ALARP

1. Identify Recover HEMP Assess Control ALARP HEMP and ALARP Training

2. Objectives of HEMP & ALARP Training • Increase Awareness of HEMP Concepts • Develop a common understanding of ALARP Principles These topics are covered in more detail in: HSE 0026 – Hazards and Effects Management Process (HEMP and ALARP)

3. Hazards and Effects Management Process (HEMP)

4. HSE Management System

5. Individual HEMP Responsibilities

6. Hazards and Effects Management Process

7. Risk Assessment Matrix & Major Hazards A5 B5 Major Hazards are those that havehigh riskor high potential consequences

8. Major Hazards & HSE Cases SEPCo Policies require that operations and facilities with Major Hazards have documented HSE Cases. An HSE Case is a facility or operation-specific demonstration that the HSE risks from Major Hazards are managed to As Low as Reasonably Practicable (ALARP) and a description of how SEPCO’s HSE Management System is applied to HSE hazards.

9. Bow Tie Terminology

10. Bow-Tie Example Threat 3 Threat 3 Consequence 3 Consequence 3 H H H - - - Loss of Loss of Threat 2 Threat 2 Consequence 2 Consequence 2 Containment Containment 01.06 Hydrocarbon Gas 01.06 Hydrocarbon Gas 01.06 Hydrocarbon Gas Threat: Corrosion Threat: Corrosion Consequence: Explosion Consequence: Explosion Process Process Control Control Source Source Ignition Ignition Corrosion Corrosion Management Management RECOVERY RECOVERY MEASURE MEASURE BARRIER BARRIER ESCALATION ESCALATION ESCALATION FACTOR FACTOR FACTOR FACTOR Installation Installation Temporary Temporary Change in Change in MOC MOC Inspection Inspection Field Field of of Equipment Equipment operating operating Process Process Program Program Inspection Inspection Temporary Temporary Standard Standard environment environment Equipment Equipment ESCALATION FACTOR ESCALATION FACTOR ESCALATION FACTOR ESCALATION FACTOR CONTROLS CONTROLS CONTROLS CONTROLS

11. Best Practice Bow Ties There will be a single bow tie for each major hazard in SEPCo that sets the minimum required barriers/recovery measures to manage risks. These are Best Practice Bow Ties. • Each Asset or Operation will: • review applicable best practice bow ties to consider and document any unique threats/consequences that may exist at their location. • benchmark the effectiveness of the barriers at their location against the performance expectation included in the best practice bow ties. • Identify gaps and implement remedial actions to improve the barriers / recovery measures and reduce the risk to ALARP.

12. Hazard Register Those items with an Environment rating are E-aspects. Those that are Major in the Environment column are “Significant E-aspects” Those items with in the Health column were identified during health risk assessments, and consider chronic and acute health exposures The Hazard Register describes hazards, their associated risks, and how the hazards are managed.

13. HEMP Tools The most commonly used HEMP tools are highlighted

14. Risk Management Hierarchy Identify Recover HEMP Assess Control In order of preference: • Eliminate – remove the risk altogether • Substitute – use a lower risk alternative • Isolate / Separate– keep the hazard away from where it can cause harm • Engineering Controls – Prevention – design such that the risk of an incident is minimal • Engineering Controls – Mitigation – design such that if an incident occurs, it is mitigated • Procedural Controls – provide procedures to reduce risk • Personnel Protective Equipment – provide protection to reduce potential for injury

15. HEMP Study Interactions Audits Incident Investigation Procedures Variances HEMP Study Project HSE Plan Regulations Designs HSE Case MOC Process

16. Asset Responsibilities for HEMP Studies • The owner of the HEMP study is the accountable party for the asset or operation covered by the study. The owner is accountable for: • Maintaining the study • Updating the study at the requisite frequency • Making sure actions from the study are documented and closed • Studies done for design considerations are kept by engineering. • Studies done for operational considerations are kept by Operations. • Action items resulting from SEPCo HEMP studies shall be tracked and closed out using IMPACT.

17. Human Factors Engineering Work Environment Work Environment Organizational Structure Organizational Structure (lighting, noise, chemical exposures, climate) (lighting, noise, chemical exposures, climate) (job design, communication, task) (job design, communication, task) Individual Constraints Individual Constraints (age, size, training, skills, intelligence) (age, size, training, skills, intelligence) Sensory Information Sensory Information Action Action Human Human TASK TASK Interfaces - Displays Displays Interfaces - Controls Controls Output Output Input Input Machine Machine The Group Minimum Health Management Standard states: Human factors engineering principles are to be considered and applied during the early design stage of new facilities projects where design can have a critical impact on equipment usability and user safety or health. The following picture illustrates how a human interacts with a technical component and the factors that can influence his/her performance.

18. As Low As Reasonably Practicable (ALARP)

19. ALARP TRIANGLE

20. Risk Perception - Types of Fatalities, US, 2001 Match the causes to the listed number of deaths/year (data from the National Safety Council). Cause Accidental Drowning (Non Transport) Transport Accidents Contact with venomous animals & Plants Lightning Legal Intervention Falls Assault Accidental Poisoning Exposure to smoke, fire and flames Number of deaths /year 47,288 20,308 15,019 14,078 3,309 3,281 396 61 44 Answers Transport Accidents Assault Falls Accidental Poisoning Exposure to smoke, fire and flames Accidental Drowning (Non Transport) Legal Intervention Contact with Venomous animals & plants Lightning

21. Relative Risk Tolerability Tolerability Tolerability Threshold Threshold Threshold Increasing Individual Risks and Societal Concerns Oil and Gas Extraction Transport Accidents Assault Falls Accidental Poisoning Drowning Legal Intervention Venomous animals & plants Lightning

22. Actual Vs Perceived Risks Which “hazard” results in more deaths per year? 45 Deaths in 1996 59 Deaths in 1995 76 Attacks Worldwide 49 Attacks USA 1 Death USA 2001

23. Risk Misperception .. Mountaineering Council for Scotland said “These two men were very aware of safety issues and did not have a reputation for taking any sort of risks”

24. Problem Framing An outbreak of disease is expected to kill 600 people. Two alternative programs have been proposed: Which program would you select?

25. Rephrasing the Problem Depending on the problem phrasing, people made different decisions:

26. ALARP Definition Screening Criteria • From quantitative risk analysis ALARP ? • Cost Risk • • • • To reduce a risk to a level that is as low as reasonably practicable involves balancing reduction in risk against time, trouble, difficulty and cost of achieving it. This level represents the point, at which time, trouble, difficulty and cost of further reduction measures become unreasonably disproportionate to the additional risk reduction obtained.

27. ALARP: Road Transport Example When does the cost of further reduction measures become disproportionate to the additional risk reduction obtained?: • No specification • Does not meet legal requirements • No regular vehicle maintenance • Provide recovery measures, e.g. roll-bars, seat belts • Provide mitigation, e.g., speed limiter, 4WD • Provide driver training • Provide safe driving incentives • Journey management system • Road transport management system • Avoid journeys by planning • Build black-top roads • Use aircraft transport only • Automate production facilities - eliminate routine driving • Stop production Intolerable SCREENING CRITERIA ALARP region ALARP probably in this area

28. ALARP and Risk Tolerability – 4 Levels of Risk The HEMP Standard describes the Tolerability Threshold, Evaluation requirements and Demonstration requirements for each of these levels of risk.

29. ALARP and Risk Tolerability Decision-Making ALARP and risk tolerability decisions are required when changes affect hazard management. • For example: • Variances to SEPCo requirements • Identification of a new hazard, or a change in risk of an existing hazard • Operating without barriers/recovery measures or operating in a way that deteriorates a barrier • Making a change that impacts an existing barrier • Selecting a new concept • Adding additional risk such that the cumulative risk threshold may be approached

30. Decision Making Framework Outline Decision Level Means of Calibration Technology Based Well established solution Codes and Standards Well understood risks Verification Drivers Peer Review Benchmarking Very novel Higher level of Management Significant trade-offs Internal Stakeholder Consultation Strong views and perceptions Values Based External Stakeholder Consultation

31. Decision Making Framework Decision Level Higher level of Management

32. Following the Decision-Making Process Determine decision type Evaluate Calibrate Demonstrate Define decision What do you need to decide? Type A? Type B? Type C? Use the right-hand side of the framework. Evaluate at the Cumulative, hazard, threat, and failure mode levels Use the left-hand side of the framework. Demonstrate the decision as defined in the HEMP Standard

33. Type A Decision Example Determine decision type Evaluate Calibrate Demonstrate Define decision How to design a ladder for accessing a work platform. The decision context is Type A because this decision is well-understood. The decision bases are Codes and Standards (ASME, SEPCo design schedules), Good Practice, and Engineering/Expert judgment of the designer. You have to design a new ladder to access a work platform. How are ALARP principles applied? cumulative risk level – N/A hazard level - consider whether a new hazard is being added or a change in risk is being proposed for an existing hazard. Consider the risk management hierarchy. threat/consequence level - verify against the personnel at heights bowtie. failure mode level – N/A Since this decision is well understood (Type A), the means of calibration is Codes and Standards, so no additional consultation is required Since this decision is well understood (Type A) reference is made to the Hazards and Effects Register, and no additional demonstration is required other than thenormal project documentation such as as-built drawings and calculations.

34. ALARP Thinking The picture shows an example of a ladder and cage. Has it been designed to reduce the risk to ALARP?

35. ALARP Thinking - Risk Reduction Ideas (RRIs) Consider the Evaluate step. Develop Risk Reduction Ideas for the preceding example. Remember the Risk Management Hierarchy! • Eliminate • Substitute • Isolate / Separate • Engineering Controls – Prevention & Mitigation • Procedural Controls • Personnel Protective Equipment

36. Ranking Tool for selecting options = Cost multiplier Benefit multiplier Effort multiplier Score X X Sample Score assignments

37. Selected Option

38. Type B Decision Example A pressure vessel has been noted to have a reduction in wall thickness from corrosion. Should it be kept in service? How would you make this decision?

39. HEMP Web Site Available via the HSE in SEPCo Web Portal or directly at http://sepco3.shell.com/sites/hse/hemp/

40. Summary of HEMP & ALARP Training • You should now be aware of HEMP Concepts • We all should have a common understanding of the ALARP Principle