1 Many serious accidents or incidents, including the Piper Alpha disaster in 1988, involve root causes associated with shift handover. An outgoing operator is handing over to an incoming operator at the end of a shift.(a) Explain the key principles of safe shift handover.Information on specific operational issues is not required in part a. (10)The key principles of safe shift handover are:Good shift handover allows the accurate and effective communication of vital information to incoming personnel in order to allow the safe operation of process plant and equipment. There are three elements which contribute to an effective shift handover: A period of time when the outgoing team prepares the information it will be conveying to the incoming team A period of time when both the outgoing and the incoming team communicate with each other and exchange all relevant information. A period of time when the incoming team cross checks the information passed onto it as it takes the responsibility for the ongoing operations. Management should ensure that the facilities, the arrangements and infrastructure allow for good shift handover practice. This should: Provide all staff who are involved in the handover process with training and the development of good communication skills. Provide written procedures for effective shift handover Emphasize the importance of effective shift handover Ensure that both parties take joint responsibility for conducting an effective shift handover. Emphasize the use of both written and verbal means of communication Ensure that any important information is written into a log or report form. The log or report form should be brought to the attention of personnel at handover. Include all personnel from both the incoming and outgoing team in the handover without exception. Ensure that managers and Supervisors are available at all times and ensure an open door policy.

Should be treated as high priority.

(b) Outline the main operational issues communicated at shift handover. (10)The main operational issues communicated at shift handover include: Work permits-the status of existing permits and the status of work in progress. The updating of work permits Preparations for upcoming maintenance New personnel to the shift Any plant overrides-existing and planned Information about any abnormal events Any existing or planned shutdowns Any change in plant parameters Any routine operations and existing parameters which may need to be carried out by the personnel from the incoming shift Any breakdowns which may have occurred Any faults which have occurred with safety critical equipment Inhibits to the fire and Gas (F&G) and Emergency Shutdown systems Any completed work and equipment which have returned to service

SECTION 2You are advised to spend about one and a half hours on this section, which contains TEN questions.2 (a) Identify the hazardous properties of Liquid Petroleum Gas (LPG). (4)hazardous properties of Liquid Petroleum Gas - LPGHeavier than airVaporisation - ColdStorage - LeaksFire / Explosion(b) Outline the risks associated with Liquid Petroleum Gas (LPG). (4)Risks associated with Liquid Petroleum gas LPG.AsphyxiationBurns (Hot and Cold)Fire / Explosion3 Safety cases and safety reports provide documented evidence that an oil and gas installation is safe.Outline the typical content of these types of documents. (8)Identification of major accident hazards using risk assessments (Q SQ QRA), bow-tie diagrams, etc. The impacts of potential major accident hazards should be analysed and identify:oEach hazard scenario.oThreats to safety and what causes them.oBarriers to prevent those threats, Consequences of each threat were it realised.oRecovery measures required.oFactors that could escalate the hazard or its consequences. Evaluation of major accident risks and measures taken to controlthose risks, using details of all existing "designed-in" precautionaryand safety measures. Existing risk controls should be evaluated tosee if these are adequate or further risk controls are required todemonstrate ALARP. This would include:oIdentify each hazard/incident scenario. Assess frequency criteria.oAssess consequence criteriaoAssess occupied and unoccupied locations as separate criteria.oAssess Evacuation, Escape and Rescue (EER) facilities and requirements.oFor higher risks, assess individually.oIdentify and assess the risk control measures proposed to achieve ALARP. Arrangements for audit and audit reports with a plan showing thetype of audit (internal, external), how often they will be carried, inwhat areas they will be conducted, how recommendations will bedealt with and actioned, and who will be responsible for completion. Having an adequate safety management system in place, includingthe management of contractors and sub-contractors.Major accident prevention policies -in the case of safety reports these would need supporting information from the safety management system Identification of the safety critical elements that are in place tomanage major accident hazards (scenarios, possible causes,controls, recovery systems). Details of the emergency plan. This would include layout drawingsof the installation, showing locations of all safety and emergencyequipment, control points (e.g. control room, radio room, etc.),isolation and shut-off controls, safe access routes and escapeladders, access to boats and manning and launch procedures.4 (a) Identify THREE marine hazards associated with all types of Floating Platform Storage Offloading Units (FPSOs). (3) Oil/gas leak arising from:- Blowouts/pipeline leaks/process leaks Non-process incident:- such as fire/chemical spill and leaks Marine event:- such as Collision of supply, stand-by and support vessels/collision with other vessel/capsize or grounding Extreme loadings due to wind or waves Structural failure due to: Fatigue/Design error Failure of derricks, cranes or other equipment Dropped objects during:- Construction/crane operation/cargo transfer/drilling operation Helicopter crash or fire during refuelling Capsize of crew boats or accident to personnel during transfer(crew change, in-field transfer) Construction accident: onshore or offshore work/marine installation/commissioning activities/pipe laying Diving accident Slips, trips Extreme environmental conditions (weather, waves, sea currents/temperature, ice, etc). Accelerated wear and corrosion -the stress of constant movement/buffeting and aggressive salt spray mean that structures and equipment can quickly fail if maintenance is neglected. Collisions with other vessels and structures, these may result in environmental damage (oil spills). An inadequate/defective mooring, combined with extreme weather may contribute to this. The intrinsic hazards of the substances for example, LNG, H2Sand drilling fluids ('mud') and the potential for fire.

(b) Identify suitable controls that minimise risk when operating Floating Platform Storage Offloading Units (FPSOs). (5) ship should be securely moored The responsible people in charge of terminal and tanker, respectively, should agree a loading/off-loading. The ship's doors, ports, windows, etc. which open onto the tank deck, should be kept closed (to avoid ingress of flammable vapours and the risk of explosion in accommodation areas). Ventilation systems may also have to be adjusted or disconnected so as not to suck in flammable vapours or act as an ignition source. Cargo tank vents should be protected by flame arresters. Ship to terminal connections (such as via directly connecting hose or marine loading arms/ metal cargo arms) can be fitted with an emergency release. Liquid loading lines and vapour emission control lines (vapour recovery) should be dearly distinguished, to avoid misconnection. Hoses should be inspected for defects before use. The position of the hoses/loading arms should be adjusted, so as not to place undue strain on the components (the hoses themselves, ship's manifold connection, etc). The weather should be monitored before and during the operation -the operation being suspended in cases where high winds or electrical storms are expected. Crews should keep watch for leaks during the operation, being prepared to halt if leaks are detected. Precautions against electrical discharge need to be observed for electrical discharge between ship and terminal. Co-ordinate activities (or take precautions), for example, if hazardous activities are being undertaken in adjacent tanker berths. Do not allow tugs, helicopters, etc. to approach too dose during the operation (or suspend operations if they must). There should be joint formal agreement between the master of the vessel and the terminal authority on readiness to load/unload cargo. No transfer should take place before this. Both sides should monitor the operation and communicate throughout. 5 An oil installation contains a vessel that requires protection from fire exposure in the form of active or passive fire protection.(a) Identify TWO examples of passive fire protection to protect vessels. (2)Fire WallsFire doorsFire resistant coatingsThermal insulation(b) Outline why the metal legs of the vessel should be protected. (2)Fires can cause thermal weakening of steelwork and result in the collapse of structures, failure of equipment, and subsequent escalation of the initial event.(c) Outline how a fixed water deluge system could provide fire protection. (2)A fixed water deluge system could provide protection for a distillation column by extinguishing the fire, controlling the fire or by providing protection for the adjacent distillation columns with the cooling effect the fixed water deluge system provides(d) Identify TWO additional examples of active fire protection. (2)Foam SystemsWater Mist Systems

6 Outline the following failure modes that may lead to loss of hydrocarbon containment from storage tanks/vessels or pipelines:(a) creep; (2)Is slow movement under stress, made more severe with heat for long periods, especially with increases in temperature approaching melting points.(b) stress corrosion cracking; (2)Occurs under tensile stress and is worse in a corrosive environment at elevated temperatures.(c) thermal shock; (2)Cracking associated with rapid temperature change with different parts of an object expanding by different amounts where the stress overcomes the strength of the materials.(d) brittle fracture. (2)Rapid run of cracks through a stressed material with plastic deformation before failure caused by such things as repetition of inappropriate heating or pressurising rates7 Outline FOUR types of work activity associated with an oil platform that might require a permit-to-work AND give a reason in EACH case for the requirement. (8)

REPEATED

8 A large oil company is proposing to build a new oil and gas installation in the North Sea. The Process Safety Management Team is analysing past incidents and database records from the Oil and Gas Industry.Excluding active and passive fire protection systems, outline physical design features of the platform that would minimise risk to operating personnel in the event of a major incident. (8)Physical design features of an offshore platform that would minimise risk to operating personnel in the event of a major incident: Plant separationCompartmentalisationProtection of personnel / equipmentMeans of escapeBlow out panelsTemporary refuges with communications & control

9 (a) Identify TWO ways in which vapour clouds can be generated. (2)Sudden depressurizationRupture of vesselLoss of containmentUncontrolledbuildup of pressure(b) Outline how a vapour cloud explosion can be generated. (4)Vapour cloud explosion can be generated by;Confined / unconfined generationVapour cloud explosions may arise from vaporization of a release of liquefied gas from a ruptured vessel or pipeline(c) Identify the physical consequences of vapour cloud explosions. (2)Physical consequences of vapour cloud explosions;OverpressureFire & explosionResulting debris as airborne missiles

10 An operator is draining a flammable liquid from process pipework to a metal container. The supervisor is concerned about the possibility of an electrostatic charge forming and stops this operation until a risk assessment is undertaken. During this work activity:

(a) identifyfactors that influence the generation of the electrostatic charge; (4)Factors that influences the generation of the electrostatic charge:Hot Dry WeatherFlow rate, OverfillingLack of earthing / bondingLiquid instabilitySplash FillingNone Conductivity of materialsAgitationFiltersPressure Velocity(b) outlinepractical ways of minimising the formation of an electrostatic charge. (4)Practical ways of minimising the formation of an electrostatic charge:Humidification of the atmosphere Antistatic additivesReduce flow velocityIntrinsically safe equipmentBonding & Grounding of equipment & containersAvoid splash filling by submerging the fill pipe bellow the liquid level in the containerIncreasing the conductance of floors, footwear

11 An employee was seriously injured in an accident at work within an oil and gas installation.Identify the documented information that might be used by the investigating team to determine the causes of this accident. (8)Documented information that might be used by the investigating team to determine the causes of an accident;PTWPhotographsCCTV FootageWitness StatementsPrevious Health and Safety Meeting MinutesRisk Assessments / JSA'sMethod StatementsControl Room DataInternal incident report formsMaintenance recordsDisciplinary recordsSafe systems of work Audit / inspection reportsSOP'sD & A Test results

Identify the hazards associated with crude/unrefined oil during extraction, storage and processing.

The potential exists for a fire due to a leak or release of crude from heaters in the crude desalting unit. Low boiling point components of crude may also be released if a leak occurs. Inadequate desalting can cause fouling of heater tubes and heat exchangers throughout the refinery. Fouling restricts product flow and heat transfer and leads to failures due to increased pressures and temperatures. Cooling-tower water can be contaminated by process materials and by-products including sulfur dioxide, hydrogen sulfide, and carbon dioxide, with resultant exposures. Hazards such as those related to liquids and vapors when opening or draining pumps, valves, and/or lines, and during product sampling, inspection, and maintenance activities The potential for fire exists should hydrocarbon storage tanks be overfilled or develop leaks that allow vapors to escape and reach sources of ignition. Hazards related to product sampling, manual gauging, inspection, and maintenance activities including confined space entry where applicable.

Identify two types of risk assessment techniques.Two types of risk assessment techniques are:QUALITATIVE Risk assessment (Q)The qualitative method of risk assessment can generally be considered to not involve equations based on numbers to evaluate risk. Using a qualitative approach, a cable trailing in a walkway used by infirm older patients may be evaluated as being a "high" risk, because it is felt that somebody is bound to trip over it and the consequences would be severe. This is a useful, straightforward approach; though it is a relatively subjective method that can easily lead management to take action to control the risk, which is the purpose of risk assessments.

SEMI-QUANTITATIVE Risk Assessment (SQ)As discussed earlier (The 5 steps) it is half way between the simplest approach, which uses qualitative methods, and the quantitative approach, which uses probability statistics. Different people may have a different perception of risk, as a result of training, life experiences and background. Semi quantitative methods try to establish parameters that ensure a more consistent approach to risk rating and attempt to overcome individual differences. Risk can be rated according to the probability (likelihood) and severity (consequence) of harm resulting from a hazard by using a guided approach to assigning a value to probability (likelihood) and severity (consequence). Words commonly associated with the scale of probability (likelihood) and severity (consequence) are provided to guide the decision process. These words have a numeric value attached to them. The risk rating is acombination of the probability (likelihood) and severity (consequence) value.

Risk rating = Likelihood (Probability) x Severity (Consequences)Likelihood Is how likely a loss will occur as a result of contact with the hazard.Severity is the degree or amount of the resultant loss from contact with the hazard.Risk rating is the level of risk after control measures have been taken into account.

QUANTITATIVE (Quantified) Risk Assessment (QRA)This method is mainly used for complex risk and are based on equations related to probabilities. In its simplest form it may be used to establish probability of failure of a component that has safety critical implications, such as a pressure relief valve. Data is sourced from the manufacturer on how often a failure can be expected. If they provide information that they had experience of 10 failures out of 10,000 valves in the last year this would provide a quantitative probability of failure of 0.001 for the valve.Two of the techniques that can be used as a quantitative method are Event Tree Analysis (ETA) and Fault Tree Analysis (FTA). Estimated failure rates are used in a sequence of events to evaluate the probability of a resultant failure.Hazard and Operability Studies (HAZOP) can be used to identify the undesired events and the probability of failure rates may be worked out from the reliability rates of the components given by the manufacturer. They may also come from maintenance records of failure, be based on historical data or informed opinion.

Qualitative (Q) -using qualitative methods to determine frequency and severity.Semi-Quantitative (SQ) -where frequency and severity are approximately quantified within ranges.Quantified Risk Assessment (QRA) -where full quantification is demonstrated.As the assessment process moves through the stages, the level of detail will increase proportionate to the risk, taking into account the level of estimated risk within of tolerability; and the complexity of deciding on what (more) needs to be done to reduce the risk.Determining the Right Method of Risk Assessment: Risk assessment is used to enable us to decide upon appropriate risk controls so assessors should be suitably senior; qualified and competent. Start with a qualitative model and enlarge the model (moving to SQ and QRA) as needed.

Outline the typical 3x3 matrix that can be used to assess the level of risk.

Outline the type of action that should be taken in relation to corresponding risk level.

Outline the concept of ALARPIn all cases, there is a danger that the risk reduction methods may be decided upon for the wrong reasons -based on affordability rather than compliance with the law; and always the danger to stop when the legal requirement has been seen to be met. This is where "as low as reasonably practicable" comes in.ALARP covers risk at levels of some uncertainty:Unacceptable risk -risk cannot be justified at this level except in extraordinary circumstances (intolerable)ALARP (tolerability region) -at the higher risk end, risk may be undertaken only if a benefit is desired, and where risk reduction is impracticable, i.e., grossly disproportionate to the benefits gained. At the lower risk end, risk is tolerable if the cost to reduce it would outweigh the benefits,Acceptable risk -where it is necessary to demonstrate risk remains this low, there is no need for detailed working to demonstrate ALARP. At the lower end, this is negligible risk (tolerable).

All risks should be reduced to ALARP, and in some cases cost-benefit analysis may be needed to determine the appropriate level of controls.All levels of risk should be compared with oil and gas industry guidance and best practice.

Identify four properties of hydrogen.

Widely used in petroleum refining as a catalyst regenerator It is colourless and odourless and very light gas Despite its stability, hydrogen forms many bonds and is present in many different compounds. Three naturally occurring isotopes of hydrogen exist: protium, deuterium, and tritium, each with different properties due to the difference in the number of neutrons in the nucleus.

Identify four hazards of hydrogen. It is a highly flammable and explosive gas which forms ignitable mixtures in air over a very wide range of concentrations (between 4.9 %- 75%) It is not a toxic gas, but can asphyxiate at high concentrations. Hydrogen fire should not be extinguished till the source is shut off as it can reignite and explode. It burns with an invisible flame.

An oil and gas industry employer is reviewing tendering contracts for an offshore platform modification.

Identify the factors that should be considered when assessing the health and safety competence of a contractor.Factors that should be considered when assessing the health and safety competence of a contractor:HSE Policy'sCertifications - AccreditationsCommitment to HSE from senior management and how this is demonstrated - Safety Management system and implementation - Safety tools usedProject records - track record of similar projectsSafety Statistics - KPI's records and achievedRisk Management system and procedurePrevious incident investigations reportsCompetency of employees and project staffSafety Initiatives used with in the business and project

A pump containing flammable corrosive slurry has been stopped for maintenance.

An operator will prepare the pump for maintenance using a nitrogen supply, drain header and collection vessel. Using this information;

Outline EIGHT risks to the operator when preparing the pump for maintenance.Asphyxiation due to displacement of OFireExplosionIrritant/Corrosive substance Incorrect isolation of valves Incorrect Lock Out/Tag Out systemLack of gas monitoringBurst pressure lines causing injury

Identify the key stages of a workplace risk assessmentIdentify the hazardsDecide who might be harmed and howEvaluate the risks and decide on precautionRecord your findings and implement themReview your assessment and update if necessary

Outline the meaning of `as low as reasonably practicable' ALARP"ALARP" is short for "as low as reasonably practicable". ALARP involves weighing risk against the trouble, time and money needed to control it. Thus, ALARP describes the level to which we expect to see workplace risks controlled.ALARP allows us to set goals for duty-holdersIt is a key part of the general duties of the Health and Safety at Work Act 1974ALARP is about weighing the risk against the sacrifice needed to further reduce itTo spend 1m to prevent five staff suffering bruised knees is obviously grossly disproportionateButTo spend 1m to prevent a major explosion capable of killing 150 people is obviously proportionate

Outline the term Flash PointFlashpoint is the lowest temperature at which sufficient vapour is given off to "Flash" - that is, ignite momentarily, and not carry on burning, when a source of ignition is applied to the vapour.

At the flash point the application of a naked flame gives a momentary flash rather than sustained combustion, for which the temperature is too low

Identify the information that might be included on a checklist for an investigation following an accident

1. Obtain basic facts:Names of injuredWitnessesPlaceDate and timePersons in areaAscertain substances / chemicals involved InjuriesDamage to equipment

2. Establish circumstances:What happened? CausesEvents leading to incident CompetenceSupervisionBehavior

3. Preventive Measures - Review the risk assessment for the activity:

What precautions should have been in force? What training should those carrying out the activity have received?

What precautions were actually taken? Compare them with those which should have been taken.

What training was actually given? Compare it with training which should have been given.

4. Was the initial response adequate?:

FirefightingFirst aidContainment and spillage

5. Identify underlying causes:

Management or supervision failure? Lack of competence?Inadequate training? Shortcomings in original design of EquipmentFacilitiesAbsence of a system for maintenance.

6. Determine action needed to prevent a recurrence

Improve physical safeguardsIntroduce better test and maintenance arrangementsImprove work methods,Provide and use personal protective equipmentMake changes to supervision and training arrangements, Review procedures involving outside contractorsImprove inspection systems

Following preparation of a vessel for maintenance within an oil and gas installation a low specific activity - LSA - radioactive sludge was encounteredIdentify hazards associated with the sludge.

Hazards associated with LSA, radioactive sludge;Risk of fire, explosion.Toxicity to Divers

Outline FOUR control measures to reduce the risk to workers exposed to the sludge.FOUR control measures to reduce the risk to workers exposed to LSA sludge;Wearing of correct PPE - RespiratorMonitoring devices and personal sensorsExplosion proof certified equipmentSafety proceduresTraining

Identify TWO other pieces of workplace equipment where the sludge may be foundTWO other pieces of workplace equipment where the sludge may be found;Shale ShakersMud Pits

An oil and gas industry employer is reviewing tendering contracts for an offshore platform modification.

Identify the factorsthat should be considered when assessing the health and safety competence of a contractor.Factors that should be considered when assessing the health and safety competence of a contractor:

HSE Policy'sCertifications - AccreditationsCommitment to HSE from senior management and how this is demonstrated - Safety Management system and implementation - Safety tools usedProject records - track record of similar projectsSafety Statistics - KPI's records and achievedRisk Management system and procedure

Previous incident investigations reportsCompetency of employees and project staffSafety Initiatives used with in the business and project

Oil and gas installations use water for cooling and heating although it can be a hazard in some situations.

Identify risks with water AND give a practical example in EACH caseWhen stored under pressure as in Fire lines and steam water linesMay contain bacteria if not circulated e.g. dead end pipe legsMay cause an unstable reaction when mixed with some hydrocarbons

Outline operational control measures that could minimize the risk of plant damage or injury during start-up or shutdown of a process

Shutdown:Ensure work carried out under the controls of a PTWAll services are;StoppedIsolatedDrained downBlankedEmpty & drain hydrocarbon facilities, with all liquids, gases and residues removed leaving the plant safe to work onEliminate or control ignition sourcesSuitable supervision of the operationCertification of items that have been maintained or replaced

Start-up:

Establish all isolations reconnected, all blanks removedEnsure all safety systems are operationalEnsure all systems are tested before start-upComplete PTWEmergency plan - in place

During an inspection an external fuel storage tank is found without a bund.Outline the features which should be included in the design of a tank bund

Features which should be included in the design of a tank bund:

Ensure the maximum quantity of product can be contained within the bund at least 110%Make allowance for the space occupied by other tanksLocated away from traffic routesImpermeable baseNo drain valve- rain water should be pumped outLightening protection

(a) Petroleum storage tank fires have been reduced substantially by using floating roofs, buta fire risk may still exist.(i) Outline how a fire risk may still exist with floating roof tanks. (4)

The following fire risk may exist with floating tanks:Lightning strikesLeaks due to corrosion, damaged pipe workProduct overfill or high internal pressuresRainwater or snow load sinks the roof and exposes fuel vapours(ii) Identify TWO examples of fire protection systems used on floating roof tanks. (2)TWO examples of fire protection systems used on floating roof tanks:Fixed foam systemsPortable foam fire fighting systemsHose lines

Q10: Outline physical design features of an oil and gas installation that would minimizerisk to operating personnel in the event of major incident. (8)

Q11: A road tanker is being drive from an onshore refinery to a petroleum (gasoline)station. Outline control measures of the Traffic Management process. (8)

Q6: Welding is to be carried out on a broken pipe support bracket within a hydrocarbonprocessing plant. The plant does not need to be shut down to carry out the repair.Outline factors that would need to be considered before welding takes place. (8)

(a) Identify THREE properties of Hydrogen Sulphide H2S. (3)

(b) On an oil processing plant outline how activation of an H2S detection system, linked to a controlroom, could prevent a fire. (5)

A worker has requested a permit-to-work in order to replace damaged thermal insulation in anOverhead pipe rack that runs between two plants.(a) Identify THREE hazards associated with this activity. (3)

(b) Outline control measures that should be implemented to reduce the risks to the worker. (5)

1 Draining water from a Liquid Petroleum Gas (LPG) vessel needs to be controlled in order to prevent a Boiling Liquid Expanding Vapour Explosion (BLEVE).

a) Identify FOUR hazardous properties of LPG. (4)

b) Outline how a BLEVE can be generated in an LPG vessel. (8)

c) Other than a BLEVE, outline the risks when draining water from an LPG vessel. (4)

d) Outline control measure that minimize risk when draining water from LPG vessels. (4)

a) Identify the significance of the "fire triangle". (3)

b) Identify FIVE types of ignition source that may cause a fire to occur, AND give atypical workplace example of EACH type. (5)

(a) Outline TWO ways in which vapour clouds can be generated. (2)

(b) Outline how a vapour cloud explosion can be generated. (4)

(c) Identify the physical consequences of vapour cloud explosion. (2)

Outline the factors that should be considered when providing a means of escape inan oil and gas installation to enable all workers to reach a place of safety in the event of a fire.

An electrically powered hydrocarbon pump, operating at 900 C, has developed aleak.Outline the control measures that should be taken for the repair of the pump. (8)

1 A crude oil storage tank needs to be taken out of service for an internal inspection. Although tank inspection is hazardous establishing suitable control measures should prevent injury.With reference to the description above:

(a) outline risks associated with internal inspection; (4)

(b) identify THREE items of equipment, associated with the normal tank operation, that would needelectrical isolation prior to the inspection; (3)

(c) identify THREE ignition sources, associated with the preparation of the tank, that would need to be considered; (3)

(d) outlinecontrol measures, other than control of ignition sources, that should be in place before allowinginternal inspection of the tank; (8)

(e) identify TWO physical hazards the inspector would be looking for within the tank. (2)

(a) Give the meaning of safe operating envelope. (2)

(b) Identify FOUR operating parameters that are part of a safe operating envelope within an oil and gas plant. (4)

(c) Outline the failure mode thermal shock. (2)

A large induced draught fan is used to exhaust gases from a furnace. The hot gas flow is controlled through pneumatically operated vanes within the fan. The fan can be isolated from the process by hydraulically operating inlet and outlet valves. The fan needs to be stopped and isolated for electric motor and fan repairs.In relation to Lock Out Tag Out (LOTO) in this example:(a) identify FOUR residual energy sources that may need de-energising; (4)

(b) outline locations where locks and associated tags may need to be applied. (4)

Following preparation of a vessel for maintenance within an oil and gas installation a low specific activity (LSA) radioactive sludge was encountered.(a) Identify hazards associated with the sludge. (2)

(b) Outline FOUR control measures to reduce the risk to workers exposed to the sludge. (4)

(c) Identify TWO other pieces of workplace equipment where the sludge may be found. (2)

6 A hydrocarbon gas plant and nearby plant suffered catastrophic damage when a gas cloud exploded after coming into contact with an ignition source. The damage may have been minimised if an associated deluge system had activated and an emergency shutdown of the plant had been performed. The disaster occurred when a pressure safety valve was removed for maintenance and a blank was attached to the open pipework within a permit-to-work system. The blank was not tightened sufficiently and when the pipework was re-commissioned a flammable gas cloud leaked from the loose blank. Similar disasters may be prevented within the oil and gas industry through risk control in the form of barrier models.Hazard Consequence Hazard Control Barriers (Proactive Controls)Recovery Measures (ReactiveControls) TOP EVENT Barrier Model

(a) Using the description and the diagram above (the top event being the gas explosion), identify:(i) ONE hazard; (1)

(ii) TWO hazard control barriers; (2)

(iii) TWO recovery measures; (2)

(iv) ONE consequence. (1)

(b) Outline reasons for involving all workers in the development of barrier models. (2)

7 (a) Smoke is one product of combustion that activates an automatic fire detection system.Identify FOUR other products of combustion that may activate an automatic fire detection system. (4)

(b) Identify the two basic types of smoke detectors. (2)

(c) Outline the reasons for installing a heat detector instead of a smoke detector in a kitchen. (2)

9 Identify hazards that should be considered when planning diver operations beneath an oil and gas platform.

Factors that should be considered when planning diver operations1) The risks to divers: Drowning; divers and others involved could drown. Becoming trapped; e.g. by their own airlines or by moorings or stuck in a soft seabed. Problems with their breathing apparatus; such as faulty valves, incorrect gas mixture, loss of gas. Divers could develop illness during the dive; such as blackouts, decompression sickness, nitrogen narcosis (a state similar to alcohol intoxication) or oxygen poisoning. There could be communications errors leading to mistakes being made. Collisions could occur; e.g. vessel escaping from its mooring or from a remote operated vehicles, ROV in use. The effects of extreme environment; e.g. rough sea, changeable weather, cold, poor visibility. Seismic operations or simultaneous operations in the area of the dive.

11 During the construction of a new oil and gas installation many welds are used to join pipework to vessels and pipework to pipework.(a) Outline FOUR reasons why a weld may be defective. (4)

Most weld failures can be attributed to:_ Improper design of weld joint_ Poor selection of base materials and filler materials_ Inappropriate welding processes_ Residual stresses_ Ineffective or non-existent inspection procedures_ Welded components operating outside their safe parameters(b) Identify FOUR techniques used for inspecting welds. (4)

Non- Destructive Testing (NDT)Visual inspectionVisual inspection involves direct or indirect inspecting for surface condition, defects, roughness and/or dimensional changes. Despite many other more sophisticated NDT techniques, visual inspection plays an important role in the detection of surface flaws and damage. This can be done unaided or with the use of a microscope.Some signs of damage may be obvious (for example, pitting and large surface cracks), but some are not.Dye PenetrantThis technique uses a three-part dye penetrant (usually in aerosol spray cans) to dean the area and highlight a defect so that visual inspection can take place. It can be used on a wide range of non-porous materials, but only relates to surface defects.Step 1: The surface of the material to be tested is cleaned thoroughly, including the removal of any lubricants (oils or grease). This is carried out using a solvent cleaner (part of the three-part kit).Step 2: A penetrant dye (often a deep red colour) is then sprayed over the cleaned area, penetrating into any surface cracks or abnormalities. After a period of time (5 minutes-one hour) the excess dye is wiped away.Step 3: To make the dye visible, it is sprayed with a "developer" which is naturally white but absorbs the dye from the defective weld or surface, thus giving a deep red indication on the weld as to the location of any defects. Visual examination of these areas can then take place. Remember this is a chemical process, so a hazardous substance risk assessment will be required.

Magnetic ParticleThis technique works by magnetising the component and applying magnetic particles or ink. Any defect in the component will show as it distorts the magnetic field and the particles lie "differently". The defect tends to cause a concentration of the magnetic field which attracts more particles to it than the surrounding material.The test works only on ferro-magnetic materials such as steel. The surface does have to be clean. It detects surface cracks and subsurface cracks dose to the surface.

Eddy CurrentWhen a high frequency AC current is passed through a coil it sets up an alternating magnetic field. If the coil is placed on the surface of a Ferromagneticmaterial it sets up a current in the material (known as eddy current). Any discontinuity in the surface causes a variation in the eddy current. It another coil is placed adjacent to the first, it can detect the changes in eddy current and indicate the location of a defect. These changes can be calibrated and used to determine the depth of any defect.The method requires trained operatives to carefully interpret the results, and it can only work in the bulk of the material and not near any discontinuity, such as holes, openings or edges. It is also unsuitable for thin material as this prevents the formation of effective eddy currents.

2) NDT TECHNIQUES SUITABLE FOR SUB-SURFACE DEFECTSUltrasonicUltrasonic testing requires a generator to transmit ultrasound waves into a material so that they can be detected when they reflect from within the material.One advantage is that the generator is usually hand-held/portable, operating from its own battery supply. The ultrasound waves are generated in a probe or transducer that is moved across the surface.The ultrasound' travels into the material and is "bounced" back to a receiver mounted in the probe. The output is read on an oscilloscope, the results being interpreted by a skilled operative. Any defect will cause a variation in the return signal and this can be interpreted to indicate the depth of the defect.Its portability and flexibility make ultrasonic testing an important non-destructive testing technique. It may be in metals and on most non-metallic materials. Its ability to penetrate the material allows it to measure depth and so it is used with particular effect looking for corrosion in boilers, pipelines, etc.RadiographyRadiography requires a source of gamma or X-rays which are allowed to pass through the material and onto a strip of film. The radiation triggers a reaction in the film's emulsion which shows where any discontinuity/defect exists.It is used extensively in steel fabrication, such as welds on oil rigs, pipework and reactor vessels.Radiography requires a source of radiation, so there must be control of people's exposure to it. Distance and use of barriers are normally used to control the risk of exposure when testing is under way.

An operator is required to drain water from an LPG sphere.(a) Identify the main hazard associated with this operation.Hydrate formation can occur when draining water from pressurized Liquefied Petroleum Gas (LPG) spheres. This can lead to valves freezing, and if they are in an open position, LPG will be allowed to escape, which may lead to an explosion.

(b) (b) Identify the control measures that can be applied in order to reduce this hazard.The operation of draining water from LPG spheres should only be carried out by trained and authorized personnel using a sequential valve procedure.

There are around twelve stages in the process of commissioning a process plant or system. Identify SIX of those stages.1 The system configuration is checked (walking the line).2 The pipework and system integrity is checked.3 The instrumentation system is checked.4 All alarms are verified as working.5 All lines and vessels are flushed and cleaned.6 All ancillary equipment is inspected and assessed as to its adequacy.7 All instruments and vessels are calibrated.8 The start- up protocol is established.9 The shutdown protocol is established.10 Commissioning trials are undertaken.11 The plant is hooked up.12 The plant is handed over.

Many fixed and floating roof storage tanks have annular rims.(a) Outline what an annular rim is.The bottom plate in a storage tank is known as an annular plate. The annular plate usually sits on a foundation of hardcore or a concrete ring wall, and is joined to the walls of the tank. This junction between this bottom plate and the wall of the storage tank is known as the annular rim.(b) Explain what problems can be associated with annular rimsThe joint where the annular plate and the tank walls meet (the annular rim) is subject to constant stress. This is because the weight of the product within the tank wants to push the walls outwards whilst at the same time push the annular plate downwards. This creates a high level of bending stress. The quality of the foundations will also have a bearing on the downward deflection of the annular plate.A further complicating factor to this stress is the fact that annular plates are prone to corrosion attacks both on the outer side where the tank shell sits on the annular rim, and on the underside of the annular plate where trapped water may lie undetected. This corrosion, coupled with the prolonged stress, can lead to stress corrosion cracking and failure occurring without warning.

(c) Describe what an emergency shutdown system is and its function.Because the petrochemical industry processes large quantities of hazardous material within a contained environment, it needs to have in place systems which will either prevent loss of containment from happening or mitigate the consequences of such an event if it does happen. These systems are known as Emergency Shutdown (ESD) systems and take the form of various components, each of which is designed to deal with a particular scenario and bring it under control in a safe and effective manner.

Identify THREE typical actions an emergency shutdown system might perform if activated._ Shutdown of part systems and equipment_ Isolate hydrocarbon inventories_ Isolate electrical equipment_ Stop hydrocarbon flow_ Depressurize/blow down_ Activate fire-fighting controls (water deluge, inert gas, foam system, water mist)_ Activate emergency ventilation control_ Close watertight doors and fire doors

Explain why and when an emergency shutdown system might be bypassed.All emergency shutdown systems and fire and gas systems need to be tested, inspected and/or maintained on a regular basis to ensure they are functioning as required. These testing and/or maintenance procedures involve the temporary bypassing of safety system interlocks which would otherwise activate the emergency shutdown system when testing, inspection or maintenance activities were undertaken.

Describe the purpose and function of an interceptor.Interceptors are a means of collecting contaminated water before it is discharged to a foul drain or surface drain. Typically, interceptors have three separate chambers, with the divisions between chambers extending down to the bottom, and low level pipes connecting the chambers. This is so that when the contaminated water enters the first chamber it can separate (oil will naturally float on top of water) and be extracted. The water is then directed to the second andthird chambers via the low level pipe where any residual oil is also allowed to separate and be extracted. Finally, the water from chamber three is channelled into either a foul or surface drain, whichever is appropriate.

With regard to fixed and floating roof storage tanks, explain what erosion is and where it might be expected to occur.Erosion is the process of material being worn away by the constant movement of product flowing over the surface. Areas such as filling and discharge points, which experience large amounts of product flow, are the most vulnerable points.

Explain what hazards are associated with fixed roof storage tanks.Normally, tanks have a pressure- vacuum relief valve fitted on or near the top of the tank. This allows vapour or gas to escape or, in the case of a reduction inpressure within the tank, allows air to enter the tank. Consequently, the pressure- vacuum relief valve is a critical piece of equipment and the integrity of the tankis dependent upon it working properly. The weight of any liquid pumped into a tank will naturally apply outward pressure on the walls of the tank it is being stored in. Also, as the liquid builds up inside the tank, the atmosphere in the void needs to be vented out. If this does not happen the pressure will become unsustainable and the tank may rupture. The contra view is also true in that when a tank is emptied the liquid reduces and the void above the liquid needs to have air vented in so that a vacuum is not created. If the air inlet valve is faulty, and avacuum is created, this may well cause the tank to collapse. There are other factors which can cause increased or decreased pressure within the tank. These include:_ Storing a volatile product will cause gases to evolve and increase pressure._ Warm weather or direct sun on the tank will warm the product up and make it expand, thus increasing pressure._ Cold weather will cool the product down and cause it to contract, thus decreasing pressure.

With regard to floating roof storage tanks,(a) Explain what landing the roof is and what hazards are associated with it.Landing the roof is where the liquid in the tank falls far enough for the legs on the underside of the floating roof to land on the base of the tank. The void between the liquid and the roof will grow, which will allow a build- up of vapour to occur. This has the potential to cause a fire and/or an explosion. Another issue with landing the roof is that it causes a particular corrosion mechanism called fretting- related corrosion. This is where repeated contact on the base of the tank by the legs on the underside of the floating roof removes protective layers of rust scale that may have formed, resulting in increased corrosion rates.(c) Explain what control measures need to be taken if the roof is landed and why.If the roof is landed, it is important that enough time elapses to allow the space below the roof to become saturated with vapour so that it exceeds its upper flammable limit. This is because when product is pumped into the tank and the roof begins to lift, there is a chance that a spark may be generated between the tank wall and the roof seal. Having the vapour in the ullage saturated to beyond its upper flammable limit will ensure the vapour will not be ignited by any errant spark. The amount of time required to allow the vapour to become saturated may be as much as 24 hours.

Explain what a bund is and its purpose and function.Where storage tanks hold a liquid product there is always the possibility that the tank will rupture and spill its contents. Consequently, contingencies should be in place to control such a situation. This is where a containment wall, known as a bund, is built around a tank, or group of tanks to contain any spillage that may occur until such time that it can be dealt with. The bund also stops the product spreading too far, seeping into the ground, or seeping into the drainage or waterSystems. It also reduces (although it does not eliminate) the risk of fire and/or explosion.

Define what a BLEVE is and describe an example of how a BLEVE might develop.A BLEVE is a Boiling Liquid Expanding Vapour Explosion. An example of how a BLEVE might develop is when a vessel is partly filled with pressurized hydrocarbon liquid (e.g. Liquefied Petroleum Gas). It will have a certain amount space above it filled with vapour, and if the vessel is subjected to a fire the pressure in the tank will increase due to the liquid going above its boiling point and turning into a vapour. The pressure relief valve on the tank will allow the overpressure to be vented to atmosphere in the first instance, but this will reduce the amount of liquid in the tank still further, and the potential for the flame to engage with a section of the tank containing vapour and not liquid will increase. If this happens, the tank wall will weaken at this pointas the heat transfer to vapour is much less efficient than it is to a liquid. The result is likely to be a sudden and catastrophic failure of the vessel, with a discharge of vapour followed by an explosion when the vapour reaches the flames. This is a Boiling Liquid Expanding Vapour Explosion (BLEVE).With regard to hazardous areas,(a) Explain why hazardous areas are categorized into different zones.

Gases and vapours can create explosive atmospheres. Consequently, areas where these potentially hazardous airborne substances present themselves are classed as hazardous areas so that appropriate controls can be implemented. However, the frequency with which these substances present themselves is also a factor in determining the appropriate level of control. For example, if the presence of a flammable vapour only happens once every three months, it would not be sensible to apply the same level of control as to an area where a flammable vapour is present all day, every day. The answer is to apply a classification to areas called zoning which places appropriate controls on the type of equipment that can be used in that area and which potentially can create a source of ignition, particularly electrical equipment, which reflects the risk involved.(c) Explain why equipment should be categorized for use in different zones.The issue with electrical equipment is that it normally creates sparks, either as part of the brushes coming in contact within the rotating armature, or when a switch is activated. Either event can ignite any flammable gas present in the atmosphere in the vicinity of the equipment. Consequently, manufacturers have designed specialized equipment which overcomes, in various ways, the issue of having sparks which are exposed to the local atmosphere. The particular solution which is incorporated into each piece of equipment is signified by a code which is marked on the equipments product identification label.There are two main types of boiler used to heat water. Explain what they are and how both types work.A fire tube boiler is one which generates hot gases which then pass through a number of tubes before being expelled out of the flue. These tubes run through a sealed and insulated container of water and the heat from the gases is transferred by thermal conductivity to the water, which then turns to steam. The steam from the boiler then exits through a tube at the top of the container. Water tube boilers have basically the opposite configuration of fire tubes. In a water tube boiler, a number of tubes run through the furnace part of the boiler. This heats the water inside the tubes, which turns it to steam.

In relation to boilers and furnaces, explain what flame impingement is and the potential consequences if it is not rectified.Flame impingement is where the flame produced by the burner, within the boiler or furnace, comes into contact with the surface being heated. This is something which the design of the boiler or furnace does not normally allow. This is because the temperature of the surface being heated should always remain within prescribed parameters and direct flame contact can lead to these parameters being exceeded. If this occurs there tends to be a gradual build- up of carbon on the inside of the tube at the point where the flame is in contact. This layer of carbon acts as an insulator between the water product inside the tube and the surface where the flame is impinging on it, compounding the effect the flame is having on the heated surface of the tube. If this process is allowed to continue, it can lead to the tube eventually becoming blocked, resulting in the potential rupture of the tube.Explain what total dissolved solids are and how they can be controlled.Total dissolved solids are substances, such as minerals, salts and metals, which are held in a suspended form within water. If these solids are of a sufficient concentration within the water used in a boiler system, they can attach themselves to the inside of boilers and, over time, build up to form scale. The first action in controlling the effects of total dissolved solids is to maintain the solids below a certain limit with the water. This is done by testing the water with a TDS meter or conductivity meter. This measures the conductivity of the water which is an indication of the measure of total dissolved solids within the water. The greater the concentration of total dissolved solids in the water, the greater the likelihood is that the dissolved solids will precipitate out of the water and form scale on the inside of the boiler. If concentration levels are deemed to be too high, it is necessary to drain some of the water from the system, called boiler blow down, in order to remove some of those dissolved solids and keep the total dissolved solids concentration below the level where they will precipitate.