FIRE AND PROCESS SAFETY

NEWSLETTER
4th Quarter 2012
Recognizing Process Hazards
and Latent Conditions
Table of Contents

Field visits, or walkabouts, are a common tool used

by leaders at all levels to engage the workforce and
demonstrate that OE is a core value. These visits
have typically been used to observe behaviors that
impact personal safety performance. While these
visits also provide an opportunity for leaders to
demonstrate their commitment to process safety
risk mitigation, process hazards and the latent
conditions that can potentially lead to serious
process incidents are much more difficult to
recognize. Finding these potential issues takes a
different focus and level of rigor when visiting field
operations.
Latent conditions can be defined as existing
conditions that may lie unrecognized until combined
with another upset condition (latent condition or
active error) to result in an incident. (Figure 1)

Figure 1

Recognizing Process Hazards and Latent Conditions

Inherent Hazards in Hydrostatic Testing

Designing Procedures for the Performer

Organizational Capability Process Safety Program

Proof of Concept Underway

Process Safety Increase Your Fluency in 2013

Gas Detector Location Guidance

LPG BLEVE Emergency Response Guidance

Document Developed

Risk Reduction Unless Unreaonable Means

of Deomonstration

11

Whats wrong with this picture?

13

Team Members

14

th

Fire and Process Safety Newsletter

4 Quarter 2012

Proprietary Information, Authorized Use Only

Latent conditions could be the managerial

influences and social pressures that make up the
culture (the way we do things around here), which
may affect the design of equipment or systems, and
may stem from insufficient supervisory oversight.
They tend to be hidden until uncovered by an
incident, possibly due to several latent conditions
combining in an unforeseen way.

Potential sources for loss of containment events

have to be envisioned with the failure of another
barrier. In this instance (Figure 2), a block valve
was closed and locked out as part of the Safe Work
Practice
preparing
this
pump
location
for
maintenance. However, the blind flange was not
fully bolted to the piping as required by an
approved standard. If the block valve were to leak
or if the lock-out was removed improperly, a loss of
containment could occur. The Operational Discipline
to consistently comply with all codes and standards
should ensure that all bolt holes are utilized to
properly tighten connections, even if the outage is
temporary.

The goal should be to identify these latent

conditions before they can escalate into a potential
process safety incident. To do this, we need to
change the way we look at hazards when we go out
into the field. We still have to look for hazards and
behaviors that can impact personal safety, but we
must broaden our search for potential process
safety incidents. The Hazard Identification Tool is
great for helping identify hazards that can lead to
potential
immediate
and
certain
safety
consequences. However, it is harder to use on those
potential future and uncertain scenarios.

Hazard Identification Tool

Figure 2
Figure 3 highlights the second focus area - potential
escalation of the process safety consequences. If
there is a gas release in the area, ignition
prevention measures could stop the scenario from
escalating into a fire or explosion.
One such
measure is by installing electrical equipment that
could be a source of ignition in electrically classified
enclosures with purge systems. These purge
systems act as safeguards that prevent the gas
from entering and coming into contact with the
electrical equipment that may result in an ignition.
However, those safeguards have to be maintained
in an asset integrity program and checked on
through routine operator duties. An inadequate
purge by itself is not a problem. But it is a latent
condition that could combine with a gas release
from another source leading to a fire or explosion.

Generally, there are four areas of focus to help

identify potential loss of containment scenarios
during a field walk.
1. Identify the potential source of a loss of
containment event.
2. Identify latent conditions that could allow
loss of containment events to escalate into
more severe process safety consequences
fire, explosion, toxic impact, etc.
3. Review the stewardship of our safeguards
(both preventive and mitigative) are they
still effective?
4. Identify non-process safety hazards that
could be a cultural indicator and relate to
process safety as an Operational Discipline
issue.

th

Fire and Process Safety Newsletter

4 Quarter 2012

Proprietary Information, Authorized Use Only

supports for a water system were inadequately

designed or did not follow the appropriate technical
codes and standards. Effective application of
Operational Discipline for this installation (There is
always time to do it right), would not have
allowed this construction technique in the field. The
workforce must understand that all of our
processes, from Facilities Design and Construction
to Management of Change and Asset Integrity, are
there to prevent incidents. Without the operational
discipline to effectively execute OE processes, these
types of deviations may become normalized when
working with other more hazardous materials.

Figure 3
Another
common
safeguard
that
requires
stewardship from design and installation through
operation and maintenance is a Pressure Relief
Device (PRD). In the picture below (Figure 4), there
appears to be a bushing and a reduced pipe size
attached to the flange on the outlet of the
conventional, spring loaded relief valve.
This
restriction in the outlet piping could prevent the
device from effectively relieving the pressure from
the system it is protecting during a future and
uncertain overpressure scenario. Luckily, in this
instance, the Pre-Startup Safety Review did catch
this installation error before the system was placed
in service.

Figure 5
So in review, what can be done to identify these
types of issues / conditions?

Understand what a Latent Condition is and

its role in potentially leading to an incident;

Actively look for inappropriate application of

technical codes and standards in the field;
and

Challenge/verify
safeguards

the

effectiveness

of

If latent conditions with a potential process safety

impact are found, consider sharing them with ETC
HES Safety Technology Unit for potential inclusion
in this newsletter. Better understanding and
identification of latent conditions will drive increased
process safety performance across the Enterprise.

Mike Kelly
Figure 4
Figure 5 is an example of the last focus area
category, which is identifying a hazard indicative of
a broader cultural issue. In this case, piping

th

Fire and Process Safety Newsletter

4 Quarter 2012

Proprietary Information, Authorized Use Only

Inherent Hazards in
Hydrostatic Testing
procedure, assemble the equipment correctly and
ensure personnel are out of the line of fire.

Hydrostatic testing (hydro-testing) is performed to

assess the fitness for service conditions of vessels,
piping and pipe components, and is performed
safely thousands of times a year.
During
hydrostatic testing, energy (in the form of pressure)
is added to the system at elevated levels. Normally
this energy is safely contained within the equipment
resulting in a successful test.
Occasionally the
hydro-test will fail due to anomalies in design,
manufacturing,
or
incorrectly
assembled
connections. This type of failure usually shows up
as a leak. However, a hydro-test can result in a
catastrophic failure with a sudden release of energy,
placing personnel in danger. Injuries and even
deaths have occurred during hydro-testing.

Pictures (Figures 1 and 2) in this article illustrate

the failure of a piping segment during hydrostatic
testing at a non-Chevron facility, which led to
three operator injuries.
A piping fabrication
consisting of 24" sch. 30 (0.562 wall thickness)
pipe and fittings was in the process of being
hydro-tested when the failure occurred. The
fabrication consisted of approximately 80 linear
feet of piping. The hydrostatic test pressure
specified was 2160 psi using water as the test
media. When the test pressure reached 1740 psi,
a 90 elbow suffered a catastrophic failure.

There are three basic types of pressure tests that

differ by their respective purposes, pressure and
duration.
A brief description of each type of
pressure test is as follows:

Spike Test - is used to verify the structural

integrity of pipelines with time dependent
anomalies.

Strength Test - is used to establish the

maximum operating pressure limit of a
pipeline segment.

Leak Test - is commonly used to determine

that a process or piping system does not
show evidence of leakage.

Hydrostatic testing should be conducted following

Chevron Engineering Standards such as PIM-SC3541-D,
Hydro-testing
of
Onshore
Piping
Systems, or PPL-EN-700, Inspection and Testing,
which references ANSI/ASME B31.4 for hydrostatic
testing of liquid lines or ANSI/ASME B31.8 for
testing of gas lines.
The American Petroleum
Institute (API) Recommended Practice (RP) 1110,
Pressure Testing of Steel Pipelines for the
Transportation of Gas, Petroleum Gas, Hazardous
Liquids, Highly Volatile Liquids or Carbon Dioxide,
provides guidelines for developing hydro-test
procedures and recommended equipment for
conducting the test. These piping codes require
hydrostatic test pressures high enough to stress the
pipe up to 90% of specified minimum yield strength
(SMYS), depending on maximum design pressure
and pipe class. These stress levels are high enough
where any anomalies in a pipe segment could result
in sudden catastrophic release of stored energy.
This is why its critical to follow the correct test

Figure 1

Figure 2

th

Fire and Process Safety Newsletter

4 Quarter 2012

Proprietary Information, Authorized Use Only

How can you apply learnings from this

incident to prevent a similar incident in your
location?

Of the four operators attending the hydro-test, two

received severe injuries caused by impact with test
equipment being propelled by the water release and
one other received a minor injury. This incident
could have had more severe consequences if the
test media used was a compressible fluid such as air
or nitrogen.

When planning and conducting hydrostatic testing,

ensure that qualified personnel are used to evaluate
hazards, develop procedures, and perform the
testing.
Pre-job safety meetings should be
conducted to ensure that all personnel are aware of
the hazards and are familiar with the applicable test
procedures.
Procedures
should
address
all
necessary precautions to minimize exposures to
personnel and the environment, including the
establishment of exclusion zones. Procedures should
also discuss measures to restrain temporary piping,
hoses, and other equipment used during the test;
as well as response plans in the event of a test
failure.

Lessons Learned
This incident illustrates the importance of
understanding the hazards inherent with
hydrostatic tests and how failure to take
preventive measures can result in serious
incidents. Frequently performed tasks that seem
routine can lead to a false sense of vulnerability.
This is why its imperative that each task be
analyzed through a robust job safety analysis,
including use of the Hazard Identification Tool.

Arturo Seyffert and Allen Pendergrass

Designing Procedures for

the Performer
step is worded in an ambiguous way, leaving it up
to the operator to interpret what actions need to
take place to complete that step in the procedure.
The technical writing guidance and supplemental
tool steers procedure writers away from situations
like the one described above and provides
alternative ways to write clear and concise
procedural steps. Instead of using vague language,
procedure steps should be written in a clear and
concise manner. Instead of perform visual
inspection of equipment, the procedure should be
specific as to what needs to be inspected on the
equipment (i.e., electrical cord fraying, secure hose
connections, integrity of seals, etc.)

Findings from major incident investigations in the oil

and gas industry indicate the most frequent root
causes cited are related to the use of inadequate
procedures or a failure to follow procedures. The
Chevron Major Incident Study (MIS) has also
identified the root cause category Procedures and
Safe Work Practices as one of the top causes
leading to major incidents over the past several
years.
As part of an ongoing research project, ETC Safety
Systems has developed Human Performance
Guidance
intended
to
incorporate
human
performance attributes into the development and
review of operating and maintenance procedures.
Part of this includes an accompanying evaluation
tool used to review the quality of existing
procedures against the established guidance
criteria.
What is it?
The technical writing guidance and supplemental
tool are provided as optional resources for those
involved in writing, reviewing and updating
procedures. The guidance provides practical tips on
how to effectively write procedures that are easy to
understand and follow.
The objective of the
document is to assist in simplifying complicated
subjects to avoid confusion, therefore minimizing
opportunities for human error.
For example, a procedure could instruct an operator
to perform visual inspection of equipment. (Figure
1) What does that really mean? The procedural

Figure 1

th

Fire and Process Safety Newsletter

4 Quarter 2012

Proprietary Information, Authorized Use Only

The guidance assumes a system for managing

operating and maintenance procedures is in place,
and supports already established requirements,
consistent with the OE Corporate Required Standard
for Operating Procedures.

PSM Resources Site.

Information listed on the
website provides all the instruction on how to apply
the tool.
Support from ETC personnel can be requested to
facilitate a half-day training session dealing with the
application of the human performance style and
writing principles, or to help procedure writers
evaluate and modify new and existing procedures.
For Human Performance questions or additional
resources, contact Lani Marshall (ETC Safety
Systems Manager).

How does it work?

The Human Performance guidance tool can be used
to evaluate existing procedures, as well as to help
writers develop new procedures. The evaluation tool
(Figure 2) consists of a checklist in which the
procedure reviewer identifies whether the procedure
complies or does not comply with identified
procedure writing best practices. Compliance with
these best practices contributes to an overall score.
Higher score rankings translate to procedures that
have been written following best practices.
In October, the San Joaquin Valley Business Unit
piloted the procedure evaluation tool on their local
procedures.
Evaluation
participants
included
personnel involved in writing, checking, and
reviewing procedures. The checklist tool was
successful in identifying opportunities in human
performance writing improvements for each
procedure and proved valuable as a guide when
reviewing for usability.
Although business units are not required to
incorporate the use of this tool, it would be
beneficial for them to identify some higher risk
operations and utilize the tool to evaluate those
associated procedures.
If reviewing existing
procedures using this tool averts at least one
incident at each location, the time and effort spent
in the review would have been worthwhile.
Where can I get more information?
The Human Performance Guidance Designing
Procedures for the Performer and tool Procedure
Quality Review Evaluation Form can be found on the

Esau Perez and Michele Seger

Organizational Capability
Process Safety Program Proof of Concept Underway
critical process safety competencies (e.g., incident
investigation & reporting, measurement and
metrics, hazard identification and risk analysis,
management of change, emergency management,
and auditing) for the individuals in the program.
The basis of the competency development will build
on established internal & external training courses,

Global Workforce Management is partnering with

Upstream and Gas; Operations; Corporate Health,
Environment & Safety (HES); ETC HES; and
Facilities Engineering (FE) on a proof of concept
project to develop Process Safety Engineers utilizing
a 12 to 18 month immersion program.
The
objective of the program will focus on enhancing

th

Fire and Process Safety Newsletter

4 Quarter 2012

Proprietary Information, Authorized Use Only

plan. The curriculum is designed to suit the diverse

needs of Operations, Facilities Engineering, and HES
personnel. Presently, the proof of concept project
team is completing course development work, and
is preparing to receive participants at the ETC
Briarpark office in Houston as early as 1Q13.
Participants will be nominated by their home
organization with an expectation that only
experienced Company personnel with process safety
responsibilities in their current or future positions
will be enrolled.

and it will include a robust series of mentored

experiences. Program participants will be paired
with a variety of subject matter expert mentors and
will
be
given
opportunities
to
complete
joint projects with their mentors. Eventually, they
will complete independent work under mentor
supervision.
The intent of the program is to provide participants
with experiential learning opportunities directly
relevant to their home organization; to engage with
mentors in process safety activities that will benefit
their business units; and to provide them with a
guided, accelerated learning and development

Ellen Leonard

Process Safety Increase

Your Fluency in 2013
The ETC HES Safety Technology Unit produced a
Process Safety wall calendar and distributed many
of them at the 2012 OE Forum in October. The
theme
of
the
2013
calendar,
Process
Safety.Always, highlights different elements of
Process Safety.
Twelve
case
studies were
chosen
to
be
representative of major industrial incidents. Each
month, one of the case studies illustrates a
contributing root cause and its relationship to a key
Process Safety element. For example, the 1984
incident that occurred at a Union Carbide plant in
Bhopal, India, had a contributing cause, Failure to
manage change in a manner to support safe
operations. For that month, the key message is,
Always follow the management of change process,
and some of the fluency points address technical
rigor of functional reviews, understanding the
technical basis of the change, and updating critical
information.

The calendar is intended to increase Process Safety

fluency and to assist those who see it to remember
the Tenets of Operation are based on two key
principles:
1. Do it safely or not at all
2. There is always time to do it right.
For more information about how you can receive
calendars, please send a message to Cindy
Roseberry at Croseberry@chevron.com.

Ellen Leonard

th

Fire and Process Safety Newsletter

4 Quarter 2012

Proprietary Information, Authorized Use Only

Gas Detector Location

Guidance
The placement of fire and gas detectors has always
been a challenging task for engineers because the
number of detectors needed, especially for outdoor
applications, depends on the anticipated size of the
leak; orientation and direction of the leak; weather
conditions; and several other factors.
Technological
developments,
innovation,
and
response philosophy continue to make this an
inexact science. Unlike smoke and heat detector
placement, which follow NFPA 72, National Fire
Alarm and Signaling Code, there are no specific
codes or standards for placement of gas detectors.
More recently, the International Society of
Automation (ISA) issued Technical Report ISA-TR
84.00.07-2010, Guidance on the Evaluation of Fire,
Combustible
Gas
and
Toxic
Gas
System
Effectiveness, which provides guidelines for
locating devices using performance based concepts.

Categorize
Leak Sources

Verify/Review

Locate Leak &

Category Sources
on Layout Drwg

A recent study from the UK Health & Safety

Executive (HSE) shows that between October 1992
and March 2002, the overall detection rate of leaks
was only 60%.1 The ETC Fire Protection Team is
nearing completion of a prescriptive approach
guidance document to ensure a consistent
methodology for the placement of fire and gas
devices, and to increase the probability of detecting
minor leaks. Flame detectors (a.k.a. optical fire
detectors) have a definite cone of vision and are
not discussed further in this article.

F&GS Sensor
Placement

Fire and Explosion Analysis

Process Flow Diagrams

Heat and Material Balances

Equipment Lists (with

inventory information)

Equipment Plot Plans

Drwg Review

F&GS Sensor
Placement in 3D
Model

Model Review
Comments

It is important to note that gas detectors are

intended to detect a wide range of leak scenarios.
The UK HSE defines minor leaks as gaseous or two
phase leaks of less than 0.1 kg/s in less than 2
minutes.1 The guidance document being developed
requires a thorough review of the following:

PFD, H&M
Bal., P&ID,
Area Class.
etc

Identify Leak
Sources

3D Model Review

Issued For
Construction 2-D
Extraction from 3D
Model

operational

and
Figure 1

Based on the outcome of the review, the equipment

is categorized (Hazard Category A, B or C) based on
the probability of failures (refer to Figure 1).

th

Fire and Process Safety Newsletter

4 Quarter 2012

Proprietary Information, Authorized Use Only

The coverage is based on the quantity and/or type

(point or open path) of gas detectors providing a
percentage of coverage based on the hazard
category. Category-A requires a high degree of
coverage (approximately 90%), while Category-B
and Category-C require lower levels of coverage
respectively. The detectors are spaced to provide
the maximum coverage based on the anticipated
size and travel of the vapor cloud formed. In a
previous Fire and Process Safety Newsletter article
(Gas Detector Study4), it was explained that the
results of the tests revealed that the flammable gas
detectors were not as sensitive as consequence
modeling had estimated.

Mean Time To Failure (MTTF) rates for some

equipment are tracked by and can be obtained from
OREDA (Offshore Reliability Data) and UK HSE.
Some equipment, such as gas compression, export
oil, fuel gas & export condensate with 0.1
leaks/system year1 are given the highest probability
(hazard category) and therefore require higher
percentage coverage. The hazard categories are
identified on the plot plan and the gas detectors
located accordingly (example given in Figure 2).
APPROX. 15'-0"

While it may not be possible to achieve 100% gas

detection coverage in open, well ventilated process
units or areas, using a more defined approach to
increase the consistency in detector placement will
greatly increase the likelihood of detection.

Point Gas Detector

Detector coverage overlap
with Flare Scrubber

APPROX. 15'-0"

Production pumps are Category A High Hazards

A new Chevron Engineering Standard (FPM-DC1501-B) will provide guidance when siting
flammable and toxic gas detectors. It is anticipated
this new standard will be released in December,
2012.

PREVALENT WIND DIRECTION :

WEST TO EAST

Column 2B

Detector coverage overlap

with Manifold Skid

Figure 2

Bernard Leong

LPG BLEVE Emergency

Response Guidance
Document Developed
necessary to determine how far hazard zones
extend and how to best address the risk at a
specific facility.

Several process safety events have occurred that

were catastrophic in terms of both loss of life and
company reputation. These events would be even
more tragic if the industry did not learn from others
misfortune. Through better understanding of these
incidents, we can work to effectively mitigate and
manage this risk in efforts to prevent recurrence at
one of our similar facilities.

Preventive safeguards that help to prevent

loss of containment

Mitigative safeguards that limit the risk in

the event of loss of containment

A Boiling Liquid Expanding Vapor Explosion (BLEVE)

in a processing or storage area can result in
catastrophic consequences. The BLEVE is typically
initiated by a jet fire or pool fire impinging on the
shell of an LPG vessel. The shell metal heats up
due to the external fire, and exposed areas above
the liquid level can fail catastrophically due to an
insufficient heat sink and overwhelming the vessels
relief device(s).
The flashed LPG vapor rapidly
escapes the vessel, ignites, and vigorously expands.
The result is a large fireball that quickly rises. The
attached BLEVE video demonstrates this phenomena.

Both types of safeguards are considered in

qualitative assessments.
However, mitigative
safeguards can be more challenging to assess
qualitatively, as it can be difficult to determine the
direct impact on risk reduction. Modeling is often

One of the most catastrophic incidents in the history

of our industry occurred on November 19, 1984, at
the Petrleos Mexicanos (PEMEX) San Juan
Ixhuatepec Terminal near Mexico City, Mexico.
Fatality estimates range from 500 to 600 people,

Effective risk management involves assessing two

categories of safeguards:

th

Fire and Process Safety Newsletter

4 Quarter 2012

Proprietary Information, Authorized Use Only

The incident investigation began after the flames

were extinguished.
There are uncertainties
regarding the triggering event. Possible credible
causes listed in the incident investigation report
include a pipe leak / rupture, a relief valve failure of
an overfilled vessel, or unburned gases from the
flare.

including workers and the public, while injury

estimates were in the range of 5,000 to 7,000.
The terminal contained a total of six spheres and 48
cylindrical horizontal vessels (sometimes called
bullets). This equipment was significantly damaged
after a fire escalated, resulting in a series of
BLEVEs. The BLEVEs yielded fireballs up to 1,000
feet in diameter. Most of the fatalities occurred in a
neighboring town, thousands of feet from the
storage area, due to the intense radiant heat of the
fireball. Projectile fragments from the spheres and
vessels were found up to 2,500 feet away from the
storage area. Some fragments hit homes or other
storage equipment, sometimes adding fuel to the
fire.
Local emergency responders spent hours
fighting the flames, trying to avoid further
escalation.

Since the PEMEX event, industry has made

improvements in preventive safeguards including
improved facility design specifications regarding
spacing, process controls, and relief valves to help
prevent loss of containment events leading to a
BLEVE.
As mentioned previously, mitigative safeguards can
be more challenging to evaluate and enhance. The
incident investigation report provided several
learnings that were used to develop a Chevron
LPG BLEVE Emergency Response Guidance
Document with the aim of enhancing these
safeguards at facilities where LPG is stored. Some
key learnings from the PEMEX incident investigation
report have been incorporated into the Guidance
Document, as listed below:

A BLEVE often results in a large

fireball, which emits intense thermal
radiation.
An emergency response
plan should be developed in advance
that addresses evacuation or taking
shelter from the radiant heat. (See
distances provided in the Guidance
Document.)

Fragments from horizontal vessels

show a strong directionality in the axial
direction. Emergency evacuation routes
should be planned such that personnel
escape in the radial direction, relative
to the LPG vessels.

If an explosion is heard, it is best to lie

flat on the ground, face down. This
posture limits exposure to the intense
heat
from
the
fireball,
which
immediately follows the explosion in a
BLEVE.

When the risk of BLEVE is deemed high

(e.g., after vessel relief valve opens or
for intense fires on larger spheres),
firefighting efforts should be limited to
a defensive mode with personnel at a
safe distance.
Typical bunker gear
(protective clothing for firefighters) is
NOT generally rated for the extreme
fire exposure that may be generated
by a large BLEVE.

Before

During

After

10

th

Fire and Process Safety Newsletter

4 Quarter 2012

Proprietary Information, Authorized Use Only

improvement opportunities in our mitigative

safeguards, which, if implemented, can reduce the
likelihood of potentially high consequences that
might result from a BLEVE.

The Canary BLEVE prediction model (software from

Quest Consultants, Inc.) was used to calculate
BLEVE Hazard Zone estimates for personnel.
Emergency response guidance is provided based
upon the consequence predictions. The Chevron
LPG
BLEVE
Emergency
Response
Guidance
Document can help site operations and/or
emergency responders think through a potential
BLEVE incident before it happens. This can identify

Chris Robinson and Wilbert Lee

Risk Reduction Unless

Unreasonable Means of
Demonstration
Background

This English decision has since been confirmed by

the Australian High Court. There does not appear to
be a legal equivalent in the United States.

A key concept underpinning Chevrons HES Risk

Management Process is the demonstration that risks
have been reduced until further risk reduction is
unreasonable.
In certain areas where Chevron
operates (notably the United Kingdom and
Australia) this requirement is further enshrined in
law, where risks have to be reduced to a level that
is As Low As Reasonably Practicable (ALARP).

Some Key Principles

When developing risk reduction measures and
determining whether risk is ALARP, some essential
principles should be considered. Asking cost-benefit
questions such as, Have the risks been lowered in
balance with the time, trouble and costs associated
to adequately reduce the risks? may help provide a
conceptual framework to launch into further
evaluation. (Figure 1)

In practice, what this means is that a facility has to

show, through reasoned and supported arguments,
that there are no other practical measures that
could reasonably be taken to further reduce risks,
rather
than
simply
following
prescriptive
requirements for risk mitigation measures. While
this flexibility is a great advantage, it can prove to
be challenging because it requires people to
exercise judgement with respect to how they are
going to manage their risks.
Some History
The legal definition of reasonably practicable was
set out in England by Lord Justice Asquith in
Edwards V National Coal Board [1949] who said:
Reasonably practicable is a narrower term
than physically possible and seems to me to
imply that a computation must be made by the
owner, in which the quantum of risk is placed
on one scale and the sacrifice involved in the
measures necessary for averting the risk
(whether in money, time or trouble) is placed
in the other; and that if it be shown that there
is a gross disproportion between them the
risk being insignificant in relation to the
sacrifice the defendants discharge the onus
on them. Moreover, this computation falls to
be made by the owner at a point of time
anterior to the accident.

Figure 1
Reasonableness Determining whether risks have
been reduced as low as is reasonable involves an
assessment of the risk to be avoided, an
assessment of the sacrifice (in money, time and
effort) involved in taking measures to avoid that
risk, and a comparison of the two. The greater the

11

th

Fire and Process Safety Newsletter

4 Quarter 2012

Proprietary Information, Authorized Use Only

initial level of risk under consideration, the greater

the effort likely to be required to demonstrate that
risks have been reduced to a level that is as low as
reasonable; however, just because the initial level
of risk may be low doesnt mean that further
consideration should not be given to reasonably
reduce the risk. The basis on which the comparison
is made involves the test of gross disproportion.
Gross disproportion If a measure is reasonable
and it cannot be shown that the cost of the measure
is grossly disproportionate to the benefit gained,
then the measure is considered reasonable and
should be implemented. The criterion is reasonable
but not reasonably affordable: justifiable cost and
effort is not determined by the budget constraints/viability
of a project.
Good practice Decision-making should factor the
relevance of good practice.
In general, good
practice refers to any well defined and established
standard
practice
adopted
by
an
industrial/occupational sector, including learnings
from incidents that may yet to be incorporated into
standards. Good practice may change over time due
to technical innovation, or because of increased
knowledge and understanding.

Technical
Analysis

Evaluate control measures in

technical terms; assess strengths
and weaknesses, e.g.,
effectiveness, functionality,
availability, reliability, technical
feasibility, compatibility,
survivability, correspondence of
control measures to hazards and
risks, appropriateness of
performance standards, etc.

Performance
Data

Evaluate safety-related performance

data/metrics as evidence of
adequacy or satisfactory levels of
performance, e.g., data on the
operational effectiveness or
reliability of a control measure may
support the demonstration of its
appropriateness for that service.

Improvement
Approach

Demonstrate the extent of relative

improvements in performance for
the facility based on past, present
and planned modifications and
enhancements.

Judgement
Approach

Present considered judgements as

to the suitability of control
measures and the management
systems.

Practical Tests

Demonstrate that the management

system and/or control measures
function effectively, using major
accident event simulations,
management system tests,
equipment breakdown and recovery
tests, etc.

Demonstration that Risk is Reasonable

Throughout the life cycle of an asset, it is important
to make consistent risk judgments.
At various
stages, evaluations may be needed to assess risks
and select controls that will reduce the risk as low
as
reasonably
practicable.
The
following
approaches may be considered to justify that
further measures to reduce risk are unreasonable
in practice a combination of two or more
approaches may be required.
Comparative
Assessment of
Risks, Costs
and Benefits

Evaluate risk and associated

costs for a range of control
measures and compare the
relative merits of each.

Comparison
with Codes
and Standards
etc.

Compare design, the

management system framework
and operational procedures
against recognised national,
international or industry
standards, codes of practice,
guides

Audit against
good practice

Audit the basis and

implementation of the
management system, including
operations and maintenance
systems, against good practice
for similar facilities.

Pitfall to Beware: Reverse ALARP

It is possible to argue that the increase in risk
realized by moving to a less protected situation is
balanced by gains in reduced operational costs or
increased operating profit this is considered a
reverse ALARP argument.
The requirement to
reduce risks as low as reasonably practicable would
rule out accepting a less protected but significantly
cheaper approach to the control of risks.
For additional guidance on ALARP, contact the ETC
Process Risk and/or Process Safety Teams.

Rod Travis

12

th

Fire and Process Safety Newsletter

4 Quarter 2012

Proprietary Information, Authorized Use Only

Whats wrong with this picture?

A process vessel is located on an upper level in a plant structure and the

discharge piping includes a glass portion. The floor is solid steel plate with
toe boards that act as a small containing berm. The process fluid is xylene.

Answer on page 15

13

th

Fire and Process Safety Newsletter

4 Quarter 2012

Proprietary Information, Authorized Use Only

ETC Safety Technology Unit

Team Members
Fire Protection Team

Process Safety Management Team

Steve Bruce, Team Lead

CTN 842-4082

Charles Foshee, Team Lead

CTN 954-6925

Tim Blackford

CTN 954-6987

John Edmed

CTN 545-5177

Glenn Kent

CTN 842-3926

Mike Kelly

CTN 954-6080

Bernard Leong

CTN 954-6345

Steve Kovach

CTN 954-6195

James Mansingh

CTN 954-6238

Jesse Meyer

CTN 842-5538

Justin Schmeer

CTN 954-6340

Allen Pendergrass

CTN 954-6018

Arturo Seyffert

CTN 842-6272

Process Risk Management Team

Safety Systems Team

Steve Bruce, Team Lead

CTN 842-4082

Lani Marshall, Team Lead

CTN 842-4224

Gonzalo Garcia

CTN 546-6960

Carlos Adams

CTN 954-6321

Francois Joseph

CTN 954-6976

Angela Barrow

CTN 372-5562

Wilbert Lee

CTN 842-4111

Sarah Dabney

CTN 954-6947

Mark Meyer

CTN 954-6102

Kelly Doughty

CTN 842-0605

Chris Robinson

CTN 842-4865

Lindsay Hamilton

CTN 842-3947

Jim Salter

CTN 842-4105

Sahika Korkmaz

CTN 842-9463

Rod Travis

CTN 216-5151

Sharon Light

CTN 372-1987

Lisa Veltman

CTN 954-6186

Sue McDonald

CTN 954-6193

Esau Perez

CTN 954-6346

Laurie Rittenour

CTN 842-8266

Michele Seger

CTN 954-6038

Todd Wilhite

CTN 842-0426

Jason York

CTN 954-6882

Major Capital Projects Team

Kevin Watson, Team Lead

CTN 954-6185

Robert Dayton

CTN 954-6375

Theo Dekoker

CTN 954-6031

Marine Julliand

CTN 372-6727

Michelle Lizio

CTN 954-6292

Ty Walraven

CTN 954-6091

Safety Technology Unit Manager

Mike McDonald

CTN 954-6108

Administrative Assistant
Cindy Roseberry

CTN 954-6043

Direct your email questions to AskETCHES or to AskETCHES@chevron.com. Your message is

important to us, and our goal is to put you in touch with the best resource within two business days.
14

th

Fire and Process Safety Newsletter

4 Quarter 2012

Proprietary Information, Authorized Use Only

Answer to Whats Wrong With This Picture?

The glass piping pictured presents risk that may be unacceptable at two levels.
1. The glass is not adequately protected from potential breakage due to a passerby
impacting the glass with tools or other objects being carried through the area (e.g.
a ladder or section of pipe).
2. The long bolt application would not likely provide a stable flanged setup when
exposed to the heat of a fire. This risk is elevated by the use of only four bolts in
this setup. The glass could potentially break due to stresses resulting from
movement of the flanged setup.
If a process application requires use of glass components, the following should be
considered:

The materials of construction should be suitable to the process application and

should be selected based on an assessment that they are:
o Chemically inert to the process fluids;
o Surface resistive to erosive properties of the process fluids;
o Designed to withstand the process pressures and temperatures;
o Resistive to the potential temperatures that could be realized if pool fire or
flame impingement exists; and
o Properly guarded against inadvertent impact.
The Chevron Fire Protection Manual section 2092 restricts the use of long bolt
flanging systems. A suitable fire resistant holder should be used to place the glass
in the process flow line.

Tim Blackford and Steve Kovach

15