risk to
ALARP.

ALARP is short form of “As Low as Reasonably Practicable”

ALARP is in context of Risk, Risk is reduced to As Law as Reasonably Practicable

OISD Rule-21; Risk Reduction: sub rule (1): Risk to human, assets and the environment
should be reduced to as low as reasonably practical (ALARP) levels.

4
 WHAT IS ALARP? CONTINUE

 Concept of what is reasonably practicable was first considered by the court of appeal in
the UK in the case of Edward vs National Coal Board in 1949

 UK Health and Safety at Work act (1974) includes the general duties on all employers to
reduce risk so far as is Reasonably Practicable.

 The concept of reasonably practicability recognises that absolute safety can not be
guaranteed in some circumstances, and permits the duty holder a defense in law of
choosing not to adopt certain risk reduction measures.

OISD Sub-rule (5): For risk acceptance criteria, established industry guidelines like those of
HSE, UK should be followed

5
ALARP PRINCIPLE-Risk
Tolerability limits
An upper bound above which risks are
deemed to be unacceptable and, save in
exceptional circumstances, must either be
reduced, whatever the cost

A range between the upper and lower bounds

which risks are regarded as being tolerab
provided that they have been reduced to leve
that are as low as reasonably practicable.

A lower bound below which risks are

regarded as being broadly acceptable and
therefore requiring no significant action to
effect further reduction.

6
HEAT MAP

7
 WHEN THE RISK IS ALARP?

‘The point at which the cost (in time, money and effort) of further Risk reduction is
grossly disproportionate to the Risk reduction achieved’.

Risk Reduction
achieved
Cost, Time and
Efforts

Example: To sped $1 Mn to prevent five staff suffering bruised knee is obviously

grossly disproportionate but
To spend $1 Mn to prevent major explosion capable of killing 150 people is
obviously proportionate
8
HOW TO DEMONSTRATE ALARP

Pre- Requisites

• Compliance to local legal requirements to be met

• Good practices must have been applied

• Risk must be in Tolerable criteria (with in Company defined IRPA values)

 HOW TO DEMONSTRATE
ALARP

GUIDING STATEMENTS
 The decision making process to get to ALARP is not a mathematical one. At the end It
depends on subject matter expertise and professional judgment.
 ALARP decision making should be defendable.
 Where implementation of ALARP is a legal requirement ( e.g. in UK) , it is not just about
numbers and complicated risk models. It is about demonstrating that the cost and effort
(time and trouble) of further risk reduction is grossly disproportionate to the risk reduction
achieved.
 ALARP decision making is applicable through the whole life cycle of an asset from
concept to operate phase
 ALARP solutions are dynamic, they change over time with changes in societal
expectations; technology advances, availability and cost.
 ALARP requires documentation of identified risk reduction opportunities through various
safety studies, and appropriate review and closure.
 When balancing cost, judgment should be on what is practicable and not what is
affordable
1
ALARP DETERMINING
PROCESS
ALARP DECISION PROCESS

PMT Joint
Venture
(Operated by ONGC, RIL and BGEPIL
 BARRIERS AND ALARP

 Barrier is common term for threat control, recovery measures and escalation
factor control

 Barrier can be a hardware such as PSV or procedure such as Lock out

procedure
 BARRIERS AND ALARP

 For barrier to be valid and considered in ALARP it should be;

Effective
Verifiable
Independent

 For well understood risks, risk is reduced to ALARP when all barriers are
established by authoritative good practice are implemented and effective

 For novel or less understood risk, good practice is insufficient to establish

number of barriers and detailed analysis and consultation with stakeholder is
required.

 Number of barrier needed to reduce the risk to ALARP depends upon level of
risk
ALARP DEMONSTRATION- CASE STUDY- PANNA
WELLFLUID PIPELINE/RISER
CASE STUDY-
PANNA WELLFLUID PIPELINE/RISER
Phase: Operate phase- Existing facility
Problem: There is no Sub Sea Isolation Valve (SSIV) for incoming well fluid
pipeline at Panna process facility PPA to isolate inventory in case of leak in riser
(splash zone).

How do you demonstrate you’ve managed the risks to ALARP?.

Pre-requisites
Is it a Legal requirement?: NO

Are good practices applied?: YES (e.g. API standards followed, ESDV available on
topside, Pipeline designed as per standards
Risk in tolerable region?: YES (based on Panna complex QRA study)
CASE STUDY: STEP 1

Identify the Hazard: Loss of containment from well fluid risers outboard of SDV (long inventory of pipeline)

Consequences:
• Toxic gas (H2S) exposure to people
• Radiation exposure to people due to fire
• Explosion impact to people VCE

Threats:
• Internal/External corrosion
• Dropped object
• Vessel impact to riser
• Flange leak
• External fire

Credible threats:
• Riser leak due to external corrosion- in splash zone
• Fire impingement from near-by risers
• Internal corrosion in subsea pipeline
• Vessel impact on riser guard

Note: For operating facilities this is already available in safety case document
CASE STUDY: STEP 2

Undertake an assessment of the risks to help you do option selection and

choose the ALARP decision type.

Risk is 5 X B
CASE STUDY: STEP 3

Apply Inherent Safety principles – eliminate the hazard, substitute a lower

risk hazard for a higher one, minimize the magnitude of the hazard and/or
its consequences.

Options-Example

1. Install SSIV in existing pipeline

2. Install additional SDV on top of riser.
3. Install Passive Fire Protection
4. Provide new Temporary refuge (TR) to manage
consequence to people working in platform
Note: Being an operating platform inherent safety options are limited
CASE STUDY: STEP 3
Carry out cost benefit analysis of options;

• Cost of implementing the option is estimated (cost of SSIV/Shutdown cost etc.)

• Benefit of implementing the option is estimated by calculating the loss/damage from an escalated event in case the
modification is not implemented.

Benefit= Remaining asset life x Cost of escalation x Escalation Frequency (per year)

• Net cost of the risk reduction measure is calculated as the difference between the cost of the Option and the benefit from it.

• Cost per averted fatality = Net cost / Averted fatalities

• Cost per life criteria assumed to be ≈23 million GBP (as per UK HSE guideline)

Cost Benefit Analysis (CBA) may be used, with a factor that is appropriate to the burden of proof of disproportion.
For example, if IRPA for a worker is near the threshold of 1x10-3, a risk reduction measure would have to cost more than 10x the
risk cost of accepting the consequences to be considered grossly disproportionate.
 CASE STUDY: STEP 4

Since its an operating facility, opportunity of applying inherent safety principles is lost unless
huge cost, time and efforts are put. The option of SSIV is grossly disproportionate.

You now need to select the decision type to guide you on the work required to demonstrate
that the barriers you put in place are suitable to manage the hazard.
WORKED EXAMPLE:
STEP 4 (CONT…)
In favour Type
of SSIV?
Codes and Codes and Standards do not indicate a decision Yes/No A or B
Standards either way, but refer to engineering judgement
and risk based analysis (BG standard).
Current Practice Current offshore practice varies - it is not No A
common to install SSIV on wellfluid pipelines.

There are known examples in Indian Offshore

where low pressure well fluid pipelines have
NOT been provided SSIV

Engineering The SSIV provide an additional barrier to the Yes/No B

Judgment inventory in the pipeline/ Riser, the base case
should be to install the SSIV based on the
significant reduction in inventory they offer
even though the event frequency and impact
on consequence is not large.

Issues with testing of SSIV and managing it.

Risk Based The installation of SSIV reduces the risk due to No A
Analysis releases upstream of the riser ESDVs. The QRA
work indicates that the benefit is small due both to
Decision type: Type B the low frequency of these events, hence no
change to the immediate effects of such a
as this is departure from release.
Company Values The internal company guidelines - most notably No B
standard good practices the standard requires SSIV to be installed if the
and lessons learned in facility safety case requires this. For Panna this
is not the case.
industry Societal Values Society is unlikely to have or hold definite view N/A A
unless aftermath of any escalation event
WORKED EXAMPLE: STEP 6

Determine all the required barriers- Bow Tie analysis to be used along with
other analysis such as consequence assessment- Dispersion, FERA, EMERA,
QRA etc.

H2S disperses (40 ppm)

after 16 m
WORKED EXAMPLE: STEP 6
Bowtie Diagram Well fluid Riser
PREVENTION
Barriers to eliminate and prevent causes DETECTION, CONTROL, MITIGATION
of hazardous event and EMERGENCY RESPONSE
Barriers to control consequences and effects

Bowtie Diagram PC Wellfluid Riser LOPC Incident

Neoprene
coating PREVENTION DETECTION, CONTROL, MITIGATION
Riser External Barriers to eliminate and prevent causes
and EMERGENCY RESPONSE
of hazardous event
corrosion in Barriers to control consequences and effects

spalsh zone Pigging Explosion

Neoprene
coating
Riser External
Riser corrosion in
Congestion
Design- spalsh zone Pigging /confinement
Explosion
Visual
splash Riser Congestion
Threats, or Causes

Lessons Detection
zone Design- Learned
Ignition /confinement
splash
prevention
Threats, or Causes

zone Ignition
UT UT
prevention

LOPC
Riser Internal LOPC
Release from
Riser Internal corrosion Material Release from
PC Riser
Ignition Fire
spec. Visual ESD
corrosion Material
Pigging
Riser Detection
prevention
Fire
Ignition ESD
spec. prevention
Pigging
Visual
Global
Detection Toxic gas
Pipeline buckling- Bucking
detection
High Temperature Breathing Toxic Effect
apparatus

Global
Over pressure HIPPS
Toxic gas
Pipeline buckling- Bucking
detection
High Temperature SCBA
Toxic Effect

Over pressure HIPPS

CASE STUDY: STEP 6

Look at the overall hazard management strategy.

Use barrier model to see other anomalies which can affect the barrier. E.g. any
safety system bypassed, any thickness reductions?
CASE STUDY: STEP 7

To provide transparency on decision

making, document the process followed
including inputs and your final solution.
In this case you complete an “ALARP
Decision Sheet/or ALARP document”
and place it in the Safety case.
CASE STUDY: STEP 8

 Monitor barriers in operate phase for its integrity. Carry out Annual barrier
verification by third party

 Implement any additional risk reduction measure as part of ALARP

CONCLUSION

 ALARP demonstration is the key Technical Safety activity in offshore

industry as hazard can not be removed

 ALARP decision making is applicable through the whole life cycle of an

asset from concept to operate phase

 During design phase follow Inherent safety principles i.e. Eliminate or

substitute hazard

 For well understood risks in standard situations, the application of

applicable codes and standards together with Good Practice will normally
be sufficient to demonstrate ALARP

 For operating facilities (late life assets) maintaining barrier is the key focus
as implementing any major modification may be grossly disproportionate

 ALARP demonstration forms a central part of safety case

THANK YOU

Q&A