2001/091 OFFSHORE TECHNOLOGY REPORT Inspecting and auditing the management of emergency response
by user
Comments
Transcript
2001/091 OFFSHORE TECHNOLOGY REPORT Inspecting and auditing the management of emergency response
HSE Health & Safety Executive Inspecting and auditing the management of emergency response Prepared by LINK Associates International Ltd for the Health and Safety Executive OFFSHORE TECHNOLOGY REPORT 2001/091 HSE Health & Safety Executive Inspecting and auditing the management of emergency response LINK Associates International Ltd Aspen Drive Derby DE21 7SG United Kingdom HSE BOOKS © Crown copyright 2002 Applications for reproduction should be made in writing to: Copyright Unit, Her Majesty’s Stationery Office, St Clements House, 2-16 Colegate, Norwich NR3 1BQ First published 2002 ISBN 0 7176 2321 1 All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording or otherwise) without the prior written permission of the copyright owner. This report is made available by the Health and Safety Executive as part of a series of reports of work which has been supported by funds provided by the Executive. Neither the Executive, nor the contractors concerned assume any liability for the reports nor do they necessarily reflect the views or policy of the Executive. ii SUMMARY Link Associates International Ltd had prepared this report under contract to the Offshore Safety Division of the Health and Safety Executive. Its primary intended purpose is as a source of information for use by HSE specialist inspection teams when drawing up inspection and audit initiatives in the field of emergency response management. The Report gives background information on the importance of offshore emergency response, on the content of emergency response systems, on the mechanisms established in Great Britain for assessing the emergency command capabilities of offshore managers, and it contains suggestions for the Regulator regarding inspection and auditing. For the purpose of this report an emergency response system is considered to comprise of two parts; emergency command and the remainder of the emergency response system. The report examines the health and safety legal duties applying to these two areas and provides suggestions to the Health and Safety Executive on how it might be involved in influencing and regulating emergency response standards. The report contains detailed information on the Offshore Petroleum Industry Training Organisation (OPITO) Standard for emergency command, and on how the Standard is applied by OPITO approved bodies. It is suggested that this information should be used as a knowledge base to inform and stimulate discussion rather than in direct regulatory interventions. The report concludes that: · emergency response, which forms part of the emergency preparedness of an installation, remains important to offshore health and safety and that it is appropriate for interest in this subject to be continually revitalised; · emergency response systems must reflect the ability of an installation to withstand an emergency, the risks from which are required to be demonstrated ALARP under the safety case assessment and acceptance procedures and, in particular, must reflect the performance standards of the accepted safety case for mustering and the endurance times of egress routes and temporary refuges, and for evacuation and escape. · emergency command capabilities of the offshore management team is at the centre of the emergency response system, and can only be developed and assessed using scenario based training and assessment techniques conducted by expert organisations; · the OPITO Standard on emergency command sets the agreed approach to the training and approved assessment of emergency command for the offshore industry and that the Regulator should continue to work with OPITO on reviewing the Standard and accreditation procedures; · the remainder of the emergency response system can be regulated following the relevant statutory requirements, most of which appear in the Offshore Installations Prevention of Fire end Explosion and Emergency Response Regulations, the Pipelines Safety Regulations and the Offshore Installations Safety Case Regulations. Ideas on how this might be done are included in the report. iii iv CONTENTS Summary Contents 1. Purpose of Report 2. Background to Emergency Response Systems 2.1. Purpose of Offshore Emergency Response Systems 2.2. Legal Requirements 2.3. The Piper Alpha Disaster 3. Emergency Preparedness 3.1. Overview 3.2. Characteristics of an Installation 3.3. Management of Emergency Response System 4. General Principles of Inspection and Audit 5. Inspection and Audit of Emergency Command Capabilities 5.1. Questions for the Regulator 6. Inspection and Audit of the Remainder of the Emergency Response System 6.1. Emergency Response Plan 6.2. Detection of Incidents 6.3. Communication and Alarms 6.4. Mustering 6.5. Drills and Exercises 6.6. Information to Personnel-The Station Bill 6.7. Facilities Check List 7. Inspection and Audit of Emergency Response Hardware 7.1. General 7.2. Helideck Emergencies 7.3. Additional Background Information 8. Conclusions page iii page v page 1 page 2 page 2 page 2 page 3 page 5 page 5 page 5 page 6 page 9 page 10 page 10 Appendix 1 – OPITO Emergency Response Standards · OPITO · Emergency Control Standard · Standard for those having Specialist Responsibilities · Standard for those having no Specialist Responsibilities Appendix 2 – Arrangements in the Offshore Industry for Assessing Emergency Command Capabilities · Importance of Command Capabilities · Coaching and Assessing Emergency Command Capabilities Appendix 3 – Implementation of the OPITO Standard · Principles of Scenario Based Assessments · Selecting Scenarios · Component Analysis page 26 page 26 page 26 page 27 page 28 page 29 page 29 page 29 page 31 page 31 page 31 page 36 Annex A – Generic Check List for the Assessment of Command Capabilities Annex B – Components of Emergency Response Systems Annex C – Overarching Emergency Response Prompt Sheet Annex D – Typical Emergency Procedures Prompt Sheet Annex E – Drills and Exercises Prompt Sheet Annex F – Station Bill Prompt Sheet page 38 page 46 page 48 page 49 page 50 page 51 v page13 page 13 page 19 page 19 page 20 page 21 page 21 page 22 page 23 page 23 page 24 page 24 page 25 Annex G - Generic Check List for the Inspection and Audit of Emergency Response Hardware and Software Annex H – Typical Emergency Response Facilities for Platform Evacuation Annex I – Facility Considerations During Emergencies Bibliography Glossary vi page 52 page 57 page 58 page 61 page 63 1. PURPOSE OF REPORT This report provides background information and practical help to the Regulator on the inspection and audit of emergency response arrangements for offshore installations. Although a matter for the Regulator, it is intended that the Report or parts of the Report should be used mainly by specialist groups within the Offshore Division of HSE to devise guidance to inspectors for use in general inspection and in targeted initiatives directed at emergency response management. Emergency response forms that part of the emergency preparedness of an offshore installation that comes into play once an emergency has occurred and contributes to reducing risks to ALARP. The other part of emergency preparedness relates to the characteristics of an installation in respect of its ability to militate against initiating events, to detect potential and actual emergency situations and to withstand an emergency should such an event occur and which have to be demonstrated to be ALARP under the safety case assessment and acceptance procedures. Although this report is concerned with the first of these parts, the characteristics associated with the second influences the starting parameters and the performance standards that have to be achieved by the emergency response arrangements. For convenience of analysis and action, it is normal to consider the management of emergency response under two headings. First, there are the overarching command and control capabilities of those charged with the management of emergencies and, second there are all the other issues of competence, hardware and external support arrangements that form vital parts of the system. The report aims to address all of these matters but special attention is given to providing information on how the Regulator might be involved in appraising the coaching and assessment of emergency command capabilities by approved bodies to the OPITO Standard. The report is for use by the Regulator but will be of interest to duty holders and those supplying expert advice and assessment capabilities to the offshore industry. It has been prepared by Link Associates International Ltd under contract to the Offshore Safety Division of the Health and Safety Executive. It does not contain all the information and knowledge deployed by Link Associates International Ltd when carrying out appraisal of emergency response capabilities of offshore installations. Nor does it contain all the information required to successfully assess every facet of an emergency response system since, in general, the knowledge, experience and time resource required for undertaking such assessments would go beyond what the Regulator might elect to support. But the report does aim to provide the Regulator with sufficient information to enable judgements to be reached by inspectors on whether or not satisfactory standards of emergency response are being achieved by offshore duty holders. Although the report is aimed at the management of emergency response for offshore installations in British waters, it is based on the worldwide in depth and diverse experiences of the staff of Link Associates International in the fields of providing expert consultancy, training and assessment services to a wide range of on shore and offshore industries. 1 2. BACKGROUND TO THE MANAGEMENT OF EMERGENCY RESPONSE 2.1. PURPOSE OF OFFSHORE EMERGENCY RESPONSE SYSTEMS The objective of the management of emergency response is to safeguard the health and safety of persons on or near an installation in the event of an emergency. Such management systems ensure that offshore installations are prepared for any emergency that might arise and help contain and control such events to safeguard persons who might be affected and to minimise damage. The systems form part of the ‘protection in depth’ philosophy applied to safeguarding against risks to persons from activities associated with the exploration and production of sub-sea hydrocarbons. Offshore emergency response systems are primarily aimed at dealing with the immediate aftermath of a low frequency event that has either escalated or has the potential to escalate into a major accident or environmental incident but such systems have relevance to other unexpected events that might affect only one or a small number of persons, for example, a man overboard situation. Emergency response systems are not concerned with control over initiating events and are only concerned with the control over escalation to the extent that is necessary to facilitate the evacuation, escape and rescue of persons. Other hazard management mechanisms forming part of an installation’s safety management system deal with the management of risks falling outside of the scope of emergency response systems. In short emergency response systems are concerned with managing emergencies, not preventing emergencies from occurring. 2.2. LEGAL REQUIREMENTS APPLYING TO EMERGENCY RESPONSE IN THE OFFSHORE INDUSTRY Emergency response systems are addressed in the Offshore Installations (Safety Case) Regulations (SCR), more specifically, in the Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations (PFEER), and in the Pipelines Safety Regulations (PSR). SCR requires duty holders to include in design and operational safety cases particulars relating to the protection of persons for as long as they need to remain on an installation following an emergency against the hazards of explosion, fire, heat, and toxic gas or fumes. These particulars include the provision of temporary refuge, evacuation routes, the means of evacuation and escape, and the facilities in the temporary refuge for monitoring and control of the incident and for organising evacuation. In addition, there are requirements relating to the establishing performance standards for the minimum period for which the provisions are to be effective following an emergency and for a demonstration, using suitable and sufficient quantified risk assessments that the risks are being controlled to the lowest level that is reasonably practicable. Most of these considerations are outwith the scope of this report and will already have been assessed by the Regulator as part of the safety case acceptance procedures. But the performance standards for the capabilities of temporary refuges, escape routes, means of evacuation and escape and the control and monitoring facilities are important inputs to the preparation of an emergency response system that need to be taken into account. PFEER also has requirements relating to the characteristics of an installation to prevent, detect and withstand emergencies arising out of fire and explosion hazards. Again, these form part of the overall emergency preparedness of an installation but mainly fall outside the scope of this report. This report is concerned with those parts of PFEER that require duty holders to prepare for emergencies by having a competent command structure, sufficient competent persons for emergency duties, to provide adequate training and instruction, to have emergency response plans, which are tested and practiced as often as appropriate, and the provision and maintenance 2 of emergency plant and equipment. These requirements embrace the concepts of critical individuals being competent at command and control and the provision of adequate training, including command training. PSR applies both on shore and offshore and include provisions requiring operators of major hazard pipelines to have in place emergency procedures and emergency plans. Pipelines and emergency shut down valves connected to, and that are within 500 metres of an offshore installation are deemed to be part of that installation. Therefore, there is overlap between PFEER and PSR in respect of emergency response duties. But an installation duty holder and pipeline operator for pipelines within the 500 metre zone are usually the same, and control over pipeline emergency shut down valves, whether located on an installation or sub-sea within the 500 metre zone are installation controlled. The physical demarcation of responsibilities between installation and pipeline duty holders is usually remote from the installation but this is not always the case; for example, a loading pipeline for a floating storage vessel. Putting aside these considerations of overlaps and the location of duty interfaces, it is indisputable that the fluid in major hazard pipelines connects the emergency response system for an offshore installation to that for any connected major hazard pipeline. This needs to be taken into account in the respective emergency response plans, which need to be compatible and include communication arrangements. Notwithstanding these legal requirements, history shows that for all industries, as the length of time from the last major accident increases so does the propensity to allow slippage to occur in the importance afforded to the maintenance, development, testing and assessment of emergency response systems. This is equally true for the offshore industry. In short, the temptation to be simplistic and superficial in verifying emergency response systems may become the norm. This is understandable as the offshore industry rightly moves its attention towards concentrating on the elimination of disaster initiating events rather than on dealing with the consequences of an escalating disaster scenario. But emergency response is too important to be neglected, both aspects are equal imperatives. The time is right to heighten the interest of duty holders and the regulator in ensuring progressive improvement in the well being of the emergency response capabilities of offshore installations. This report aspires to stimulate this heightened interest. 2.3. THE PIPER ALPHA DISASTER It is worth briefly reflecting on what Lord Cullen stated in his report into the Piper Alpha disaster. The immediate cause was a breakdown in the permit to work system. This led to the use of machinery that was undergoing maintenance, which in turn caused the escape of condensate from an insecurely fastened temporary blank flange. Thereafter, there was a series of misjudgements that contributed heavily to the scale of the loss of life. Many of the men on board were unfamiliar with the layout of the installation and had not been properly trained or practised in emergency procedures. Those in the accommodation block were encouraged to stay put by the Offshore Installation Manager [OIM] to await rescue. Yet, as the Cullen Report makes clear, to remain there meant certain death. Lord Cullen was critical of the OIM who died in the disaster, for not exercising effective command as the disaster developed. It was argued that many of those lost could have been saved if the OIM had been more decisive. However, Brian Appleton, one of the two technical assessors who assisted Lord Cullen is on record as saying that he did not blame the OIM for these failings since he had been given no training in emergency command and that the installation emergency command capabilities had not been subject to realistic test, development or assessment. This was a very telling observation, the effect of which appears to have been diluted with the passage of time since the Piper Alpha disaster. There are many other examples where decisions taken by management under pressure, time constraints and conditions of isolation at the time of a developing disaster could, if taken more competently, have resulted in much improved outcomes. 3 As a consequence of the concerns over emergency command capabilities, Lord Cullen recommended that a duty holder’s formal emergency command organisation, together with the criteria used for assessing the command ability of OIMs, should form part of the safety management system for the installation, and that there should be a system of exercises that provide opportunities to practice decision making in an emergency. In addition, amongst other things, Lord Cullen recommended that duty holders should be required to submit to the Regulator an evacuation, escape and rescue analysis for each installation. These requirements are embodied in the Offshore Installations (Safety Case) Regulations. 4 3. EMERGENCY PREPAREDNESS 3.1. OVERVIEW The emergency preparedness of an offshore installation is a combination two interdependent factors. These are: · the characteristics of an installation that influence emergencies; · the pre-arranged emergency response system that becomes operative in the event of an emergency and which deals with the management and the provision of plant and equipment to facilitate the evacuation, escape, rescue and recovery of persons following an emergency. 3.2. THE CHARACTERISTICS OF AN INSTALLATION In respect of emergency preparedness, the characteristics of an offshore installation determine the likelihood of an emergency arising, the existence and capability of systems to detect emergencies, and the ability of an installation to withstand an emergency for the period of time required to effect the evacuation and escape of all persons. Under the provisions of SCR, duty holders submitting design and operational safety cases are required to demonstrate that all major accident risks are being controlled to the lowest reasonably practicable level and are required to include in design and operational safety cases, amongst other things, particulars of: · wells and well control arrangements; · connected pipelines and associated safety systems; · detection systems for flammable or toxic gases and fires; · plant and arrangements for the prevention and mitigation of fires; · the arrangements for protecting persons from explosions, fire, heat, smoke, and toxic gas or fumes following an emergency until such time as they can be evacuated or escape from the installation; · the provision of temporary refuge that remains effective for the period following an incident until such time that persons can be evacuated; · safe escape routes to temporary refuges and from the refuges to the evacuation points; · safe means of evacuation; · means within the temporary refuge for the control and monitoring of an emergency, and for organising evacuation. In addition, SCR requires duty holders to establish performance standards for the arrangements to protect persons against explosions, fire, heat, smoke, and toxic gases or fumes, and for temporary refuges, escape routes, means of evacuation. PFEER also has provisions on prevention of fire and explosion, detection of incidents and mitigation of fire and explosion. 5 These characteristics of an installation are considered as part of the Regulator’s procedures for assessing and accepting or otherwise safety cases and are not part of the emergency response system for an installation since such systems come into play once an emergency has commenced. However, the characteristics, and particularly the performance standards, are very important parameters effecting the preparation of an emergency response plan. For example, the muster times in an emergency response plan have to be compatible with the performance standards for the endurance times of the escape routes; the evacuation and escape times from the temporary refuge have to be compatible with the performance standards for the endurance time of the temporary refuge; etc. In other words, the characteristics of an installation are relevant inputs to the preparation of an emergency response system but the underlining analysis of the worth or otherwise of these characteristics is outwith the scope of this report which is concerned with the inspection and audit of the management of emergency response. 3.3. THE MANAGEMENT OF EMERGENCY RESPONSE An emergency response system is the second part of the emergency preparedness of an offshore installation. It is concerned with being prepared for the management of the situation and the provision of plant and equipment to safeguard persons on or near an offshore installation once an emergency has arisen. The main elements of an emergency response system for an offshore installation are listed below. · Identification of Reasonably Foreseeable Emergencies. Prior to any emergency, all reasonably foreseeable emergencies should have been identified but it should always be remembered that the emergency system might well have to deal with a situation that was not previously envisaged. The principle to be followed is that of maximum preparedness for all reasonably foreseeable emergencies. This can be best achieved by identifying reasonably foreseeable emergencies and then ensuring that these are covered by the emergency plans, and by the emergency exercise and drill programmes for the installation. The starting point for identifying possible emergencies should be the risk assessment section of the safety case for the installation and the assessment carried out in pursuance of Regulation 5 of PFEER. Amongst other things, the latter requires duty holders to identify the events which could give rise to the need for evacuation, escape or rescue, and requires performance standards to be established for these measures. But risk and the need for evacuation, escape or rescue should not be the only determinants of whether or not a hazard is addressed in the emergency plan. The plan should address all reasonably foreseeable emergencies including those of a low probability. There will be some emergencies that fall outside of the five defined major accident categories listed in the Offshore Installations (Safety Case) Regulations that also need to be considered. These might include a helicopter ditching into the sea, a man overboard, an incident on a neighbouring offshore installation, a major pollution incident etc. · The Emergency Response Plan. This details the organisation and arrangements for handling any emergency including who does what and the procedures to be followed in different circumstances. Guidance on the content of emergency response plans can be found in the UKOOA publication ‘Guidelines for the Management of Emergency Response for Offshore Installations’. This document contains high-level guidance applicable to all circumstances. Understandably it lacks practical details applicable to the varying offshore situations. It was finalised after close consultation and involvement with the Regulator. · Arrangements for Monitoring the POB. Monitoring the POB and keeping the personal details of all the persons on an offshore installation is a requirement of the Offshore Installations (Management and Administration) Regulations. 6 · Command Structure. The command structure should be clearly established and should take into account the selection criteria, training and development of plans and assessments for persons occupying emergency command and other critical posts. This should cover the arrangements for persons to deputise in the event of the unavailability of any critical post holder. The critical command and control posts should include: o an on shore emergency support manager; o an offshore site main controller (the offshore installation manager); o an offshore operations coordinator installation manager or equivalent); o offshore fire team leaders/on site controllers; o an offshore muster coordinator; o offshore muster checkers. (the deputy offshore · Competence of Personnel in Emergency Response. The role, leadership, training and competence assurance arrangements for the emergency management team and the emergency support teams such as the medical team, the fire fighting/emergency response teams, the helideck team, the radio operator, the control room operator, the lifeboat coxswains, the muster checkers, the muster coordinator etc should be specified. · Incident Detection. Duty holders should provide detection systems for emergencies such as a fire and gas system; hydrogen sulphide monitoring; carbon monoxide monitoring; loss of HVAC facilities; loss of power; an impending ship collision, instructions to persons of reporting emergencies detected by the eye, nose or ear such as hydrocarbon or other fluid releases, smoke, fire, a man overboard etc; flare or vent stack irregularities; etc. PFEER Regulation 10 and the Schedules to SCR dealing with the particulars to be included in design and operational safety cases are relevant. · Raising the Alarm. The installation should be equipped with a general platform alarm system and broadcast communication system complying with Regulation 11 of PFEER. · Communication Systems. Communication systems including internal systems and external marine and helicopter band radios, external satellite telephone system, VHF radios, installation telephones, status lights etc, should be provided. PFEER Regulation 11 is relevant. · Muster Arrangements. Regulation 14 of PFEER addresses mustering of persons. These requirements are a central part of an emergency response system and not only include accounting for all persons on an installation but also the very important issues of the provision of safe muster areas, safe routes to these areas from working places and the accommodation, and safe routes from the muster areas to the evacuation points. 7 · Assessment. Once an emergency has been detected, a platform general alarm sounded and all persons have commenced mustering, the emergency command team have to collate all the available information to make a competent assessment of the situation to facilitate and decide on the appropriate response. · Evacuation. Evacuation means leaving an installation without entering the sea. Safe evacuation, as far as is reasonably practicable, is a requirement of Regulation 15 of PFEER. The associated approved code of practice states that preferred means of evacuation should be the normal means of getting persons to and from an installation. This would usually be by helicopter. In addition, an alternative means should be provided which would normally be by a TEMPSC. But in certain circumstances it might not be reasonably practicable to provide two methods of evacuation, for example, on small normally unattended installations where the risks in providing and maintaining a TEMPSC would outweigh the risks of not providing a TEMPSC or for divers in hyperbaric chambers. · Escape. Regulation 16 of PFEER addresses means of escape. Means of escape is the method of leaving an installation when the evacuation systems have failed. Escape systems include hardware such as escape routes, life rafts, escape systems to the sea, immersion suits and other personal protective equipment usually associated with a grab bag etc. · Rescue and Recovery. Rescue and recovery are addressed in Regulation 17 of PFEER. For persons who are evacuated or who escape to the sea from an installation or who are near an installation, the emergency response system must provide a good prospect of recovery, rescue and being taken to a place of safety. · Familiarisation. All persons on an offshore installation must be familiar with the emergency arrangements and of what would be expected of them should an emergency arise. · Exercises and Drills. All persons on an offshore installation should be provided with sufficient emergency response training and assessment proportional to their emergency responsibilities. These arrangements should include familiarisation exercises, drills and professionally organised scenario based testing and performance assessment of the whole emergency response system. These elements are shown in a functional form at Annex B (page 46). Examples of the hardware and software associated with each main functional component are included. 8 4. GENERAL PRINCIPLES OF INSPECTION AND AUDIT Inspection and audit are ubiquitous words that are used in many different contexts. In respect of regulatory interventions, over a period of time particular meanings have been accepted for these words and it is these meanings that are being explained in this Chapter. Neither inspection nor audit represents complete coverage of the situation or activities being appraised. Both are sampling techniques aimed at gaining an overall impression of the acceptability or otherwise of whatever is being scrutinised. Audit is more thorough, focused and time consuming than inspection. Regulatory inspection and audit is an activity carried out on behalf of society and other more direct stakeholders to assess and influence standards of health, safety and welfare, and to take proportional enforcement action if legal contraventions are discovered. In the field of emergency preparedness, regulatory inspection and audit is different to the activities undertaken by duty holders to ensure that their emergency response capabilities meet their legal duties and company policies. But there is a distinction to be made between regulatory inspection and audit. Inspection is a more limited exercise than audit. It involves an informed person, but not necessarily a specialist, taking a relatively limited look at a situation and then using the outcomes to determine whether or not there is sufficient concern to warrant a more detailed look at any of the hardware or activities that has been the subject of the inspection. Although the worth of the systems being inspected would be considered, there would be a distinct tendency towards testing that the systems were properly understood and competently implemented. Whereas for auditing the approach would be more systematic, would be conducted with increased resources and expertise and would question the value of the systems as well as witnessing the end to end application of the system. But there is no clear point where inspection stops and auditing starts. 9 5. INSPECTION AND AUDIT OF THE COMMAND AND CONTROL ASPECTS OF EMERGENCY RESPONSE SYSTEMS 5.1. QUESTIONS FOR REGULATORS RELATING TO EMERGENCY COMMAND The legal basis for inspection or audit of the command capabilities of offshore installation management teams lies in Regulation 6 of PFEER. In paraphrase, this requires duty holders to prepare for emergencies by ensuring: · competent offshore emergency command; · sufficient competent persons offshore to deal with any emergency; · for manned installations, a helicopter landing officer and helideck crew; · the names of the persons fulfilling the above tasks to be posted at suitable locations on the installation; · the provision of adequate training for every person on the action to take in an emergency, and access for every person to information on emergency plant. In relation to the emergency command capabilities of offshore management teams, regulatory inspectors should pursue three direct lines of inquiry. First, questions should be asked about the policy of the duty holder towards ensuring emergency command competencies of its offshore management teams. Inspectors should verify that the offshore installation managers and deputies have successfully attended OPITO approved offshore installation managers’ emergency command training and assessment courses with the appropriate endorsements for the installation concerned. If the answer to these questions were to indicate that some or all of the installation managers or deputies have not been trained and successfully assessed then this would appear to be a contravention of Regulation 6 of PFEER. OPITO has been appointed by the Government to be the National Training Organisation for the upstream petroleum industry and, amongst other things, sets the training standards and arrangements for offshore emergency response. More information on the role of OPITO appears in Appendices 1, 2 and 3 of this Report (pages 26 to 37). Second, questions should be asked about how long ago was the training and assessment undertaken and about the duty holders policy on the frequency of refresher training. If the answer to these questions indicate that refresher training has not been undertaken within three years of the last emergency command and control training then this, although more judgemental, also could be viewed as contravening Regulation 6 of PFEER. The importance of offshore installation managers and their deputies periodically practicing and progressively improving their command and control skills cannot be over emphasised. Without the use of professionally run and assessed emergency exercises based on realistic scenarios, coupled with appropriate coaching, it is the view of Link Associates International that there cannot be any confidence in the ability to cope in the event of a real emergency. Simplistic drills should be run on a regular basis. They are a useful means of keeping offshore personnel familiar with some aspects of the emergency procedures but are no substitute for the periodic testing and enhancement of the command capabilities of the management. A reasonable frequency for this in depth practising of the command system would be once every three years. Third, questions should be asked of duty holders to test whether or not they are setting the approved assessment of command capabilities in the wider context of selecting suitable persons 10 for offshore management posts. The ability to exercise command in emergencies is an important attribute for an offshore installation manager but there are also other essential health and safety requirements. These include offshore experience, career profile, track record in engineering management, technical qualifications, maturity and knowledge of the installation. Inspectors should pursue the familiarity of the offshore emergency management team with the layout of the installation, the characteristics of the wells and process plant, the emergency response procedures and hardware, the capabilities of the emergency support teams etc. For example, what happens to the process plant in the event of any one of the various levels of process plant trips occurring; what happens to the hydrocarbon inventories in the various sets of circumstances. This is a highly judgemental area for the Regulator and care needs to be taken not to reach firm conclusions on weak evidence. During routine offshore visits or as part of a campaign, inspectors should show an interest in emergency command competencies and the experience of offshore installation managers and their deputies when undertaking command training and assessment. Enquiries could be made into how confident such individuals are of their ability to react satisfactorily. Undoubtedly this would stimulate a wider discussion that in turn would reinforce the demonstration of the Regulator’s interest in emergency preparedness. Inspectors would be wise to avoid the temptation to get directly involved in reaching judgements on the quality of the emergency command training and assessment provided to individuals by an OPITO approved body. It should be sufficient to know that the approved arrangements have been followed. OPITO has its own mechanism for ensuring that organisations that have been approved maintain standards of training and assessment and is itself is subject to periodic Government assessments in order to retain its National Training Organisation this status. But it would be valuable and influential for inspectors and more senior managers from the Regulatory body to demonstrate support for this process by, from time to time, witnessing emergency command training and assessment taking place, either on site or at a simulator. Apart from the specialist knowledge and skills required to assess scenario based command training and assessment that are already in place, arrangements to ensure the quality of this training and assessment, the amount of time and other resources that would be involved for the Regulator, would be prohibitive if it were to engage in a meaningful way with this work. Typically it takes around five days to complete a training and assessment course. Notwithstanding the recommendation for caution above in respect of inspectors getting involved in inspecting scenario based command assessments for offshore installations, managers and their deputies and inspectors should be aware of the techniques and assessment criteria used in these processes. They would then be able to enter into wider conversations and be able to set the approved training and assessment in context from a standpoint of knowledge. Amongst other things, the assessment process for offshore installation managers and their deputies addresses the question of leadership skills. Inspectors should talk about the issues surrounding leadership without being too authoritative. The two most common leadership patterns are first, the autocratic leader where there is propensity to centralise authority and rely on command and coercive power to control subordinates, and second, democratic leadership where authority but not responsibility is delegated to others, participation in decision making is encouraged and leadership skills play a big part in maintaining the power to give influence to subordinates and others. Of course, in reality there is a blurring between the two styles of leadership and in one organisation it is sensible to change from one to the other according to the situation being addressed. For example, on an offshore installation the democratic style would be best suited for every day management but for an emergency situation, the command and control ethos of the autocratic style will have some part to play. 11 But the most fruitful line of influence for the Regulator in the detail of emergency command is through the OPITO standard making and associated approval processes. This is what actually happens at the moment. Through this route, combined with regulatory action to ensure that the Standard and approved assessments are being used and applied by offshore installation duty holders, it should be possible for the Regulator to exert maximum influence on offshore emergency command capabilities. For example, if the Regulator were to be of the view that the present approved standard ‘OIM Controlling Emergencies’ and the associated approval process is in need of revision, partly to incorporate the concepts of component assessment etc referred to in Appendix 3 (page 31) of this Report, then the Regulator should raise this matter through its representative on the OPITO training Standards Committee. Information on OPITO Emergency Response Standards, the arrangements for assessing emergency command capabilities in the offshore industry and the use of scenario based training and assessment for offshore managers is given in Appendix 1 to 3 of this Report (pages 26 to 37). A generic check list for the assessment of offshore command capabilities appears in Annex A (page 38). The non-command aspects of Regulation 6 of PFEER are dealt with in Chapter 7 of this report (page 23). 12 6. INSPECTION AND AUDIT OF THE REMAINDER OF THE EMERGENCY RESPONSE SYSTEM 6.1. THE EMERGENCY RESPONSE PLAN 6.1.1. Meaning of an Emergency Response Plan When inspecting the remainder of an emergency response system for an offshore installation, the natural starting point is the emergency response plan. Regulation 8 of PFEER effectively defines the emergency response plan as a document setting out the organisation, arrangements and procedures for use in an emergency. This is a narrower definition than might be expected. The plan has to be prepared in consultation with all who are likely to be involved in its implementation, including persons external to the installation such as the Coastguard, and to give guidance on the organisation and arrangements, and the procedures to be followed in the event of an emergency. Regulation 8 also requires the plan to be made available to all persons on an installation and that those who are required to assist in its implementation are informed of the content of the plan that is relevant to them. And finally, Regulation 8 requires that the organisation, arrangements and procedures forming the plan be tested as often as is appropriate. This will be referred to later. 6.1.2. Relationship between the Emergency Response Plan and the Safety Case A major input to the preparation of an emergency response plan should be the characteristics of an installation in relation to the ability to be able prevent, detect and to withstand an emergency. These issues are required to be addressed in the design or operational safety case for an installation and are considered by the Regulator as part of the safety case assessment and acceptance procedures. Safety cases are required to demonstrate that all major accident risks are being controlled to the lowest reasonably practicable level and are required to contain performance standards for the measures taken to safeguard persons against explosions, fires, heat, smoke and toxic gases or fumes. In addition, performance standards are required for temporary refuges, egress routes to temporary refuges and from temporary refuges to the evacuation or escape points, the means of evacuation or escape, and the facilities in temporary refuges for monitoring and control of emergencies and for organising evacuation and escape. Clearly, these performance standards set the standards that must be achieved by the emergency response plan for the mustering, evacuation and escape. Inspectors should look for strong links between installation safety cases and emergency response plans. Inspectors should compare safety case endurance times for escape routes and temporary refuges and the times for muster, evacuation and escape with what appears in the emergency response plan and, where appropriate, with the achievements in drills and exercises. Any discrepancies in which the emergency response plan or the outcomes of drills or exercises exceeds the safety case performance standards should be pursued. 6.1.3. Structure of the Emergency Response Plan The structure of an emergency response plan will reflect the type of installation and the range of hazards. There is no one correct structure but whatever structure is adopted, the result should provide a concise source of information that would be readily accessible and retrievable in the event of an emergency. A typical structure for a large production installation would be an over arching document dealing with the detection of an emergency, communicating the emergency to all persons offshore, the mustering arrangements and the on going management of the emergency. This over arching plan would be supported by a second tier of documentation would deal with the plan and procedures for dealing with the different types of reasonably foreseeable emergencies. 13 6.1.4. Consultation on the Emergency Response Plan Regulation 8 of PFEER, amongst other things, requires a duty holder to consult on the emergency response plan with persons who are likely to be involved in responding to an emergency. This effectively means consultation with every person on an installation and with those external to the installation that might be involved in providing assistance in the event of an emergency. These would include, as appropriate, HM Coastguard, helicopter provider, standby vessel provider, supply boat provider, operators of any connected pipelines, neighbouring installations, on shore medical services, police etc. 6.1.5. Behavioural Issues The success or otherwise of involving people in a consultation exercise on emergency response is dependent on the safety culture on the installation. Inspectors should consider the safety culture that exists on the installation with a view to assessing if this is conducive to the total ownership of the emergency response system by all persons offshore. Culture is difficult to define but it embraces such issues as organisational structure, the degrees of recognition given to each level of management or individuals, the values and respect attached to individuals, the degree of reliance on individual competencies and motivations, whether or not an organisation is an open and listening organisation, etc. All of these factors have influence on health and safety in the workplace but are particularly relevant in the event of an emergency. Closely linked to the cultural issue is the extent of team working on an installation. There are four main reasons for promoting team work, all of which align well with the natural human trait of feeling comfortable when brigaded together rather than standing alone. First, a group approach is necessary because of the complexity of the problems being faced that require a range of knowledge and skills wider than that possessed by any individual and a level of activity that goes beyond that of an individual. Second, a high degree of cooperation is required over interrelated and overlapping tasks. Third, each member of the team will develop ownership of the whole and will be better placed to assess the impact of narrow contributions and decision on the well being of the whole. Fourth, the mutual support that arises out of teamwork achieves a sense of belonging that enables the team to achieve much more than would be possible from a summation of the individual efforts and is of particular relevance to the offshore industry where the workforce lives remote from home and away from the normal social support systems. These factors are important at all times but are vital in the event of an emergency. Inspectors should talk around these issues when offshore and attempt to reach judgements on the degree and success of team working on the installation. Feedback to duty holders and the offshore workforce should be given in a manner that encourages and strengthens teamwork. 6.1.6. Main Elements of an Emergency Plan The main elements of a plan are listed below. However, it should be remembered that Regulation 8 of PFEER and the associated ACOP, both of which deal with emergency response plans, are drafted in very general terms and that it would therefore be wrong to conclude that an omission from the list automatically meant that the installation concerned was in contravention of the law. The principle of proportionality needs to be applied since there may be a very good reason for an installation not addressing the whole of the list. Inspectors should look at the installation emergency response plan to see if there are any omissions. · Give an emergency response philosophy. · Take account of the installation safety case including the performance standards that define the starting point for the emergency response system and that establish the endurance, evacuation, escape and rescue times that the emergency response system must meet. 14 · Define roles and responsibilities of personnel. · Provide clear directives. · Identify and detail specific emergency procedures. · Provide a definition of a major incident. · Describe the communication facilities. · Describe the emergency response organisation. · Describe the mustering arrangements. · Detail the reporting and notification requirements. · List the emergency facilities. · Contain an emergency contact list. · Contain proformas for emergency public address announcements. · Meet the relevant legislative requirements. · State the arrangements for making all offshore personnel familiar with the part of the plan relevant to them. · Specify the type and frequency of the training, tests, and practises necessary to ensure and maintain competence. · Describe the mechanisms for judging the results of tests and practises against performance standards and for taking action to address any weaknesses. 6.1.7. Command Structure Offshore installations come in a variety of types, shapes and sizes covering small fixed normally unattended production installations, large attended fixed production installations, floating production installations, floating storage units, jack up drilling installations, jack up accommodation installations, semi-sub drilling installations etc. Notwithstanding the wide variations in the hazards associated with the different types of installations and the wide variation in the management structures and number of persons typically on an installation type, the emergency organisation should contain a command structure that embraces the following posts. · Emergency support manager. This is an on shore post. The post holder has to be available for 24 hours each day on every day. The person or persons involved should be sufficiently familiar with offshore hazards and activities, and have the necessary authority within the duty holder’s structure to carry out these functions. At the time of an emergency, the remoteness of this person from the scene of the emergency limits immediate involvement. But this person should act to reduce the communication load on the offshore emergency command team and should provide a coordinating role with the Coastguard, helicopter operators, standby ship and supply ship companies operating in the area, companies operating neighbouring 15 installations, with the police, the Regulator, the media, the relatives of persons working offshore, etc. Support for this person would come from the wider technical and managerial capabilities within the duty holder’s structure and, if appropriate, from outside of the duty holder. Inspectors should determine the identity of the emergency support managers and the arrangements that that have been made to fulfil the roles described above. The emergency response system for a particular installation will be set out in some detail in the safety case. Inspectors should familiarise themselves with the relevant part of the safety case and then enquire of the general approach to emergency response being followed by the duty holder. Any discrepancies with the safety case should be pursued. These enquiries should extend to the competency of the management team, those having specialist emergency response duties, and all offshore personnel in respect of dealing with emergencies. From the narrow standpoint of the Regulator, one of the roles of the emergency support manager would be to oversee the arrangements for making the statutory notifications of reportable accidents, dangerous occurrences and reportable incidents of ill health and enquiries should be made about these arrangements. Inspectors should satisfy themselves that these arrangements are workable. · Offshore Installation Manager or Site Main Controller. This is the person in overall command in the event of an emergency arising and is the leader of the offshore emergency team. It is this person that directs the management of the emergency but the situation can be more complicated when combined operations are taking place when there will be two offshore installation managers. In this case the nature of the incident will dictate which manager takes command. For example, for a combined operation between a drilling installation and a production installation, the manager of the drill rig would take command for a well control incident involving the well being worked; for a production incident, the manager of the production installation would take command. But there will be envisaged emergencies where natural divisions of responsibility are much more blurred. There should be a clear written understanding between the parties on these matters. Where there is a Combined Operations Safety Case, this should address the division of responsibilities although detail might be in a separate reference. The site main controller leads the offshore emergency management team and is responsible for making initial and ongoing assessments, taking an overview of the emergency and how it might develop, managing the flow of information, making decisions in consultation with others, directing activities, directing the use of the resources, supporting the leaders of the emergency specialist teams, communicating with all the offshore personnel, communicating and liaison with external bodies, and providing the emergency support manager with sufficient information. One of the early tasks is establishing the status of the escape routes. Inspectors should enquire of designated site main controllers to test whether or not they are clear about their roles, how they would undertake their duties in the event of an emergency and, in the case of combined operations, are the two managers involved clear about the scope of their respective responsibilities in the event of an emergency arising. Inspectors should also enquire when the persons involved last undertook OPITO approved training and assessment for emergency command. · Deputy Offshore Installation Manager or Equivalent or Operations Coordinator. On a drilling installation the equivalent person might be the Barge 16 Master or Senior Tool Pusher. On a floating production or storage unit the equivalent might be the Chief Mate. This person assists in managing an emergency and should be capable of acting as the site main controller in the event of the installation manager not being available for whatever reason. This person will form the main communication link between the fire team leader/on site controller and the emergency management team. The role needs to be undertaken by a technically competent person capable of précising complex issues into simple language and knowing the source of additional technical information should that be required either by the emergency management team or the fire team leader/emergency response on site controller. Inspectors should enquire of designated operations coordinators whether or not they are clear about their roles, how they handle information overload, whether they would be comfortable operating as the site main controller in the event of the installation manager not being available etc. Again, inspectors should also enquire when the operations coordinators last undertook OPITO approved training and assessment in emergency command. · Fire Team/Emergency Response Team Leader or Site Incident Controller. This is the person who takes charge at the actual site of an emergency and is responsible for directing the use of resources at the site. The person should have an in date certificate for having successfully attended an OPITO approved fire team leader training and assessment course. Inspectors should verify this. One of the critical areas of competence for fire team/emergency response team leaders is that of understanding the limiting parameters applicable to the safe use of breathing apparatus for either fire fighting or entering confined spaces. Such persons should know how to operate a time based control system for persons wearing breathing apparatus. In addition, they should have a good knowledge of the hazards of the installation. · Muster Coordinator. This person is responsible to the site main controller for the checking and recording of the headcount on the installation following the sounding of a general platform alarm. There should be an accurate list of person on board available to the muster coordinator so that discrepancies can be identified. This person will monitor the movement of personnel and casualties as the emergency develops and should meet the OPITO Competence Standard for a muster coordinator. · Muster Checkers. These persons will be designated to the pre-arranged muster points around the installation and will check and record the presence of persons at the allocated muster point. The information will then be forwarded by one of the installation’s communication systems to the muster coordinator. Regulation 14 of PFEER requires that each person on an installation is assigned to a muster area and that there is an up to date muster list held at each muster area. Inspectors should enquire to see that the designated muster checkers properly understand these duties and that they do not conflict with any other emergency duties. Persons undertaking these roles should meet to OPITO Competence Standard for muster checkers. 6.1.8. Persons having Specialist Emergency Response Duties In addition to the above formal appointments that are common to most emergency response plans, whether for offshore installations or otherwise, there are a number of other key emergency posts for an offshore installation. These are as follows, the competencies for which 17 are all covered, except for the medic, by OPITO approved training and assessment courses. In the case of an offshore medic, a training and assessment course approved by the Health and Safety Executive has to be successfully taken. · Lifeboat coxswain. · Radio operator. · Offshore medic. · Control room operator. · Helicopter landing officer. · Fire/emergency response team member. Inspectors should discuss with duty holders these roles, paying particular attention to the competency and physical capabilities of the persons involved, and whether or not there are any conflicts between the emergency roles that they are expected to perform. For example, fire team members should be physically capable of negotiating ladders and obstacles when wearing breathing apparatus; with the reductions that have occurred in the number of persons working on an offshore installation, it is possible for a person to be allocated two emergency tasks that might, in some circumstances, be required to be undertaken simultaneously. This is not acceptable. 6.1.9. Persons having no Specialist Emergency Response Duties Persons falling within this category, in the event of an emergency, are mainly concerned with their own personal safety, evacuation and escape. With the exception of occasional visitor, these persons should hold current certificates to show that they have successfully attended an OPITO approved Basic Offshore Induction and Emergency Training Course. In addition, all persons should received adequate instruction and training on the layout, safety system and emergency response system for the particular installation. Information should be provided on the location of personal protective equipment for use in emergencies and life-saving appliances. PFEER Regulations 6, 8 and 21 refer. Inspectors should satisfy themselves that duty holders are meeting these requirements to a satisfactory standard. 6.1.10. Emergency Procedures The emergency response procedures should align with the structure of the emergency response plan referred to paragraph 6.3. There should be an over arching procedure that directs the work of the emergency command team supported by individual procedures linked to the identified hazards. A list of the issues that should be addressed in the overarching procedures is at Annex C (page 48). For the individual procedures, the hazards would arise out of the safety case and or from any other reasonably foreseeable event that falls out of the major accident definitions in the Offshore Safety Case Regulations but nonetheless would still be an emergency requiring a response as required by PFEER. Procedures for dealing with emergencies need to be codified and set out in a user friendly manner such as a flow diagram. They should cover what is expected to happen from the initial detection of a potential emergency situation through to the ultimate conclusion of casualties being transported to a place of safety, any evacuations completed and the installation has returned to a stable state. 18 A typical list of emergencies to be addressed by the emergency response procedures is at Annex D (page 49). Inspectors should be reasonably familiar with most of the procedures since those dealing with major accidents will be set out in the installation safety case. Inspectors should check to see that the emergency management team on an offshore installation are familiar with the emergency procedures and that all offshore personnel are familiar with those parts of the procedures that affect them. 6.2. DETECTION OF INCIDENTS Regulation 10 of PFEER requires detection and control room alarm systems to be provided for fire, accumulations of flammable or toxic gases, and leakages of flammable liquids. These issues are all linked to major accident risks and so will be addressed in the installation safety case. Nevertheless, inspectors should make enquiries about these systems. In particular, consideration should be given to what actions are taken following the detection of a leak and who makes the decision on what action to take, what happens when part of a detection system is not available for use, what controls are exercised over apparent spurious outputs, how are the calibration intervals decided, are the results of the pre-calibration tests recorded so that an informed view can be reached on the appropriateness of the maintenance intervals etc? In addition, from time to time the assistance of specialist inspectors should be sought on such matters as reliability of the detection systems, dispersion patterns for the fluids being detected, and the use of novel techniques in special circumstances. 6.3. COMMUNICATIONS AND ALARMS Regulation 11 of PFEER, in paraphrase, requires · a system for giving an audible and, where necessary, a visual alarm in the event of an emergency in accordance with a prescribed pattern of signals; · systems to allow communications between persons on the installation, between the installation and the standby vessel, any supply boat, any interconnected neighbouring installation whether the connection be by a bridge link or a pipeline, and between the installation and the Coastguard, the on shore emergency centre, the on shore medical support centre etc. All installations are equipped with alarm systems and both internal and external communication systems. But it is possible that the alarm system and internal communication systems might not be universally effective at all places on an offshore installation. Inspectors should look for and make enquiries to see if there are any serious black spots. If serious black spots do exist then appropriate action should be taken. Inspectors should also pursue the human factor and behavioural aspects of communications. Effective communications are vital to health and safety performance in general as well as in emergency situations, and are a wider issue than the provision of effective and reliable hardware. It should always be recognised that upward and horizontal communications are just as important as downward communications. Failures are often not related to hardware shortcomings but to either a lack of clarity in the message or a misunderstanding by the recipient. Such factors as disbelief in the information being passed, failure to give sufficient attention to the information, information being couched in terms that disturb the sensitivities of recipients and recipients allowing themselves to be over sensitive to the tenor of information rather than concentrating on its content, all contribute to communication failures. 19 In addition, communication barriers can result from either individual shortcomings or from failures in the organisational systems. Individual shortcomings can arise from the use of poor semantics and syntax, confusion over the messages being transmitted, interpersonal emotions, preconceived perceptions about what is in messages without fully examining the content, assuming more knowledge and competence than actually exists within the other communicating parties etc. Organisational barriers can arise from status and power differences, a reluctance to pass on bad news, departmental boundaries and parochial considerations causing messages to be misinterpreted, structural shortcomings in the communication networks, the absence of formal communication channels etc. Also, the experiences of past relationships can have a strong influence on the success or otherwise of the communication link. If not handled in a positive way by the parties concerned this can have a highly detrimental effect. Distrust must be banished and care exercised in the choice of words and in demonstrating listening skills. Communication barriers can be seen at two levels. Similar to an iceberg there is the obvious skill level associated with communication. But the great mass of the iceberg cannot be seen. This represents the subliminal barriers to communication of attitude, behaviour, motivation etc. To make lasting improvements both levels need to be given constant attention. Two overriding considerations for effective communications are the attitude and behaviour of the parties involved. Unless there is a conscious attempt to clear the system of bias and preconceived ideas and for all parties to start from a common point of reference, then there will always be scope for misunderstandings. In addition to the above, active listening skills are vital to the communication process. 6.4. MUSTERING Regulation 14 of PFEER lays down requirements on mustering. The parts that are of direct relevance to the management of an emergency require that each person is assigned to a muster area, that at each muster area there is displayed an up to date list of names of the persons assigned to that area, and that there are procedures for mustering and accounting for all persons on an installation. The mustering system comprises of local muster checkers at the designated muster station and a central muster coordinator. When an emergency alarm sounds, persons offshore report to their muster stations where the appropriate muster checker marks them present on the local muster list. Then each muster checker communicates with the muster coordinator and passes over the head count for the particular area. Once the muster coordinator has received all the reports, a total head count is prepared which, if no one is missing, should align with the POB. This sounds a simple arithmetic task. But it is not. Experience shows that errors often occur. It is usual for a muster drill to be programmed for each offshore duty tour. Inspectors should witness any such drills that take place when they are offshore. More crucially, they should enquire about how often muster drills are being conducted and how quickly the muster takes. These times should be compared with the performance standard in the safety case. Inspector should also compare the POB with the maximum declared in the safety case for the installation. If the actual POB should exceed this maximum then this should be pursued. . But the requirements of Regulation 14 of PREER are wider than accounting for all persons on an installation in the event of an emergency. They extend to the provision of safe muster areas, safe routes from the muster areas to the evacuation and escape points, and safe means of egress from working places and the accommodation to the muster areas. This last requirement needs special attention since it can involve the provision of equipment such as emergency breathing apparatus, smoke hoods, torches, heat resistant gloves etc. 20 6.5. DRILLS AND EXERCISES It is a requirement of Regulations 6 and 8 of PFEER for training to be provided and tests to be conducted on the emergency response system. Although the primary purpose of routine drills and exercises is to meet these legal requirements and to maintain familiarity and competence, they can also be used as part of the duty holders own audit systems. Regular drills should be designed to test specified facilities and parts of the system. All parties that would be involved in a real emergency falling within the scope of the drill or exercise should be involved. This could embrace organisations external to the installation such as neighbouring installations, the standby vessel, any supply boat that might be in the area, the operator of any pipeline that might be connected to the installation, the Coastguard, the on shore emergency support manager, etc. Typical topics to be covered in a programme of drills and exercises are at Annex E (page 50). Inspectors should show an interest in the scheduling of drills and, whenever possible, observe them taking place. A good starting point would be to enquire if any drills were planned and then to seek to be excluded from the drill so as to be better placed to observe as many facets of the drill as possible. But inspectors should be cautious not to interfere in a manner that might increase risks, and not to underwrite the quality of the performance in response to a drill or exercise. The results of drills should be retained on the installation and comparisons made with the performance standards in the safety case. Inspectors should pursue serious discrepancies. A list of points to consider when judging the outcome of drills and exercises is at Annex E (page 50). Records should be maintained of the routine drills and exercises conducted and of any lessons learnt. Feedback from the debriefing sessions held following a drill or exercise should be inputted into the review procedures for the emergency response system. Inspectors should make enquiries to ensure that the review process for drills and exercises functions to produce progressive improvements in performance and in a manner that gives life to any lessons learnt. 6.6. INFORMATION TO OFFSHORE PERSONNEL -THE STATION BILL The usual way of informing persons on offshore installations about the emergency response plan is through the inductions that take place when a person visits an installation for the first time, and using the Station Bill, copies of which are strategically placed around the installation. The induction should cover alarms, muster points, means of escape, use of lifeboats, the provision and use of personal protective equipment, man overboard procedures, dealing with fires, stopping work in the event of an emergency etc. Particular instruction and training should be included for special items of equipment such as hydrogen sulphide escape breathing apparatus sets, special escape systems for reaching the sea or any other installation specific systems. With the reduction in time spent on basic offshore safety training courses, it is important that the offshore inductions are properly executed. It was the trade off between general safety training provided on the basic offshore training courses and the installation specific training that led to the time spent on the basic courses being reduced. Against this background, inspectors should consider whether or not the offshore induction training is sufficient to allow persons to act correctly in an emergency. The Station Bill for an offshore installation sets out in the form of a poster the emergency instructions for all offshore personnel. Copies are displayed at appropriate places around the installation including at the muster points, the heli-admin area, and the dining area. Inspectors should consider whether or not the Station Bill contains sufficient information, the manner in which the information is displayed and the location and number of sites at which the Station Bill is displayed. There is no direct legal requirement covering the use of the Station Bill. However, Regulation 8 of PFEER lays down that every person on an installation should be provided with adequate instruction and training in what action to take in the event of an 21 emergency, and that the emergency response plan should be available to all persons on an installation. For persons not having any specialist emergency response duties, the Station Bill coupled with the instruction and training provided in a normal induction process would appear to meet this requirement and inspectors should take this into account. An example of the information that should appear on a Station Bill is at Annex F of this Report (page 51). 6.7. FACILITIES CHECK LIST A generic check list for helping with the inspection of the non-emergency command aspects of the emergency response system is at Annex G of this Report (page 52). 22 7. INSPECTION AND AUDIT OF THE EMERGENCY RESPONSE HARDWARE 7.1. GENERAL A number of systems and arrangements are available on installations that together provide the facilities and procedures necessary for emergency response. So far the control and command aspects of EER have been discussed, for example people and plans. But the implementation of these relies on the use of hardware such as equipment and facilities designed to cope with all foreseeable incidents. These hardware aspects of EER range from structural arrangements (passive fire protection, deluge systems, design of the installation etc) to small items of equipment (personal survival equipment, communication facilities, etc). Together, the control and command arrangements and the hardware should be sufficiently robust to ensure effective emergency response on offshore installations. The facilities identified as having a role in the response to an emergency should be operational and usable by participants. Furthermore, operation and usage should be demonstrable. Legislation requires that where equipment is safety critical, as defined in the amended Offshore Safety Case Regulations, it must be subject to verification arrangements under Regulation 15A of those Regulations. Plant and equipment on offshore installations provided to comply with PFEER may also be subject to the Provision and Use of Work Equipment Regulations (PUWER) 1998. Where equipment is of a personal nature, it is subject to the Personal Protective Equipment at Work Regulations (PPEWR) 1992. Regulation 19 of PFEER requires duty holders to ensure that plant, other than personal protective equipment for use in an emergency, provided in compliance of PFEER is: · suitable for its purpose and is maintained in an efficient state; · subject to a suitable written scheme of systematic examination by an independent competent person, which should specify the nature and frequency of examinations and where appropriate provide for an examination to be carried out prior to equipment being made available for use or after modification or repair. In broad terms, the plant covered by Regulation 19 is provided for the purposes of: · ensuring safe processing; · preventing uncontrolled releases of flammable substances; · preventing ignitions of flammable substances; · mitigating the effects of fire or explosion; · detecting fire or the accumulation of flammable or toxic gases; · communications and the control of emergencies; · means of evacuation; · means of escape; 23 · life saving appliances. Notwithstanding that every item in the above list could have relevance to an emergency situation, the list is wider than the plant that would be used in direct response to an emergency. Therefore, for the purpose of this report, consideration of plant will be limited to that that is provided in direct support of persons on an installation faced with an emergency. A typical list of such emergency response hardware facilities for an offshore installation is provided in Annex H (page 57). It should also be remembered that Regulation 6 of PFEER requires written information to be available on the use of emergency plant. An example of industry standards and guidelines that inspectors should take into account would be the UKOOA Guidelines for the Management of Emergency Response for Offshore Installations (1995), which states alternative evacuation provisions such as TEMPSC should be easy to deploy, reliable in launch, give protection against hazards such as fire and smoke, be able to move away quickly from the installation and, where it is reasonably practicable, should be oriented away from the installation on completion of launch. 7.2. HELIDECK EMERGENCIES Inspectors should check for compliance with Regulation 7 of PFEER by seeing whether or not there is suitable and sufficient mechanical cutting, levering, and tugging equipment available in the vicinity of helidecks to facilitate the release of any persons that might be trapped in the event of a helicopter incident on or in the vicinity of a helideck. There should be available an inventory of the equipment provided for this purpose and inspectors should enquire about evidence to show that the equipment is being periodically checked and maintained. The equipment should be suitably housed at a location in the vicinity of the helideck but not so close that its accessibility might be compromised by a helideck incident. 7.3. ADDITIONAL BACKGROUND INFORMATION Annex I (page 58) shows the relationship between the components of an emergency response system, the issues linked to the individual components and the physical systems that address the issues. This is provided as background information. 24 8. CONCLUSIONS The main conclusions of this report are: · emergency preparedness, which embraces the characteristics of an installation to withstand an emergency and the emergency response system, remains a central part of the ‘protection in depth’ philosophy applied to safeguarding the health and safety of persons on offshore installations; · with the passage of time from the last major offshore accident it is appropriate for a stimulus to be given to the total provision of emergency response capabilities of offshore installations; · the performance standards in design and operational safety cases relating to the endurance times of escape routes and temporary refuges, and muster, evacuation, escape and rescue times, all of which are based on ALARP considerations, are important inputs into the preparation of an emergency response plan; · emergency response systems can be considered in two parts, first the command capabilities of the management team and, second, all the other support systems and hardware; · emergency command capabilities of offshore management teams is of vital importance and, as in other fields involving the possibility of low frequency, high consequence events, professionally organised scenario based training and assessment is the only way of developing and assessing individuals likely to be engaged in offshore emergency command activities; · the offshore industry standard for providing training and assessment for emergency command is set by OPITO and only OPITO approved bodies can undertake training and assessments to this standard; · the regulator should be aware of the background to the OPITO Standard and the assessment process and should measure whether or not duty holders are meeting their legal responsibilities in respect of the emergency command capabilities of their offshore management teams; · the remainder of the emergency response systems can be inspected by the Regulator by following the legal requirements in PFEER, SCR and PSR. Ideas on how this might be done are included in the report. 25 APPENDIX 1 (Page 10 refers) THE OPITO STANDARDS FOR THE MANAGEMENT OF COMPETENCE AND TRAINING IN EMERGENCY RESPONSE OPITO OPITO is the body that has been given official recognition as the Government’s National Training Organisation for the up stream petroleum industry. It is truly tripartite. One of the responsibilities placed on National Training Organisations by the Government is the establishment of training standards for a defined sector of industry. The influence of the Regulator on these standards is achieved through direct representation. The Offshore Safety Division of HSE is represented on the OPITO Training Standards Committee and at the OPITO Board Meetings. OPITO EMERGENCY CONTROL STANDARD FOR OFFSHORE INSTALLATION MANAGERS AND THEIR DEPUTIES For the offshore industry, there is an OPITO Standard for the training and assessment of offshore installation managers and deputies in controlling emergencies. This Standard has been single out for a more detailed exposure than the other OPITO emergency response standards since it is of paramount importance to success in dealing with offshore emergencies. It is applied on an individual basis to offshore installation mangers and deputy installation managers or their equivalents. However, the persons being assessed are examined when playing a leading role in the emergency management team for their installation. From this it follows that, notwithstanding the focus on the individual during assessment, the performance of the team as an entity is also observed, together with the use of the hardware and the links to and capabilities of the emergency response support teams. In this sense, the assessment process also forms part of a wider testing of the whole of the emergency response system. The Standard is based on a core unit for all installations with a system of awarding endorsements for the various types of installation. Both the core and the appropriate endorsement for the particular installation involved must be assessed. Endorsements cannot be awarded on a stand-alone basis. The endorsements cover: · production operations (fixed); · production operations (floating); · drilling operations (fixed); · drilling operations (floating); · mobile/floating installations. This Standard specifies that the training and assessment must be done using scenario based exercises and the manner in which the assessment must be carried out. Only an organisation that has obtained OPITO accreditation can undertake training and assessments to this Standard. The coaching and assessment areas covered include: · maintaining a state of emergency preparedness; 26 · evaluating the initial situation following an event requiring and emergency response; · mustering all personnel and determining whether or not any one is missing; · developing a plan of action; · how to take an overview of the situation and not get overloaded with detail; · establishing and maintaining effective communications both on the installation and externally with the Coastguards, the standby vessel, other installations that might be involved, other ships, helicopters in the area etc; · delegating authority to act; · dealing with stress; · determining the procedures to be followed including predicting the likely escalation; · determining as far as possible the state of the critical pieces of hardware on the installation; · controlling the flow of information; · taking time out to reflect on the whole situation. Although the OPITO Standard for emergency control only applies to the training and assessment of offshore installation managers and their deputies, it is usual to train and assess the performance of other members of the emergency response team when carrying out scenariobased events. These other members would include muster coordinators, muster checkers, control room operators, fire team leaders/on site controllers etc. A next step wider question for the Regulator is whether it should be encouraging, and be involved in, establishing a National or International Standard for emergency response that covers all major hazard industries, but this is not a question for this Report. OTHER OPITO EMERGENCY RESPONSE STANDARDS FOR PERSONS HAVING SPECIAL EMERGENCY RESPONSE DUTIES In addition to the OPITO Emergency Control Standard, there is a suite of other OPITO Emergency Response Standards for persons having special emergency response duties. These are listed below. All persons undertaking these roles except for the roles of offshore medic, muster coordinator and muster checker, should have successfully completed the appropriate OPITO training courses and be in possession of a current certificate to that effect. In the case of the offshore medic HSE sets the training standard and approves the training courses. Therefore, the role of offshore medic does not appear in the list below. In the case of muster coordinators and muster checkers, whilst there is an approved OPITO competence standard for these posts, the relatively straightforward nature of these duties are such that the training and competence assessment is carried out offshore and does not warrant the involvement of an approved training provider. 27 · Fire team leader/on site controller. · Fire team member/on site team member. · Muster coordinator. · Muster checker. · Radio operator. · Lifeboat coxswain. · Helicopter landing officer. · Emergency helideck team member. · Control room operator. BASIC OPITO STANDARD FOR EMERGENCY RESPONSE DUTIES PERSONNEL WITH NO SPECIALIST There is an OPITO Standard for a basic safety induction and emergency response course. All persons except occasional visitors should have attended such a course and be in possession of a current certificate to that effect. 28 APPENDIX 2 (Page 10 refers) OFFSHORE INDUSTRY ARRANGEMENTS FOR ASSESSING AND DEVELOPING EMERGENCY COMMAND CAPABILITIES IMPORTANCE OF COMMAND CAPABILITIES For the purpose of regulatory inspection, it has to be recognised that there is a natural dividing line between the command and control aspects of an emergency response system and the provision of emergency hardware, individual competencies and an emergency response plan setting out the organisational arrangements, the procedures to be followed and identifying the roles to be undertaken by individuals. No matter how good is the emergency hardware, the individual competencies, the emergency response plan etc, none of these provisions will be effective unless there is a clear, competent and practiced installation command structure. The very nature of command, which is characterised by the need for a management team to perform, to manage a developing crisis under time and consequence pressures, often with insufficient resources and information and with a varying dependency upon outside help, requires a different training and assessment approach than is appropriate for the rest of the emergency response system. Assessing and progressively improving the command capabilities of individuals and management teams is highly specialised and requires skills that are not traditionally used by regulatory inspectors. COACHING AND ASSESSING EMERGENCY COMMAND CAPABILITIES Fortunately, the offshore industry is not alone with its needs to train, assess and progressively improve the emergency command and control capabilities of its offshore management teams. Perhaps the most publicised use of techniques for this purpose is in military command structures, and in training and ongoing competence assurance procedures followed for airline pilots. In the second of these the infamous flight simulator is used to generate stressful emergency conditions that are used to both train and assess the performance of the flight deck crew. But the military command and airline flight deck operations are by no means the only examples of the use of scenario-based exercises for training and assessment purposes. In all cases the basic principles are the same and involve a mixture of teaching, progressive learning through practical exercises, and competence assessments during the exercises to make sure that only the competent are allowed to practice in posts where emergency command and control duties are likely to arise. Clearly there are serious limitations on the scope of the practical exercises that can be undertaken on any major hazard site and some equally or more effective alternative methods of simulating emergencies have to be found. For example, in respect of a potential offshore fire, prospective offshore installation managers cannot sensibly be given the opportunity to practice and be assessed with a real offshore fire. Similarly, in the airline industry it would not be sensible to practice taking off on an actual aeroplane with a serious defect developing such as an engine failure. Therefore, a realistic alternative has to be found. The training and assessment technique used is to simulate a range of emergency situations, either on an offshore installation or in an on shore simulation centre, by running a realistic exercise scenario with role players. The offshore installation managers and their deputies undertaking the training are the progressively coached and observed when managing these simulated emergency culminating them being formally assessed on the last three exercises. One of the advantages of using a simulation centre as opposed to an actual installation is that the centre is completely separate from the day-to-day affairs associated with running an offshore installation. And, using systems of one-way glass partitions, video cameras, voices recorders etc 29 it is possible to both enhance the learning and the assessment processes. This is a highly professional business that needs to take care in generating sufficient realism in the scenarios but, at the same time, needs to take care not to damage the persons under going the learning experience and assessment. Just as in the case of military command and flight deck crews, the employment consequences for the individuals who do not meet the standard are serious which adds to the stress of those involved. 30 APPENDIX 3 (Page 10 refers) IMPLEMENTATION OF THE OPITO EMERGENCY COMMAND STANDARD BY APPROVED BODIES PRINCIPLES OF SCENARIO BASED ASSESSMENT The OPITO Emergency Command Standard follows the same principles as used for the training and assessment of critical individuals for other high consequence situations requiring decision making under stress and subject to very tight time constraints, for example, the training and assessment of air line pilots, military commanders, managers of on shore major hazard plants. The Standard requires the approved training and assessment provider to develop a number of emergency scenarios that are relevant to offshore installations. Initially these are used as training tools for the individual offshore installation manager or deputy being assessed and then for the actual assessment. A different scenario is used on each occasion. The method of assessment is by direct observation of the performance, when controlling a simulated emergency, of the offshore installation manager or deputy offshore installation manager being assessed. At least two qualified assessors holding NVQ D32 assessment qualifications are used for each scenario. The OPITO Standard requires that for each individual being assessed, at least three different simulated emergency major incident scenarios should be used. These have to be drawn from the prescribed list below: · well control incident; · explosion and fire; · accommodation fire; · helicopter incident; · pipeline incident; · collision or wave damage causing structural collapse; · loss of stability (mobile installations). 31 SELECTING SCENARIOS FOR COACHING AND ASSESSMENT The mechanism for selecting, developing, running and appraising the outputs from scenarios are illustrated by the flow chart set out in figure 1 below. Objectivity and consistency in the assessment process is achieved by breaking down the assessment into components. Outcomes are set for each component. A top-down analysis of the system breaks down the components into high-level statements of intent and then into individual components from which measurable criteria can be identified. Scenario development and execution must be linked to the desired output and it is recommended that measurable criteria are established to allow feedback on the results, analysis of the strengths and weaknesses, and benchmarking across time, shift patterns and installations. Figure 1 A flowchart based on auditing through a scenario driven approach 32 The variation between scenario-based exercises can be large, ranging from a simple fire team exercise through to a complete evacuation exercise. A plan defining the overall programme, which illustrates how the complete system is to be assessed, should be developed. This can be subdivided into more manageable units but a full test will need to be scheduled. Examples of objectives: · testing information flow and communication through the platform control room; · testing the implementation of plans and decision making in the control room; · examining muster control and evacuation arrangements; · testing event recognition and reaction; · reviewing the evacuation of injured personnel; · testing alternative points of control; · examining rescue and recovery. For each objective an output must be defined, what is acceptable within the safety case, the emergency response system, industry guidance or company policy. The output may be a high level statement that is subjective, for example: Within the context of a drill or a large scale exercise a number of objectives and outputs could be defined. For example a scenario based on a process plant event: Objective: To test communication and information handling through the platform control room. Output: The control room to demonstrate its capability for handling verbal and visual information, by assimilating, recording and briefing the correct personnel within an acceptable time frame. To allow analysis and feedback against the objective, it is necessary to breakdown the system into components that can be monitored, tested and measured. A system can be broken down into hierarchical elements by considering the command structure and the organisation, for example, offshore installation manager, fire team, first aid, muster control etc. Alternatively the system can be built from the bottom up using a detailed analysis of equipment and a tasks analysis. For a given platform a matrix of components can be compiled and referred to when recording the components to be tested. 33 Using the control room example a range of components covering the people, plans and facilities can be identified: Objective: To test communication and information handling through the platform control room. Output: The control room can demonstrate its capability to handle verbal and visual information, assimilate, record and brief the correct personnel within an acceptable time frame. Components: NB components monitored to achieve output a) Facilities - Communications equipment Information display equipment Information recording equipment Fire and gas panels Stability controls Wind speed and sea state Process status Isolation status Fire pump status b) Plans - Emergency response plan Operating procedures Incident Checklists PA announcements c) People - Training Suitable numbers Leadership Ergonomics of the control room Decision making Information loading For the approach to work the scenarios must be developed to meet defined objectives. They have to be platform specific, based on the vulnerabilities of the platform and its operation, use realistic techniques for initiation and escalation and ensure decision-making and tasks are suitable. The scenario should not assume the response works according to the plan. The scenario should be structured to allow opportunities for errors to be made, in observing the exercise a textbook response is not to be expected. The object is to test effectiveness of the system to deliver key performance criteria based on teamwork. It is not necessary for the scenario to be complex but it is important that the expected events can be analysed and the person developing the exercise must have a good understanding of the 34 event, its escalation paths and the planned response. The expected events refer to the actions of teams, potential for mitigation, timescales for achieving various key points on decisions etc. A range of inputs should be identified and the resulting actions analysed. Where a number of components have been identified the scenario should be independently checked to ensure the events and the possible outcomes will test the desired components. Whilst the risks and events may be taken from the safety case it is not necessary to construct scenarios that strive to replicate top events. Relatively small problems if correctly observed will generate suitable analysis. It is however important to ensure realistic conditions are provided, information flow, background noise etc are key examples of this. The assessment is carried out by qualified and experienced assessors from OPITO approved body appointed by the duty holder to undertake the work. Structured checklists are used to ensure that the activities are being properly assessed, that there are no gaps in the scope of the assessment, to provide consistency, and as part of the quality assurance arrangements of the approved body. Annex A (page 47) gives a generic checklist used when assessing emergency command capabilities. Repeating what has already been stated, such check lists should only be used in real assessments by qualified and experienced assessors under the auspices of an OPITO approved body. The process is illustrated in figure 2 below. Figure 2 35 When using the assessment proformas, it sometimes happens that all components cannot easily be assigned values or quantitative ratings. A combination of components may be grouped into a time-based value such as the availability of a first aid team or fire fighting team within a set time. The assessor monitoring the running of the scenario then makes an observation on whether or not this time for the group of activities has been met and makes a corresponding entry on the proforma being used. Separate scenarios are selected for training and assessment. The training scenarios are graded in an increasing order of difficulty so as to enable those involved to progressively improve. At least a set of three different scenarios are used to assess the command performance of the individuals fulfilling the roles or designated for the roles of offshore installation manager or deputy offshore installation manager. The scenarios sets are not chosen so as to be a comprehensive package covering all possible types of emergency but each set is assembled to capture emergencies involving a fire, a helicopter crash and a hydrocarbon release. As well as performing assessment functions and making the scenarios work, role players from the approved assessment body are used to simulate the actions and communications of those who would be involved if the simulated emergency were to be real. Before the start of a scenario, a full breakdown is made of the components that will be used for assessing the performance of the individual being assessed. The generic checklist forms the starting point for the component analysis that takes place during the running of the scenario. COMPONENT ANALYSIS To test the emergency response system, assessors use component analysis in the following stages: · first, by breaking down the emergency response system into a series of components, for example, detection, action, response and conclusion, and taking into account, examine in relation to the key elements of emergency response including People, Plans and Facilities. · second, determining the salient emergency response actions that are relevant to each of these components. The components and the salient actions are then used as the basis for carrying out the performance assessment of the individual being assessed. Part of this process includes predetermining the acceptable performance under each of the components. The outputs are then measured during the assessment process to determine whether or not the person under assessment has demonstrated competency under each of the components. The techniques used included: · observation (although observation is subjective, the subjective measurements can be aggregated to achieve a degree of objectivity, again this is an area where the OPITO accreditation process and the quality assurance procedures with the approved assessment body come to the fore); · comparing the component against pre-determined levels, for example, performance standards and specifications; · attributing a number from the 5 point scale (good to unsatisfactory) in relation to how close the component performed in relation to the ideal standard; 36 · aggregating components together to measure the response. The results of this process are assembled and moderated through the peer review and quality assurance procedures of the approved body. A final report is then prepared. The process is illustrated in figure 3 below. Figure 3 Stages of component analysis 37 ANNEX A (Page 12 refers) GENERIC CHECK LIST FOR THE ASSESSMENT OF COMMAND CAPABILITIES This checklist is provided as background information. It is an example of the issues considered by an OPITO approved training and assessment organisation when carrying out an assessment to the OPITO OIM Emergency Control Standard. Component Information Gathering Parameter Verbal reports noted and action taken Alarm inputs noted Incident status checked Equipment status checked Correct communications established Personnel location identified Personnel at risk identified Continual updating takes place 38 Notes Communication to individual/team provided sufficient information for team to assess response required Response is appropriate to type of alarm raised Fire and gas detection, CCTVs, reports from SOI etc Plant status checked Both internal and external eg SBV, MCA, Duty Manager Use of PTW board, PA system, muster point Safety of at risk personnel checked Information is continually and actively gathered through observation, interrogation, communication, active listening Component Recognition and evaluation of risk Parameter Action to report and escalate required response taken Understanding of impact demonstrated Appropriate isolation considered Dangers of ongoing work evaluated Information sources reviewed Leader communicates current position and intended actions Identify equipment and controls Systematic check of equipment and controls conducted Communications equipment checked Security of ECR checked Alternative equipment identified or used Equipment well maintained 39 Notes Positive action is taken to obtain information or updates from and to SOI, Possibilities of escalation, weather conditions, location of incident, inventories considered. Actions indicate awareness of impact Isolation procedures initiated Dangers from other operations considered Alternative sources of information explored A ‘timeout’ is held during which time information is shared, objectives are identified and plans imparted Warm clothing, suitable footwear, grab bags etc. Individuals can use the equipment correctly under realistic conditions (noise, light etc) Vulnerability of communications equipment considered and contingencies identified Vulnerability of ECR considered and use of alternate considered Back-up fire pumps, emergency generator, alternate muster points considered Checks on records show correct maintenance Component Competence Parameter Control staff assessed by company as competent Training records available Roles and responsibilities known Decision making Facts reviewed and analysed Decision communicated Actions implemented Actions monitored Decision reviewed Escalation Leader demonstrates knowledge of escalation paths Actions to prevent escalation are taken Safety of personnel assessed Risks of escalation communicated OIM updated on escalation 40 Notes Verification of training and assessment records Records of onboard drills and exercises and training matrix in place Roles and responsibilities clearly identified in ERP / Station Bill Reviewed as a group or with individuals, possibly during timeout, updates on boards, plot plans etc Recorded on action list, through observation and questioning Record checked against exercise/drill objectives Individual monitors that actions are implemented correctly Changing circumstances are considered particularly during ‘timeout’ Leader identifies possible escalation paths Boundary cooling, deluge, reduction of inventory, may be appropriate Determine whether the effect of escalation on safe areas and escape routes eg TR, lifeboats is considered Team members highlight escalation risks during ‘timeouts’ Feedback given from SOI, SBV, CCTV etc Component Planning Parameter Actions follow a defined plan The plan is approved The plan is communicated The plan allows for escalation The plan is reviewed Dealing with stress Behavioural observation indicates Leader controls his stress levels Stress in team members is observed and acted on Impact of room environment suitable to control stress 41 Notes Determine whether a plan has been devised and if it complies with the ERP Variations to the plan are recognised and approved in accordance with the command structure Determine whether clear instructions are given, roles defined and tasks delegated Determine whether leader identifies possible escalation paths and whether effects of escalation (particularly on safe areas and escape routes) are considered From brief discussions during ‘timeouts’, from discussions with MCA, Duty Manager etc. Indicators such as breathing, posture, voice etc and particularly self awareness Stress reactions are identified eg agitation, trembling, loss of concentration etc and support provided in the form of reallocation of task, removal from the situation etc Room layout, noise level and environmental conditions should be appropriate Component Take effective action Parameter Mitigation actions are identified Mitigation is implemented Actions are communicated Actions are monitored Opportunities for error are controlled Issue clear instructions Instructions are short and to the point Personnel do not require repeated clarification Instructions are implemented Communication is two way Barriers to communication are controlled 42 Notes Containment, down manning, manoeuvring may be considered Mitigating factors identified are implemented Clear instructions are given both internally and externally Feedback is requested, obtained and independent checks are conduced Communication is clear and two way, monitoring takes place, overload and stress on individuals are controlled Instructions are clear and precise Determine whether individuals ask for clarification and repetition of instructions Select specific instructions and follow progress Determine whether feedback is apparent (this indicates two way communication) Language is understood environmental factors are controlled Component Re-evaluate situation Parameter Updates of information are reviewed Focus is not concentrated on single issues Decisions are reviewed in light of new information Is behaviour rule or knowledge based? Team Work Individuals work as a team Remote teams are part of extended team Objectives and goals of team clear Feedback given on objectives Open communication and ideas accepted 43 Notes Changing circumstances are considered particularly during ‘timeout’ Priorities are identified and an overview is maintained Changing circumstances are considered particularly during ‘timeout’ Are procedures / flow charts appropriate for the incident and are they being used? Are the required decisions skills rules or knowledge based? Good communications, clear task allocation evident Good communications and obvious concern for the welfare of remote teams Objectives are clearly communicated and recorded Feedback parameters are set and followed Team members are encouraged to contribute during timeouts Component Resource Management Parameter Task overloads monitored Correct skills present Sufficient personnel available Missing skills can be resourced Loss of key personnel Control of personnel occurs Replacement for key personnel available Clear roles and responsibilities displayed Delegation Alternatives have correct skills/competence Personnel act on the authority of the leader Tasks are delegated to the correct persons Feedback is monitored Personnel have resources to act on the tasks 44 Notes Determine whether tasks are being given unnecessarily (eg the stress associated with inaction - the need to do something) Refer to training records and job descriptions Determine whether personnel have too many tasks and whether tasks are evenly distributed Determine whether personnel are multi-skilled in ER duties and whether clear checklists are available for stand in personnel Is the loss recognised in a timely manner? Determine whether the responsibilities were delegated / shared appropriately ERP and / or checklist available and utilised Records checked Authority is clearly delegated Consider criticality of task, suitability and workload of individual Determine whether feedback is clearly requested during delegation and whether milestones are identified Correct resources are identified and made available Component Information overload Parameter Notes Information overloads monitored verbal and electronic Determine if the team are able to cope with number and frequency of alarms and instructions Check response boards, plot plans and event narrative are accessible and maintained up-to-date Determine whether panel operator is able to identify key information despite number and frequency of alarms and instructions Atmosphere is calm and controlled, GPA is muted in a timely manner Check response boards, plot plans and event narrative are up-to-date and contain correct information (Track piece of information from insertion to recording) Recording and retrieval of information is possible Identification of key process variables is not obscured by information overload Noise does not restrict information flow Information is acted on and not lost 45 ANNEX B (Page 8 refers) COMPONENTS OF AN EMERGENCY RESPONSE SYSTEM Component Examples of Hardware Examples of Software · · · Automatic systems Manual systems Communication · · · · · Organisation Elements of emergency response Procedures Training and competence Lines of command Raising the alarm · · · · Automatic systems Manual systems Communication Audible/visual signal · · · · · Organisation Procedures Training and competence Lines of command Emergency response plan Mustering of persons · · · · · · · · Escape routes Protection Muster areas Temporary refuge Communication Medical equipment Diving provisions Short Duration BA · · · · · · · Account for POB Organisation Procedures Training and competence Emergency response plan Lines of command Casualty provision Assessment · · · · · Communication Remote facilities Protection Temporary refuge Short Duration BA · · · · · · Procedures Organisation Lines of command Competence Training and competence Emergency response plan Evacuation · · · · · · · · · · Evacuation routes Communication On installation Off-installation Protection Accessibility Medical equipment Availability Diving provisions PPE · · · · · · · Procedures Organisation Lines of command Training and competence Emergency response plan Ease of use Casualty provision Detection 46 Component Escape Rescue Examples of Hardware Examples of Software · · Primary Systems Secondary Systems · · · · · · · · Escape routes Escape equipment Communication Accessibility Protection Availability Medical equipment PPE · · · · · · · Procedures Organisation Lines of command Training and competence Emergency response plan Ease of use Casualty provision · · · · · · SBV, DC, FRC Availability Communication Protection Medical equipment Diving provision · · · · · · Procedures Organisation Lines of command Training and competence Emergency response plan Casualty provision 47 ANNEX C (Page 18 refers) OVERARCHING EMERGENCY PROCEDURES PROMPT SHEET Matters to be addressed in the over arching emergency procedures should include: · communicating the emergency to all persons on an installation; · mustering arrangements; · external communications; · interfaces with the emergency response plans of the operators of any connected pipelines; · actions to be taken by the standby vessel, any supply boats available and any helicopters available; · the management of the emergency including the use of an incident log and event matrices for such matters as process plant upsets, availability of fire water, availability of electrical power etc; · informing any divers working in the vicinity of an installation of an emergency; · emergency arrangements for rescuing and evacuation of any divers involved in a diving emergency near the installation; · the availability of external assistance including search and rescue services; · arrangements for decision making on and actioning precautionary down manning; · arrangements for decision making on, and actioning abandonment of an installation. 48 ANNEX D (Page 19 refers) TYPICAL SPECIFIC EMERGENCY PROCEDURES PROMPT SHEET A typical list of emergencies to be addressed by the second tier procedures is as follows: · fire or explosion; · blow out of a well; · leak or spillage of hydrocarbon fluids; · a pipeline incident; · severe weather affecting the stability of an installation; · movement of the sea bed affecting stability of an installation; · structural failure; · failure of the means for keeping an installation on station; · collision involving the installation; · helicopter accident; · person over board; · death or serious injury of a person on an installation; · terrorist activity. In the context of the above list, inspectors should consider: · are the emergency response procedures fit for purpose; · are they available to all persons on the installation and to all organisations that might be involved in responding in some way to an emergency; · are the procedures understood; · have all parties connected with the procedures been consulted; · are they periodically reviewed and updated to reflect lessons from exercises, drills or other sources? 49 ANNEX E (Page 21 refers) DRILLS AND EXERCISES PROMPT SHEET The programme of drills and exercises should include the subject areas listed below. · Musters and the use of alternative muster points. · Location and handling casualties. · Fire fighting. · MOB. · Helideck incident. · Helicopter incident. · Well incident. · Hydrocarbon production incident. · Ship collision incident. · Preparation for evacuation. · Preparation for abandonment. A typical drill could be used to test aspects of the emergency response system by determining the effectiveness of the following: · reaction to alarms; · mustering arrangements; · familiarity with equipment; · evacuation procedures; · internal and external communications; · compliance with procedures; · familiarity with installation layout. 50 ANNEX F (Page 22 refers) STATION BILL PROMPT SHEET The information of the Station Bill covers such matters as: · the emergency telephone number; · action to be taken on discovering an emergency; · the alarm system; · the normal and alternative muster points; · the lifeboat stations; · evacuation systems; · details of the emergency control and response teams; · instructions about ceasing work and smoking in the event of an emergency. 51 ANNEX G (Page 22 refers) GENERIC CHECK LIST FOR THE INSPECTION OF EMERGENCY RESPONSE HARDWARE AND SOFTWARE 1. This check list is an aid memoir for persons having an interest in emergency response systems. It should be of use to inspectors assessing the effectiveness of emergency response management. Component Emergency response plan (ERP) Parameter Does the plan comply with Regulation 8 of PFEER and do the roles and responsibilities follow the plan? Command established in accordance with the plan Communication routes follow the plan Test availability and knowledge of ERP Safety Case Organisation complies with safety case Response meets performance criteria Equipment suitable and sufficient Risks and escalation routes known to personnel Event matrix (A matrix linking cause and effect for process plant problems) Cause and effect of process upsets known Mitigation of problem implemented Information available to meet operator needs 52 Notes Examine ERP Examine roles and responsibilities within ERP Refer to communication flowchart within ERP Sample management and personnel generally Refer to Safety Case Refer to Safety Case Refer to Safety Case Decisions reflected the escalation risks and times. Loss of key services anticipated Check whether specific event matrix is available and up to date Actions correctly implemented in a timely manner to mitigate event, actions monitored and corrections made if required Check whether specific event matrix is available, up to date and is appropriate Component Alarm lists Parameter Alarm sequence interpreted by operators Prediction of escalation realistic Monitoring of alarms carried out Operating Instructions Are instructions and information provided in accordance with Regulations 6 and 8 of PFEER and are the instructions followed as appropriate? Instructions known to operators Instructions in an appropriate format Means of detection Does the emergency detection arrangements comply with Regulation 10 of PFEER and are appropriate actions implemented on detection? Maintenance of equipment suitable PFEER Regulation 19 refers Compare operator’s conclusions against scenario outline Determine whether monitoring and interpretation of secondary alarms is appropriate Determine whether secondary alarms are interrogated Appropriate instructions are identified and followed Personnel are aware of the location and content of standing instructions Easy to identify, locate and use (user friendly) eg flow diagrams and matrix Automatic actions are confirmed and manual intervention considered Are alarms audible? Refer to maintenance records Refer to planned maintenance and inspection records Scenario allows for individuals to detect incident Consult noise survey Do alarms comply with PFEER Regulation 11 and UKOOA guidance Refer to legislation and guidance Can there be confusion over the type or nature of an alarm? Check particularly local package and module alarms Refer to ERP and local standing instructions Refer to records Testing of equipment carried out Personnel demonstrate knowledge of actions on discovery of event Alarms Notes Are control room staff aware of the action required on alarms? Is the alarm history available for analysis? Correct action implemented on alarm 53 Action follows ERP Component Life saving appliances Parameter Notes Are life saving appliances available at the muster and / or embarkation stations? PFEER Regulation 20 refers Determine the most suitable location for emergency equipment eg survival suit in ECR Refer to inspection records / visual sampling of actual equipment Refer to test certificates Refer to training records Check against procedures Is the equipment well maintained? PFEER Regulation 19 refers Are test certificates in date? Have personnel been trained in its use? Was it used correctly during the exercise? Can personnel demonstrate how to use it? Are instructions available for its use? PA System Communications equipment PFEER Regulations 6 and 8 refer Is guidance provided on who is authorised to use it during an emergency? Are personnel provided with prepared statements? Is the system accessible for use? Is the equipment readily available and does it meet the requirements of Regulation 11 of PFEER? Personnel know how to use equipment Equipment is suitable for the environment Alternative arrangements in place 54 Refer to drill records Determine whether instructions exist and are correctly placed Refer to ERP and standing instructions Check ERP for proformas Check accessibility from various locations ie lifeboat and helideck Local to the SOI, at muster and command points Correct procedures applied Includes issues such as suitable for hazardous areas, suitable for noisy environment, waterproof etc Personnel know and can demonstrate alternative means Component Muster station Parameter Notes Regulation 14 of PFEER refers. Is a list of names readily available for personnel mustering at various muster stations Inspection eg POB lists, muster lists, t-card system Observation, questioning and consider special inputs to scenario Determine vulnerability of muster stations Monitoring of access and egress routes is carried out. Re identification of personnel, readability of lists etc. Sufficient space is available to muster and not interfere with required operations Location remains safe Access and egress routes remain available Lighting main and emergency Emergency Control Room equipment PFEER Regulations 6, 8, 11 and 12 are particularly relevant. Communications Maintenance is carried out Plans and procedures are available Means for recording key information Back up lighting is available Evacuation and escape routes Torches are provided Regulations 14 and 15 of PFEER refer. Are escape routes available Alternative routes are known to all personnel Personnel practice using different routes 55 Platform and external communications are available Records are available and up to date Available and used Available Include loss of normal lighting in exercise Inspection Check emergency response boards, particularly plot plan to ensure unavailable routes are identified Routes should be clearly identified on the plot plan Training records Component Evacuation and escape equipment Parameter Notes PFEER Regulations 15, 16, 18 and 19 refer. TEMPSC are available as a secondary means of evacuation. Escape items such as life rafts, chute systems, ladders to the sea, other controlled descent devices etc are available as a means of escape Grab bags are available to all personnel Suitable protective equipment is available as defined in the safety case/ERP Personnel are trained in the use of the equipment First aid equipment is available Personnel have been instructed and trained and are able to demonstrate correct use Helideck Equipment Rescue and Recovery PFEER Regulations 7 and 19 refer. Equipment to rescue persons from helicopters is available. Equipment is suitable and maintained PFEER Regulation 17 refers. Arrangements to recover persons following evacuation or escape. Arrangements for rescuing persons from the sea. Arrangements for taking persons to a place of safety Information regarding plant PFEER Regulation 21 refers. Information on areas where flammable liquids and gases can occur, and on the location of fire fighting plant, personal protective equipment and life saving appliances External resources Communication maintained with OIM Requests from Fire Team dealt with Control of remote response teams demonstrated 56 Grab bags are utilised Survival suits, lifejackets, immersion suits Training records and questioning Inspection and questioning Use is checked under realistic conditions if possible Periodically check the availability of the equipment Check performance standards for achieving a good prospect of recovery and that the facilities provided meet these performance standards Check availability of information on zoning, on the location of portable fire fighting equipment and on the location of life saving appliances Check event narrative on response boards and observe OIM or delegate Check action list and listen for feedback Determine whether clear tasks, delegation, careful monitoring are conducted ANNEX H (Page 24 refers) TYPICAL EMERGENCY RESPONSE HARDWARE FACILITIES FOR PLATFORM EVACUATION AND ESCAPE · · · · · · · · · · · · · · · · Audible and visual alarm systems for GPA, PAPA, and where appropriate, toxic gas Evacuation / Escape Routes Muster points POB lists Evacuation list and other proformas T-cards / Swipe cards Emergency signs Survival suits Grab bag (flash light, fire resistant gloves, smoke hood) Life jackets Emergency lighting Helicopter TEMPSC SBV FRC Lifeboat loading instructions / procedure · · · · · · · · · · Communications eg radios, PA system Escape set (short duration BA set) Water curtains (protection for people while abandoning installation eg stairways to lifeboats) Fire fighting systems – deluge cools vessels down gives personnel time to evacuate Medical Equipment Station Bill Diving Provisions ECR Emergency Response Status Boards POB board When considering this plant inspectors should take into account relevant industry standards and guidelines and should pursue the following questions: · is the equipment working to the correct specifications; · ease of use; · location; · identification and markings; · training in the use of facilities, etc. 57 ANNEX I (Page 24 refers) FACILITY CONSIDERATIONS DURING EMERGENCIES The table below shows the relationship between the components of an emergency response system, the issues linked to the individual components and the physical systems that address the issues. These are provided as background information. Component Detection Raising the alarm Issue Typical elements - Single or multi-detection Area classification Widespread / isolated Reliability of detection Availability and survivability · · · Heat detection Smoke detection Gas detection - Type of alarm Type of event occurring Possible outcome Special operations Availability and survivability · · · · · Fire and gas detection Local alarms General platform alarm PA system Flashing signal/indicator lights Manually activated call point (MAC) Communication equipment eg radios Egress routes Muster station POB list Muster list T cards/swipe cards Emergency signs Emergency lighting Emergency equipment Emergency response status board POB board Station Bill Temporary refuge (TR) Fire and gas detection system (to show further alarms) Feedback from ERT CCTV Decision making flow charts · · Mustering personnel Assessment - - Areas affected by incident / · protection of routes · Safety of personnel · Personnel missing · Weather conditions · Availability and survivability · · · · Nature of incident Event escalation Time restraints Failure of ESD systems Availability and survivability 58 · · · · · · · Component Control Issue - Evacuation - Escape - Typical element Containment Mitigation (eg blow down, boundary cooling) Rescue Tactics Availability and survivability · Equipment availability / survivability Access to equipment Weather conditions Wind direction Maintain communication · Equipment availability / survivability Access to equipment Safe access to sea Fire on water / gas cloud Weather 59 · · · · · · Fixed fire fighting systems Portable fire fighting equipment Fire fighting vessel Water curtain Procedures Checklists Ventilation /extraction · · · · · · · · Communication equipment PAPA TEMPSC Life jackets Helideck/Helicopter Survival suit Grab bag Emergency lighting Evacuation routes Fire dampers Pressurised areas Medical equipment eg stretcher Station Bill Diving provisions Water curtains Electrical isolation Escape set Procedures Checklists Evacuation sheets · · · · · · · · · · · · · PAPA Escape set Grab bag Survival suit Life jackets Life raft Dacon scoop FRC Ladder to sea Escape routes Emergency lighting Temporary Refuge Procedures · · · · · · · · · · · Component Rescue Issue Typical element - Resources available Maintain communication Recovery to SBV · · · · · · · - Installation manoeuvrability · General 60 Helicopter SBV Other vessels Dacon scoop Other installations Procedures Onshore facility eg Casualty reception centre Engines BIBLIOGRAPHY THE PUBLIC INQUIRY INTO THE PIPER ALPA DISASTER Lord Cullen HMSO ISBN 0 10 113102 PIPER ALPHA AND THE CULLEN REPORT KENNETH miller, University of Strathclyde PIPER ALPA – THE SAFETY CRISIS AND WHAT CAUSED IT HSE Conference of Changing Health and Safety Offshore: The Agenda for the Next 10 Years, Aberdeen, July, 1998 Brian Appleton A GUIDE TO THE OFFSHORE INSTALLATIONS (SAFETY CASE) REGULATIONS 1992 HSE ISBN 0 7176 1165 5 PREVENTION OF FIRE AND EXPLOSION, AND EMERGENCY RESPONSE ON OFFSHORE INSTALLATIONS HSE ISBN 0 7176 0874 3 A GUIDE TO THE OFFSHORE INSTALLATIONS AND PIPELINE (MANAGEMENT AND ADMINISTRATION) REGULATIONS 1995 HSE ISBN 0 7176 0938 3 WORKS A GUIDE TO THE INSTALLATION VERIFICATION AND MISCELLANEOUS ASPECTS OF AMENDMENTS BY THE OFFSHORE INSTALLATIONS AND WELLS (DESIGN AND CONSTRUCTION, ETC) REGULATIONS 1996 TO THE OFFSHORE INSTALLATIONS (SAFETY CASE) REGULATIONS 1992 HSE IBSN 0 7176 1193 0 A GUIDE TO THE PIPELINES SAFETY REGULATIONS 1996 HSE IBSN 0 7176 1182 5 ASSESSMENT PRINCIPLES FOR OFFSHORE SAFETY CASES HSE ISBN 0 7176 1238 4 NATIONAL EMERGENCY MANAGEMENT STANDARDS Link Associates International Ltd LINK ASSOCIATES INTERNATIONAL LTD - COURSE MATERIAL FOR COMMAND AND CONTROL TRAINING COURSES Link Associates International Ltd 61 SCENARIO BASED EMERGENCY RESPONSE PROCEDURES HSE Conference of Changing Health and Safety Offshore: The Agenda for the Next 10 Years, Aberdeen, July, 1998 C McWhirr DEVELOPMENT OF PERSONNEL FOR OFFSHORE EMERGENCY RESPONSE ROLES HSE Conference of Changing Health and Safety Offshore: The Agenda for the Next 10 Years, Aberdeen, July, 1998 T Brighton CHANGING MINDS - A PRACTICAL GUIDE FOR BEHAVIOURAL CHANGE IN THE OIL AND GAS INDUSTRY Step Change Forum GUIDELINES FOR THE MANAGEMENT OF EMERGENCY RESPONSE FOR OFFSHORE INSTALLATIONS UKOOA GUIDELINES FOR THE MANAGEMENT OF COMPETENCY IN EMERGENCY RESPONSE UKOOA OPITO APPROVED TRAINING STANDARD FOR OIM (DEP) Offshore Petroleum Industry Training Organisation REVIEW OF RESCUE AND IMMEDIATE POST-IMMERSION PROBLEMS F Golden and M J Tipton HSE OTH 519 HSE EER IN THE NEW MILLENIUM 2nd International Workshop, Conference and Exhibition on Evacuation, Escape and Rescue, Aberdeen, March, 2000 D M Menarry THE ASSESSMENT OF RESCUE AND RECOVERY ARRANGEMENTS 2nd International Workshop, Conference and Exhibition on Evacuation, Escape and Rescue, Aberdeen, March, 2000 S Haddock THE SELECTION AND TRAINING OF OFFSHORE INSTALLATION MANAGERS HSE Research Report RG Flin and G M Slaven A NUMBER OF EXISTING OFFSHORE INSTALLATION PLANS. 62 GLOSSARY ACOP BA CCTV DC ECR EER ERP ERT ESD FRC GPA HLO HVAC HSE MAC MCA NVQ OIM OPITO PA PAPA PFEER PTW SBV SCR SOI TR POB PPEWR PSR TEMPSC UKOOA Approved Code of Practice Breathing apparatus Close circuit television Daughter craft Emergency control room Evacuation escape and rescue Emergency response plan Emergency response team Emergency shutdown Fast rescue craft General platform alarm Helicopter landing officer Heating, ventilation and air conditioning Health and Safety Executive Manually activated call Maritime and Coastguard Agency National vocational qualification Offshore installation manager Offshore Petroleum Industry Training Organisation Public address Prepare to abandon platform alarm Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Permit to work Standby vessel Offshore Installations (Safety Case) Regulations 1992 Site of incident Temporary refuge Persons on board Personal Protective Equipment at Work Regulations 1992 Pipelines Safety Regulations 1996 Totally enclosed motor propelled survival craft United Kingdom Offshore Operators Association 63 64 65 Printed and published by the Health and Safety Executive C0.50 4/02 66 ISBN 0-7176-2321-1 OTO 2001/091 £15.00 9 780717 623211