OFFSHORE MAJOR ACCIDENT REGULATOR

Assessment Principles for Offshore Safety Cases

(APOSC)

Title Assessment Principles for Offshore Safety Cases

August 2021 Document
Publication Date APOSC
(Rev:001) Identification
Review Due August 2022 Internal Reference 2021/174769
All OMAR
Target Audience Inspectors Document Owner HSE ED 7
All stakeholders

Foreword ........................................................................................................................ 4

Changes to APOSC……. ................................................................................................ 5

Introduction..................................................................................................................... 8

Factual information ........................................................................................................ 9

Principle 1

Management of health, safety and environment ........................................................ 10

Principles 2 & 3

Control of major accident hazards .............................................................................. 11

Major accident hazard identification ................................................................................ 13

Principle 4

Major accident risk evaluation ......................................................................................... 14

Principle 5 - 14

Major accident risk management .................................................................................... 20

Page 1 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

Principles 15 - 20

Emergency response ................................................................................................... 25

Principles 21 - 24

Rescue and recovery .................................................................................................... 28

Principle 25

Life cycle requirements ................................................................................................ 28

Design……. .................................................................................................................... 29

Principles 26 & 27

Combined operations ................................................................................................... 30

Principles 28 - 32

Decommissioning and dismantlement ........................................................................ 33

Principles 33 - 36

Corporate Major Accident Prevention Policy (CMAPP) ............................................. 36

Principle 37

Environmental Emergency Response ......................................................................... 36

Principle 38

Environmental Information .......................................................................................... 37

Principle 39

References .................................................................................................................... 37

Other Sources of Information ...................................................................................... 39

Page 2 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

Page 3 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

Assessment Principles for Offshore Safety Cases (APOSC)

Issued August 2016

Foreword

The Offshore Installations (Offshore Safety Directive) (Safety Case etc) Regulations 2015
(SCR015) require operators and owners to submit safety cases for their installations. The
Offshore Major Accident Regulator (OMAR) (‘the Competent Authority’) assesses each
case to decide if it is satisfied with the duty holder’s approach to identifying and meeting
health, safety and environmental needs. This document (APOSC) sets out the principles
against which OMAR assesses safety cases; it represents the distilled experience on
which OMAR draws when assessing safety cases. The principles should be widely known
by industry managers, technical experts and employees, enabling a common
understanding of the process.

We believe the 1992 Safety Case Regulations, the 2005 Regulations and the supporting
regulatory regime have played a significant part in improvements to health and safety
offshore. The changes brought about by the revision of the regulations in 2015 will allow
us to build on these successes and include environmental aspects within the regime.
There is however no room for complacency. Vigilance remains important as changing
circumstances; advances in technology and new knowledge require the continuing review
of existing risk control measures and arrangements.

The safety case regime provides a continuing challenge, both to the regulated and to the
regulator. There are no short cuts to success. This revised version of APOSC should
make the process of safety case assessment clear, and we believe all concerned will find
it helpful. Finally we would like to thank all those who contributed to its development.

Chris Flint Wendy Kennedy

Interim Head Energy Division Head of Oil and Gas Environment &
Health and Safety Executive Decommissioning
Department for Business, Energy & Industrial
Strategy

Page 4 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

Changes to APOSC

The Offshore Installation (Offshore Safety Directive)(Safety Case etc.) Regulations 2015
came into force on 19 July 2015. This new version of the ‘Assessment Principles for
Offshore Safety Cases' (APOSC) has been published to accompany the other guidance
being made available for these new Regulations. This version of APOSC replaces the
version published in March 2006, which was itself the replacement of the original
HSG181 booklet.

There are significant changes to the regulatory requirements as a result of the

introduction of SCR2015. These are identified in L1541a. OPRED (formerly DECC) and
HSE, working in partnership as the OMAR, have revised APOSC to the extent necessary
to reflect those regulatory changes, modifying principles as required and introducing three
new principles, Principles 37-39. Obsolete principles that related to combined operations
in the transition between the 1992 Safety Case Regulations and SCR2005 (2004
Principles 36-40) have also now been removed. A decision was taken to add the new
principles to the end of APOSC, this is no reflection of the significance of these principles
and simply allows the existing principle numbers to remain unaltered as many other
documents refer to the principles by number.

The main changes introduced in SCR2015 that impact upon APOSC include:

1. Application

SCR2015 applies to oil and gas operations in external waters, that is, the territorial
sea adjacent to Great Britain and any designated area within the United Kingdom
Continental Shelf (UKCS). For these activities they replace the Offshore
Installation (Safety Case) Regulations 2005 (SCR2005). Activities in internal
waters (e.g. estuaries) continue to be covered by SCR2005. As SCR2015 builds
upon the requirements of SCR2005 APOSC can apply to both within the limits of
the regulatory requirements that are relevant. All regulation numbers now quoted
and terminology used refers to SCR2015 and readers are directed to Operations
Notice 8426 for further information about how to interpret new and existing
guidance for each regime.

2. Major accident

SCR2015 has redefined a ‘major accident’. The definition of ‘major accident’ lists
types of events involving, or with the potential for, serious injury or loss of life. The
definition also includes major environmental incidents resulting from these events.

3. Corporate Major Accident Prevention Policy (CMAPP)

Page 5 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

SCR2015 requires a duty holder to produce a Corporate Major Accident

Prevention Policy (CMAPP). The CMAPP establishes the duty holder’s overall
aims and arrangements for managing and controlling major accident hazards and
how those aims are to be achieved and arrangements put into effect by the
officers of the duty holder.

4. Safety and Environmental Management System (SEMS)

The duty holder must now prepare a document setting out its safety and
environmental management system. The previous requirement under SCR2005
for a ‘management system' to address safety has been extended to incorporate
relevant environmental aspects. The use of the term ‘management system’ is
inclusive and can still be used within the revised context but references to safety
management systems must be revised for cases complying with SCR2015.

5. Internal Emergency Response Duties

Certain duties under PFEER are now designated ‘internal emergency response
duties’ in the SCR2015 regime. A description of these duties together with the
OPEP produced under OPRC 1998 deliver the description of the internal
emergency response arrangements. This description must be included in the
safety case. Together these arrangements are known as the Internal Emergency
Response Plan (IERP).

6. Safety and Environmental Critical Elements (SECEs)

The verification scheme requirements under SCR2015 have been extended to

cover environmental aspects and are no longer referred to as safety-critical
elements but safety and environmental critical elements (SECEs).

7. Verification & Well Examinations Scheme

The verification requirements in SCR2015 have been updated to accommodate

new duties, and well examination requirements for wells in external waters have
been revoked from DCR, updated to accommodate new principles and duties, and
placed in SCR2015. These new duties include competence and sharing of
information.

The above changes, including the revision of terminology and/or definitions of familiar
terms, have implications for industry that must be understood to ensure compliance within
the relevant regulatory regime. Any application of the terminology must be accompanied

Page 6 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

by a thorough understanding of the scope and interpretation relevant to the particular

regulatory regime being applied.

The additional requirements outlined above apply to the SCR2015 regime and do not
apply to the SCR2005 regime. A case that is accepted under the SCR2015 is also
accepted under the SCR2005 regime as the new requirements are incremental upon the
SCR2005 requirements. A duty holder may still submit a safety case for acceptance
under the SCR2005 regime however it would only allow for operation in internal waters.

It should be noted that the requirement for risks to be reduced so far as is reasonably
practicable is a key feature of primary UK health and safety legislation. Thus the
SCR2015 changes do not mean that a lower standard of safety demonstration is
required, nor do the changes imply significant changes to the safety case assessment
processes.

Further information

Any queries concerning APOSC should be addressed to:

Health and Safety Executive
Aberdeen International Businees Park (AIBP)
Building 2 Level 1
Dyce Drive
Dyce
Aberdeen
AB21 0BR

Page 7 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

Introduction

1. A duty holder is required by SCR2015 to submit a safety case to OMAR for each
installation. This is a written demonstration of the duty holder’s approach to
identifying and meeting health, safety and environmental needs that has to be
updated whenever necessary, to reflect changing knowledge and operational
conditions. OMAR must accept the safety case before an installation can operate.
In reaching a decision about acceptability, OMAR assesses the content of the
safety case – the APOSC principles guide that assessment. It should be noted
that there are a suit of offshore environmental regulations that relate to the
assessment and management of environmental impacts.

2. APOSC is for use by OMAR assessors and industry safety and environmental
practitioners. In publishing this document, OMAR aims to provide an
understanding of how OMAR evaluates the acceptability of safety cases, by
setting out the principles against which cases are assessed, with explanations of
what is required.

3. Safety cases should take account of each principle to the extent necessary to
provide an adequate demonstration, and also include the factual information
required by SCR2015.

4. APOSC complements the guidance on the Regulations1a. They should be read

together. OMAR has developed an approach to assessment that utilises topic
assessment templates to guide and record assessment. These templates are
available to duty holders and should also be referred to for further information

5. The principal matters to be demonstrated in a safety case are that:

a) the management system is adequate to ensure compliance with statutory

health, safety and environmental requirements; and for management of
arrangements with contractors and sub-contractors,

b) adequate arrangements have been made for audit and for audit reporting,

c) all hazards with the potential to cause a major accident have been identified,
their risks evaluated, their likelihood and consequences assessed and that
suitable measures have been, or will be, taken to control those risks to ensure
that the relevant statutory provisions will be complied with2.

d) for non-production installations, all major hazards have been identified for all
operations the installation is capable of performing

Page 8 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

6. In addition, the SCR2015 Schedules list factual information and other particulars
to be included in each safety case.

7. SCR2015 requires the preparation and operation of a verification scheme and

where appropriate, a well examination scheme, which includes plant provided to
comply with specified Prevention of Fire and Explosion, and Emergency
Response (PFEER) regulations3. The safety case should refer to the principles of
the scheme(s) and describe how the objectives will be achieved. SCR2015 is
prescriptive in what the description(s) contained in the safety case should include
and this is given in regulation 13. A description which does not include all the
required elements is unlikely to be accepted.

8. The Pipeline Safety Regulations 1996 4 (PSR) and SCR2015 verification

requirements impose a network of interrelated duties. The major accident
prevention document required under PSR regulation 23 may contribute to
arguments in a safety case, and where appropriate should be referenced in the
case.

9. For the purposes of the safety case, the Offshore Installations and Pipeline Works
(Management and Administration) Regulations 1995 5 deem any part of a pipeline
connected to the installation, and associated apparatus or works, located within
500 metres of the installation, to be part of the installation. The case also needs to
take account of any equipment beyond the 500 metre zone on which the safety of
the installation may depend. This includes the interaction between the installation
and others linked by pipeline, and the effect that an interconnected pipeline
system could have on the installation.

10. The term 'duty holder' is used throughout APOSC. This refers to the person
(whether owner or operator of an installation) on whom duties are placed by
SCR2015, particularly in relation to the preparation of a safety case.

Factual information

Principle 1

The factual information should meet the SCR2015 requirements and provide
sufficient detail to support the arguments made in the case

11. The factual information, which should be provided for all safety cases, includes
information about the installation, the plant and systems, the location and external
environment, and the activities to be carried out on, or in connection with, the
installation. These particulars are linked to hazards with the potential to cause a
major accident, including those that could result in a major environmental incident.

Page 9 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

12. The case must contain the particulars required by regulation 17 or 18 for
production or non-production installations respectively and the relevant
Schedule(s). The case should be a self-contained document which: (a) presents
the main arguments clearly and succinctly; and (b) includes sufficient supporting
detail to lend conviction to the arguments made in the case.

13. The safety case must be clearly bounded and distinguished from supporting
material. Merely referring to particulars contained in other documents is not
allowed if these particulars (or documents) are intended to be an integral part of
the case for safety. Additional supporting material may be referenced.

Management of health, safety and environment

Principle 2

The safety case should demonstrate that the management system is adequate to
ensure compliance with SCR2015 and the relevant statutory provisions

14. SCR2015 requires a safety case to demonstrate that the duty holder's
management systems are adequate to ensure compliance with the relevant
statutory provisions, and that there are satisfactory arrangements for the
management of contractors and sub-contractors. SCR2015 also includes specific
requirements for the safety and environmental management system (SEMS) in
regulation 8 and schedules 2 and 3 which must be described in the safety case.
The term ‘relevant statutory provisions’ is defined in HSWA section 53.

15. The required demonstration of the adequacy of the management system is not
restricted to the management of major accident hazards.

16. A safety case which does not include the following elements in the descriptions of
the management system is unlikely to demonstrate that the system is adequate:

a) Plan

 determining your policy

 planning for implementation

b) Do

 profiling the risks

 organising for health & safety

 implementing the plan

Page 10 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

c) Check

 measuring performance

 investigating accidents and incidents

d) Act

 reviewing performance

 learning lessons

17. Standards and guidance relating to health, safety and environmental management
systems are widely available. The HSE publication 'Managing for health and
safety '6 provides further advice on health and safety management systems and
the publication ‘Environmental Management System Requirements in relation to
OSPAR Recommendation 2003/5’25 is also relevant.

Principle 3

The description of the management system should show an appropriate level of

control during each phase of the installation life cycle, including design,
construction, commissioning, operation, decommissioning and dismantlement

18. It should be clear who has overall charge of activities, including the
communication arrangements between the responsible persons on and offshore,
during normal operations and in emergency conditions. Particular attention should
be paid to authority levels, treatment of exceptional conditions, lessons learned
from incidents, and performance standards.

19. Where another installation or vessel (for example diving support vessel (DSV) or
heavy lift vessel (HLV)), carries out work in combination or in connection with an
installation, the case should summarise the arrangements in place for
coordinating the management of their activities with the management systems for
the installation. This should include steps to ensure that suitable audits and
assurance checks have been undertaken on both installations, or the installation
and the vessel, to ensure activities can be carried out safely.

Control of major accident hazards

20. A key part of a safety case is a demonstration that all hazards with the potential to
cause a major accident, including those that could result in a major environmental
incident, have been identified, their risks evaluated and that measures have been,
or will be, taken to control those risks to ensure that the relevant statutory
provisions will be complied with.

Page 11 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

21. An acceptable safety case will demonstrate that a structured approach has been
taken which:
a. includes and implements the duty holder’s Corporate Major Accident
Prevention Policy (Principle 37)
b. identifies all major accident hazards, including those that could result in a
major environmental incident (Principles 4 & 39),
c. evaluates the risks from these hazards (Principles 5 & 39),
d. describes how an appropriate approach to risk assessment has been
adopted, and how uncertainties in risk assessment have been taken into
account (Principle 9),
e. identifies and considers a range of potential measures for further risk
reduction (Principles 10 & 39),
f. presents systematic analysis of each of the identified measures and views
formed on the safety and environmental benefit associated with each of them
(Principles 10,11 & 39),
g. presents an evaluation of the reasonable practicability of the identified
measures (Principles 12,13 & 39),
h. explains the implementation (or planned implementation) of the identified
reasonably practicable measures (Principles 14 & 39),
i. describes how major accident hazards are managed (Principles 15-20),
j. describes the internal emergency response arrangements (Principles 21-25 &
38);
k. describes how the representatives of the workforce, including safety
representatives, were consulted on the preparation, review or revision of the
safety case (Principle 4);

There may be some overlap between these activities.

Page 12 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

Major accident hazard identification

Principle 4

A systematic process should be used to identify all reasonably foreseeable major

accident hazards including those that could result in a major environmental
incident, that apply to the installation, together with potential initiating events or
sequences of events

22. The hazard identification methods applied will depend on factors such as the
systems involved (i.e. types of plant and equipment, including protective devices)
and the operational activities. All significant foreseeable activities associated with
the installation should be considered and all major accident scenarios described.
A structured approach should be taken to ensure that no major accident hazards,
initiating events or sequences of events, are overlooked. A comprehensive
process for identifying these hazards would normally include consultation with the
workforce and if appropriate, contractors and suppliers.

23. All reasonably foreseeable initiating events or sequences of events should be

considered. Some major accident scenarios may arise from a particular sequence
or combination of events, for example a gas release followed by a failure to isolate
the affected components. In this context, an evaluation should be made of the
effects of failure of plant together with a failure of equipment or persons to
prevent, detect, control or mitigate the hazardous conditions.

24. The sequence of activities and their relationship in time with other foreseeable
activities should also be considered as possible initiating events e.g. well
workover and servicing operations together with other activities on the installation.

25. The appropriateness of the hazard identification method(s) should be explained.

No single method is universally appropriate. Examples are:
a. hazard and operability studies,
b. failure mode and effect analysis,
c. safety reviews,
d. industry standard or bespoke checklists.

Page 13 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

Major accident risk evaluation

Principle 5

The methodology and evaluation criteria adopted for major accident risk
assessment should be clear

26. The case should summarise the duty holder's approach to risk assessment
including the methods and criteria used to demonstrate that risks from major
accidents are controlled to ensure compliance with the relevant statutory
provisions.

27. A typical approach consists of describing:

a. the risk assessment methodology,
b. the risk evaluation criteria
a) The risk assessment methodology

28. Risk assessment involves identifying the possible consequences of major

accident scenarios and evaluating their likelihood. This may include a description
of the preventative measures relevant to the identified major accident scenarios,
and an analysis of their strengths and weaknesses.

29. An adequate risk assessment helps in understanding how major accident hazards
can arise, what prevents them from occurring and (where there are few barriers to
occurrence) what can be done to increase the number of barriers and/or make the
barriers more effective. The case should describe how this has been done, by the
appropriate use of qualitative or quantitative methods.

30. SCR2015 does not specifically prescribe the use of quantified risk assessment
(QRA). However QRA may be appropriate in the consideration of some of the
risks, for example those affected by decisions on repair options or test/inspection
intervals. Other risks may be addressed more appropriately by the use of semi-
quantitative or qualitative techniques.

31. The logic for the choice of risk assessment methodology should however be
explained i.e. why QRA, semi-quantitative or qualitative techniques have been
used for particular risks. The explanation should cover the approach taken to
assess the risk and consequence of all major accident hazards including those
that could result in a major environmental incident.

Page 14 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

32. HSE has published a document to provide further guidance on risk assessment
for offshore installations7.

b) Risk evaluation criteria

33. For quantified assessment, one accepted approach is to consider how major
accident risks contribute to total individual risk. All sources of risk, including non-
major hazard type occupational risks, should be included.

34. There is a need for criteria to judge the overall acceptability of risks. One
approach presented by HSE8,9 shows how risk can be viewed as a continuum with
three regions:
a. a region of low risk which is broadly acceptable;
b. a region of intermediate risk which is acceptable if ALARP;
c. a region of high risk which is unacceptable.
35. In the broadly acceptable region, the potential for further risk reduction is low.
Nevertheless the duty holder should consider whether there are additional
reasonably practicable measures to reduce risk (for example regarding good
industry practice) and ensure that vigilance is maintained to ensure that risks
remain in this region.

36. In the intermediate risk region, risks are acceptable provided they are known,
controlled and ALARP. As the risk approaches the limits of acceptability the
greater will be the degree of rigour required to demonstrate that risks have been
reduced so far as is reasonably practicable, there is a particular responsibility on
the duty holder to show that all reasonably practicable measures have been
taken.

37. In the unacceptable region of risk, the benefits to be gained by taking additional
risk reduction measures may be so large that any consideration of cost may be
irrelevant.

38. A safety case can show that a particular activity is acceptable either by showing
that the activity represents established good practice, or that it presents a similar
or lower level of risk to one that would be considered to represent good
practice10,11,12.

39. An individual risk of death of 10-3 per year has typically been used within the
offshore industry as the maximum tolerable risk.

Page 15 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

Principle 6

Any criteria for eliminating the less significant risks from detailed consideration in
the major accident risk evaluation should be explained

40. It may be appropriate to eliminate the less significant risks from further
consideration at an early stage of the evaluation. The criteria for making such
decisions should be explained. However, care is needed not to subdivide risks so
far that the individual elements appear trivial, while collectively still representing a
substantial risk.

Principle 7

The assessment should take account of people exposed to exceptional risks

41. Particular attention should be paid to people who may be exposed to risks
significantly higher than the average for the installation as a whole. This may
arise, for example, from the type of work carried out, or its location, or from people
not being able to reach the temporary refuge (TR).

42. Care is also needed where risks appear to be low solely because of low
occupancy of the hazardous areas, for example on a normally unattended
installation. In such cases it is more appropriate to consider risk exposure on an
occupied year basis instead of a calendar year. To provide a balanced picture, the
risks from helicopter travel may need to be considered, particularly with respect to
workers based onshore or who travel frequently i.e. to normally unattended
installations.

Principle 8

The major accident risk evaluation should take account of human factors

43. The risk evaluation should consider people as both a key element in safe
operation and as a potential cause of major accidents and their escalation.

44. Where lines of defence against major hazards and escalation are presented, the
role of the human element in these should be made clear and a demonstration
provided that this can be delivered reliably when required.

45. Safety and environmental critical tasks should be analysed to demonstrate that
task performance could be delivered to the specified performance when required.
This demonstration should draw upon recognised good practice in human factors.

Page 16 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

46. The occupational factors, which may affect a person’s well being at work and their
ability to perform safety and environmental critical tasks, are relevant. Examples
are multi-tasking and long hours of work.

47. Human performance problems should be systematically evaluated13. This should

involve evaluating the feasibility of tasks, identifying control measures and
providing an input to the design of procedures and personnel training, and of the
interfaces between personnel and plant. The depth of analysis should be
appropriate to the severity of the consequences of failure of the task.

48. The effects of hazards on human performance should be evaluated to ensure

decision-making capability or the ability to evacuate or escape does not become
impaired.

Principle 9

Conclusions reached in risk assessment processes should take uncertainty into

account

49. Quantitative and qualitative risk assessment arguments should be subject to

adequate considerations of uncertainty and of the relative merits of engineering
judgement and good practice.

50. The amount of support provided by QRA is likely to depend on the complexity of
the events to be modelled, any assumptions to be made, and the degree of
uncertainty in the methods and data to be used.

51. Particular attention should be paid to the use of QRA arguments to justify not
implementing risk reduction measures. If engineering judgement or good practice
point towards a different conclusion, the circumstances will warrant a detailed
explanation.

52. HSE has published a separate guidance document on risk assessment for
offshore installations7 that contains a more detailed discussion of the issues
surrounding the choice of risk assessment methodologies. Guidance on the
impact of uncertainty on QRA is also available from Oil and Gas UK14.

Principle 10

The identification of risk reduction measures should be systematic and take into
account new knowledge

Page 17 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

53. There is a continuing duty to keep risks and possible further risk reduction
measures under review to take account of changing circumstances, advances in
technology and new knowledge. This means challenging the adequacy of existing
measures and considering any additional practicable measures. This is
particularly relevant to cases submitted under SCR2015 regulation 24(2).

54. SCR2015 requires that a safety case is kept up to date. Thus all changes need to
be considered systematically whether or not the change generates a requirement
for the safety case to be resubmitted to OMAR.

Principle 11

The reasoning behind the choice of risk reduction measures to be implemented

should be described. Decisions on implementation should take reasonable
practicability into account

55. In many instances, safety and environmental risks will be controlled to a level that
ensures compliance with SCR2015 and the relevant statutory provisions by
adopting a series of measures involving inherently safer design, prevention,
control and mitigation. This requires a balanced and integrated approach to the
choice of risk reduction measures and to risk management. It is important that
identified risk reduction measures are not viewed in isolation from one another. All
options, or combination of options, which are reasonably practicable should be
considered.

Principle 12

Risk reduction measures identified, as part of the risk assessment, should be

implemented if they are reasonably practicable

56. If a measure is practicable and it cannot be shown that the cost of the measure is
grossly disproportionate to the benefit gained, then the measure is considered
reasonably practicable and should be implemented.

57. Cost Benefit Analysis (CBA) is the numerical assessment of the costs of
implementing a design change or modification and the likely reduction in fatalities
that this would be expected to achieve. It suffers from the same problems with
uncertainties as QRA when used as an input to decision-making. Therefore it
should be used cautiously in support of qualitative or engineering arguments.

58. In making an assessment of reasonable practicability, there is a need to set

criteria on the value of a life or implied cost of averting a statistical fatality (ICAF).
HSE’s ‘Reducing Risks Protecting People’ document8 sets the value of a life at

Page 18 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

£1,000,000 and by implication therefore the level at which the costs are
disproportionate to the benefits gained. In simplistic terms, a measure that costs
less than £1,000,000 and saves a life over the lifetime of an installation is
reasonably practicable, while one that costs significantly more than £1,000,000, is
disproportionate and therefore is not justified. However case law indicates that
costs should be grossly disproportionate and therefore costs in excess of this
figure (usually multiples) are used in the offshore industry. In reality of course
there is no simple cut-off and a whole range of factors, including uncertainty need
to be taken account of in the decision making process.

59. In the offshore industry there is a need to take account of the increased focus on
societal (or group) risk, i.e. the risk of multiple fatalities in a single event, as a
result of society's perceptions of these types of accident. Therefore the offshore
industry typically addresses this by using a high proportion factor for the maximum
level of sacrifice that can be borne without it being judged ‘grossly
disproportionate’; this has the effect of increasing the ICAF value used for
decision-making. The typical ICAF value used by the offshore industry is around
£6,000,000, i.e. a proportion factor of 6. OMAR considers this to be the minimum
level for the application of CBA in the offshore industry.

60. Use of a proportion factor of 6 ensures that any CBA tends towards the
conservative end of the spectrum and therefore takes account of the potential for
multiple fatalities and uncertainty. Although a proportion factor of 6 tends to be
used, there are no agreed standards and it is for each duty holder to apply higher
levels if appropriate, for example in very novel designs.

61. Guidance on the ALARP decision-making process, aimed at helping to assess the
relative importance of the various factors involved is also available from Oil and
Gas UK15.

Principle 13

In deciding what is reasonably practicable, the case should show how relevant
good practice and judgement based on sound engineering, management and
human factors principles have been taken into account

62. 'Good practice' means those standards for controlling risk that are recognised by
OMAR as satisfying the law when applied in an appropriate manner. This may be
achieved by reference to conformance with appropriate codes, standards and
guidance. OMAR has set out such information in guidance16. A lower standard
would not normally be acceptable. However, it may be possible to construct a
robust argument to show that the measures adopted are likely to achieve an
equivalent or higher standard of health and safety.

Page 19 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

63. Account should be taken of foreseeable harsh conditions, unusual operational

schedules, and novel designs of wells or equipment. Where good practice is not
clearly established, or may not adequately safeguard against the risks, the
significance of the risks should be systematically assessed to show that the
measures taken, or to be taken, are appropriate10,11,12.

Principle 14

Where remedial measures are proposed to reduce risk, the timescale for
implementing them should take account of the extent of such risks and any
practical issues involved

64. Remedial work programmes should be considered against the need to reduce
risks to levels that are consistent with relevant statutory provisions. Temporary
mitigation measures, applied to reduce risk until remedial measures are in place
may also be appropriate. Such measures could include additional management
controls or restrictions on operations.

Major accident risk management

65. The principles of risk control and health and safety management are set out in the
Management of Health and Safety at Work Regulations 199917 regulation 4 and
Schedule 1. Requirements for assessing environmental impacts are contained in
the Offshore Petroleum Production and Pipelines (Assessment of Environmental
Effects) Regulations 1999 (as amended)24 and the requirements for response and
remedial measures are contained in the Merchant Shipping (Oil Pollution
Preparedness, Response and Co-operation Convention) Regulations 199821.

Principle 15

Measures taken to manage major accident hazards should be described

66. A hierarchical approach should be used for managing major accident hazards,
taking account of the effect of each measure in a balanced and integrated way.
The recommended hierarchy is:
a. elimination and minimisation of hazards by design (inherently safer design),
b. prevention (reduction of likelihood),
c. detection (transmission of information to control point),
d. control (limitation of scale, intensity and duration),
e. mitigation of consequences (protection from effects).
67. Inherently safer design and measures to prevent and control major accident
hazards merit the highest priority, because of their greater effectiveness and

Page 20 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

dependability in reducing risk compared with systems of work and similar

procedural measures. For more information see HSE Research Report
OTH 96 52118.

68. For a new installation, the greatest scope to eliminate or minimise hazards is at
the design stage. The design process should address all contributors to risk from
major accident hazards, with emphasis on the most significant risks. Risks should
be reduced to ensure compliance with the relevant statutory provisions primarily
through sound engineering design, supported by appropriate management
controls and human factors assessment. For existing installations, the scope for
increasing inherent safety or for prevention or control is more limited, but should
still be addressed.

69. In explaining the measures taken to manage major accident hazards, the safety
case should consider the effects from fire, explosion and toxic gas, and from
events such as loss of stability or station keeping ability, which have the potential
to affect the integrity of the installation.

Principle 16

The safety case should explain how inherently safer design concepts have been
applied to safety and environmental risk in the design decisions taken

70. This principle is relevant to all stages of the installation’s life cycle. The principle
thus also applies to the notifications, such as are required for design and
combined operations.

71. Inherently safer design requires the hazard management strategy to be developed
at a very early stage in the design process. The strategy might reference, for
example:
a. concept selection, for example platform vs. subsea development, attended vs.
unattended, floating vs. fixed, single vs. multiple structures, pre-drilling of
wells,
b. installation location and orientation,
c. substitution of hazardous processes by less hazardous ones,
d. segregation of hazards,
e. reduction in complexity,
f. reduction of subsurface uncertainty, for example by seismic surveys,
g. riser location and routing,

Page 21 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

h. allowance for human factors, for example by fail-safe, error-tolerant designs,

i. materials selection,
j. corrosion, erosion and stress concentration in design,
k. design which facilitates inspection and maintenance.

Principle 17

The measures for preventing major accident hazards should take account of the
various activities undertaken during the installation's current phase of operation

72. Measures to prevent major accident hazards should be considered for the current
stage in the installation's life cycle. The case should be revised and updated as
necessary to ensure that it continues to reflect current operational conditions. Life
cycle activities may include:
a. drilling and maintaining wells,
b. operating temporary systems for well production testing,
c. operating the production system in the 'steady state', including routine and
non-routine activities,
d. operating in the steady state during maintenance, whether undertaken by
contractors or directly employed staff,
e. planned changes from steady state, arising from changes in plant, substances,
procedures or people,
f. all reasonably foreseeable emergencies,
g. decommissioning, dismantling and removal of facilities, plant, equipment or
substances.

73. The arrangements for managing hazardous activities carried out simultaneously
with other, possibly hazardous, activities should be described. Examples include:

a. simultaneous wellbore and production operations,

b. simultaneous drilling and workover activities,

c. maintenance, construction or commissioning activities simultaneous with

drilling or production operations.

Page 22 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

Principle 18

Appropriate detection measures should be provided for any reasonably

foreseeable event requiring an emergency response

74. The safety case should include information on detection systems. Their primary
function is to give warning of the existence of a hazard or of conditions which
could lead to a hazard.

75. Such conditions include:

a. those which could affect the integrity of the installation and its position
keeping, including structural failure, ballast system fault, dynamic positioning
system fault, heading control fault, mooring line failure, foundation weakening,
extreme weather, excessive inclination and flooding,

b. those involving accumulation of flammables, uncontrolled hydrocarbon

release, hydrocarbon fire and fire from other sources,

c. smoke, toxic gas or fumes entering the TR and accommodation area,

d. detection of vessels on a collision course with the installation.

Principle 19

Appropriate control and mitigation measures should be provided to protect against

the consequences of a major accident

76. These measures could include (amongst others):

a. ballast/elevation control systems,
b. operating and maintenance philosophy,
c. minimisation of hazardous inventories,
d. emergency shutdown systems,
e. fire and gas control systems,
f. ventilation control systems,
g. arrangements for evacuation and rescue,
h. system diversity and redundancy,

Page 23 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

i. mooring line emergency release,

j. well control equipment and systems,
k. control systems to prevent loss of containment,
l. oil pollution emergency plans.

Principle 20

Arrangements for controlling an emergency should take account of likely

conditions during emergency scenarios

77. The measures described above may be required to function:

a. in the presence of potentially flammable mixtures of hydrocarbons,
b. during or after a fire,
c. after the mechanical shock of an explosion,
d. during or after flooding or submergence,
e. for floating installations, during abnormal inclination or movement of the
installation.

78. Account should be taken of the extent to which an emergency system may be
partially or totally ineffective. This may be due to initial incident damage or latent
defects.

79. Account also needs to be taken of the need for the continued availability of staff to
carry out emergency procedures.

80. The case should describe how these systems are intended to control emergency
situations, (for example, how shutdown systems limit the inventory released in an
emergency). Shutdown system applications include:
a. wells,
b. processes,
c. pipelines,
d. supply of power or fuel to prime movers,
e. electrical power supplies and equipment.

Page 24 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

81. As another example, the case should describe how HVAC systems disperse gas
or smoke, and are shut down to prevent smoke, fire or gas spreading to occupied
areas.

82. The expected consequences of a shutdown delay or failure of the ventilation

systems, and the contribution this would make to the escalation of a major
accident scenario, should be considered.

Emergency response

82a SCR2015 introduced the concept of the internal emergency response

arrangements. These arrangements bring together the results of the PFEER
regulation 5 assessment and the Oil Pollution Emergency Plan (OPEP) and form
the Internal Emergency Response Plan (IERP). The scope of Principle 21 has
been extended in this revision of APOSC, Principles 22-25 still relate to the
PFEER aspects of emergency response and an additional principle, Principle 38,
relates to the OPEP arrangements.

Principle 21

The measures and arrangements for the management of safety and environmental
emergencies should be identified

83. SCR2015 requires a demonstration that the safety and environmental

management system (SEMS) is adequate to ensure that there are appropriate
arrangements to protect people and the environment from identified hazards. The
safety case should describe how the duty holder has ensured there are, or will be,
appropriate measures in place for securing effective emergency response,
including:
a. The identification of the various events that could give rise to the need for
evacuation, escape, rescue or pollution response to avoid or minimise a major
accident,
b. The evaluation of the likelihood and consequences of such events.

84. The case should include information from the results of the PFEER regulation 5
assessment, which form the basis of the major hazard risk assessment, and the
description of the OPEP to show that the measures taken, and arrangements in
place, are likely to be appropriate for protection of people and the environment
from the various events that could give rise to:
a. A major accident; or

Page 25 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

b. The need for evacuation, escape, rescue or pollution response to avoid or

minimise a major accident

85. One way to do this would be to include examples of appropriate standards of

performance for the various measures provided. Alternatively, the case should
include a description of the methodology used to develop these performance
standards, the basis for them and how they are derived.

86. The arrangements can include equipment, physical (active and passive) systems,
operational procedures, managerial structures and planning.

87. There should be arrangements for consultation and co-operation with others likely
to be involved, for example HM Coastguard, pipeline operators, standby vessel
owners, SOSREP and environmental pollution responders.

Principle 22

The Temporary Refuge (TR) should provide sufficient protection to enable people
to muster safely, to permit the emergency to be assessed, and to allow the
emergency response plan to be executed

88. The TR should be a place where personnel can muster safely in an emergency,
monitor and assess the developing situation, and either take control action or
initiate evacuation. An enclosed structure may not always be the most suitable
TR.

89. The TR function should be defined for all identified hazards.

90. There should be sufficient safe access routes from all potentially occupied
locations to the TR. The TR may be on a bridge-linked structure.

91. The protection provided by the TR may be critical to the success of the
emergency response. The description should include how it will withstand the
effects of fire, explosion, smoke and toxic gas (including secondary effects such
as impacts). The case should show that the TR is capable of delivering its
required functions for as long as is necessary during major accidents.

92. The design of the TR should take account of the size and layout of the installation
and the numbers and distribution of persons on board. Allowance should be made
for the effects of incapacity, injuries, darkness, smoke and damage to access and
exit routes.

Page 26 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

Principle 23

Criteria should exist that describe the Temporary Refuge integrity (TRI) and the
time over which TRI needs to be maintained against all hazards identified in the
risk assessment. The safety case should demonstrate that these criteria are met
i.e. that TRI would be maintained for the necessary time

93. A loss of TRI means a loss of the capacity of the TR to perform its required
functions. Three main types should be considered:
a. loss of structural support,
b. deterioration of life-support functions at TR locations,
c. loss of command or communication functions.

94. Loss of command or communication functions will affect the information available
for making decisions and the capacity to mitigate the incident and/or organise safe
evacuation.

95. Demonstration of TRI, and the time for which TRI need to maintained, is likely to
require modelling of the consequences of various accident scenarios identified
during the systematic hazard identification process.

96. Measures that could improve TRI and the associated time, should be evaluated to
ensure the TR is capable of delivering its required functions for as long as is
necessary during major accidents.

Principle 24

Evacuation and escape arrangements should be integrated in a logical and

systematic manner, taking account of the environment in which they may need to
function

97. There should be a clear distinction between means of evacuation and means of
escape. Evacuation means leaving the installation and its vicinity in a systematic
manner and without directly entering the sea. Escape devices may cause people
to enter the sea with little or no protection, so the likelihood of survival is likely to
be lower than that for evacuation systems; the need to use them should be very
infrequent. Escape devices should nevertheless be chosen on the basis that they
will ensure, so far as is reasonably practicable, the safe escape of people, should
evacuation arrangements fail.

Page 27 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

98. The evacuation and escape arrangements should allow everyone to reach a place
of safety. Providing personal protective equipment for residual risks is important,
but this should not be a substitute for protected evacuation and escape routes,
safe muster areas and a TR.

99. Additional muster areas should be considered for hazards that are not mitigated
by a conventional enclosed TR. An example might be the loss of stability of a
floating installation.

100. Endurance times should exist for access and evacuation routes, embarkation
points and totally enclosed motor propelled survival craft (TEMPSC).

101. The endurance times should take account of the time needed for people to travel
from their work stations to a TR, possibly helping injured colleagues.

102. Exits and evacuation routes may be required for some time after the development
of a major accident, and should be protected accordingly. Shielding or other
protection for TEMPSC and evacuation points may be necessary to provide
adequate endurance time.

Rescue and recovery

Principle 25

Effective rescue and recovery arrangements should be provided to cope with major
accidents

103. The case should demonstrate that effective rescue and recovery arrangements
have been made for all the identified major accidents.

104. Realistic estimates should be made of the survival and recovery times for
individuals under the anticipated conditions for each event. The survival time
should exceed the recovery time by a margin sufficient to demonstrate that there
is a good prospect of survival, taking uncertainty into account.

Life cycle requirements

105. Many of the above principles apply throughout the life cycle of an installation. This
section highlights matters relating to those stages in the life cycle of an installation
that require additional consideration.

Page 28 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

Design

106. SCR2015 requires a design notification for a new production installation that is to
be established, and for OMAR to comment on the design. Similar requirements
exist for installations that are relocated and for installations that are converted
from non-production to production. They do not require acceptance by OMAR,
but OMAR will be guided by APOSC in making comments. The duty holder is
required to include reference to the comments made by OMAR, and how they
were addressed, in the subsequent safety case.

107. The level of detail required in the design notification will be less than for the
operational safety case, but should show the main philosophies, the basis for
concept selection, the layout and the risk prevention measures. The notification
should be submitted before the submission of the field development programme to
the Oil and Gas Authority (OGA), at a time when it would not be difficult or
expensive for the duty holder to take into account any matters relating to health ,
safety and the environment raised by OMAR. OMAR will raise such matters
within three months of submission.

Principle 26

A Design Notification should describe how the principles of risk evaluation and
risk management are being applied to the design to ensure that major accident
risks, including those that could result in a major environmental incident, will be
controlled so as to ensure compliance with SCR2015 and the relevant statutory
provisions

108. These principles involve a hierarchical approach (see principle 15). Their
application is appropriate from the earliest stages of design, including concept
selection.

109. It should be clear how good engineering practice will be used during the detailed
design of the installation, as a basis for demonstrating that major accident risks
will be controlled so as to ensure compliance with SCR2015 and the relevant
statutory provisions.

110. Policies (and procedures where appropriate) should be described for the
prevention, detection, control and mitigation of major accident hazards during
operations.

Page 29 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

Principle 27

Well engineering aspects, especially those that refer to well operations before the
start of facility operations, should be included in the Design Notification

111. Wells connected to an installation are the major source of hydrocarbon hazard.
The design of the wells can significantly affect the level of risk to the installation.
Design features of the installation may limit the design options for the well.
Similarly, design features of the well may dictate the selection of the installation’s
drilling facilities and the sizing of the utility facilities. These, in turn, may affect the
overall development concept.

112. Well-related hardware selection, which can only be addressed satisfactorily during
the design stage, could include
a. Pre-drilling and tie-back designs, including the suspension design of pre-drilled
wells;
b. Well conductor sizing;
c. Hole sizes and planned depths;
d. Well-head arrangements and distances;
e. Unusual drilling or completion procedures;
f. Planned methods of secondary oil recovery;
g. Unusual drilling rig arrangements;
h. Unusual work over or maintenance operations;
i. Novel completion or well-head equipment requiring long lead times.

113. Other wells related matters, concerning detailed design, minor hardware or
operations management may be better addressed in the operational safety case.

Combined operations

114. [OBSELETE] .

115. Where an installation is likely to engage in combined operations, the safety case
for the installation should contain generic information on combined operations
safety. The information should include summaries of the arrangements for
coordinating the management systems of the two installations. The case should
also include a summary of arrangements for a review of the safety and

Page 30 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

environmental aspects of combined operations. This review should take place

before a particular combined operation occurs.

116. Under SCR2015, a Combined Operations Notification is required. That

notification should include a review of the relevant information provided in the
operational safety cases of the separate installations. The review should deal with
any hazards with the potential to cause a major accident and provide a description
of any risk control measures introduced as a result of the review. OMAR will be
guided by APOSC in considering these notifications. Combined operations
notifications do not however require acceptance by OMAR.

117. If combined operations are planned that are outside the scope of those operations
covered by the operational safety case, a revised safety case submission is
required.

Principle 28

The management system should address the additional risks associated with
combined operations

118. This should include the arrangements in place for the interfacing of the
management systems, identification of any new major accident hazards, and for
risk evaluation relating to the combined operations. The prevention, detection,
control and mitigation strategies to be adopted for these additional hazards should
be addressed.

119. The decision, command and communication arrangements should be described.

The relationships and arrangements for co-operation between the parties involved
should also be defined.

120. Where other vessels, for example DSVs and HLVs, are working during a
combined operation (or otherwise), the case should show how the management of
their activities is intended to be coordinated with the management systems for the
installation(s).

Principle 29

A systematic approach should be taken to assessing the impact of combined

operations on the conclusions of the operational safety case for each installation

121. Any aspects that may require further consideration should be identified and
addressed. These may include:

Page 31 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

a. duties on plant or equipment in relation to their limits of operation (for example

fire water systems),

b. structural loadings (for example use of additional or temporary equipment,

close proximity of jack-up spud cans to installation piles),

c. restrictions (for example on mooring patterns) due to pipelines or other

vulnerable subsea or topside structures,

d. reliability/availability restrictions on plant or equipment (for example due to

interconnection of indication, alarm or communication systems).

Principle 30

A systematic approach should be taken to identifying and assessing any additional

major accident hazards arising from combined operations. These can be new
hazards or changes to existing hazards

122. The techniques used to identify and assess any additional major accident hazards
should be described, and the results summarised in the case. Reference can be
made to the techniques and assessments for the individual installation cases.

123. This assessment should cover all aspects of the combined operation, from the
arrival of a mobile installation to its departure. This should include hazards
introduced by vessels that are not installations, for example anchor handling
vessels.

124. The case should also address:

a. maintenance, construction or commissioning activities carried out
simultaneously with well operations on installations working in a combined
operation,
b. integration and harmonisation of the various safety systems,
c. the TR, and evacuation and escape arrangements,
d. new performance standards for the combined operation
e. integration of the oil spill response arrangements

Page 32 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

Principle 31

The measures for emergency response should be appropriate to the particular

combined operation

125. Any restrictions or conditions imposed by the combined operation or by the

placement of installations or equipment (for example, changes to the availability of
escape routes, lifesaving appliances, fire-fighting equipment or additional
measures to protect the environment) should be considered. Any limitations on
these arrangements should also be considered, for example bridge link
disconnection in adverse weather.

Principle 32

Elements that become safety and environmental critical elements (SECEs) as a

result of combined operations should be identified and made subject to
verification. They may be parts of the individual installations, or additional plant or
equipment provided for the combined operations

Decommissioning and dismantlement

126. The principles of assessment of safety cases will also apply to the revision of a
fixed installation operational safety case that deals with its ultimate
decommissioning (SCR2015 regulation 24(1) or 24(2) as appropriate) or final
dismantlement (SCR2015 regulation 20). In particular:
a. the extra information requirements relates to activities which are directly
involved with the decommissioning and removal of plant, equipment and
dismantlement of structures,
b. the health and safety of people and protection of the environment involved in
the transport and disposal of decommissioned or dismantled items are outside
the scope of SCR2015 (and SCR2005),
c. the environmental impacts not associated with a major accidents during
offshore operations are outside the scope of SCR2015 (and SCR2005),
d. where non-production installations are involved in decommissioning or
dismantlement, the safety case may need to be revised to address the
combined operations implied by their use. A Combined Operations
Notification will also be necessary;
e. if a heavy lift vessel, which is not categorised as an installation is involved, a
notification is not needed, but the safety case should indicate how the
management arrangements are co-ordinated

Page 33 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

Principle 33

When the safety case is revised to deal with decommissioning or dismantlement,

the sequence of events should be described, from cessation of production to
dismantling of the structure

127. The decommissioning and dismantlement programmes should follow a logical

sequence, taking account of the progressive reduction in the availability of plant
and equipment on the installation. The major accident risks from activities relating
to dismantlement, including those that could result in a major environmental
incident, should be considered. The need for and availability of facilities for
emergency response should also be assessed.

128. The process may include a time lag between operations ceasing production and
eventual dismantlement. The plant may be decommissioned but the installation
maintained intact pending removal. Maintenance and verification should continue,
to prevent the installation from deteriorating to an extent that those on board, or
those who will be engaged in the dismantling operation, may be put at risk.

129. Well abandonment operations can occur at any time during the life of an
installation. However, when the installation itself is being decommissioned, there
may be some wells that have yet to be abandoned. The well abandonment
policies and procedures should be described in the operational safety case. The
arrangements made by well operators in complying with the Offshore Installations
and Wells (Design and Construction, etc) Regulations 1996 (DCR)19,20 will
contribute to the requirements of SCR2015. Well operators are required to ensure
the safe physical condition of wells at all stages of the cycle, from design and
commissioning through to abandonment.

Principle 34

The case should describe the extent and availability of systems provided to
prevent major accidents during decommissioning or dismantlement

130. Operators have a duty under DCR19,20 to ensure that installations are
decommissioned and dismantled in such a way that, so far as is reasonably
practicable, they will have sufficient integrity to enable the work to be carried out
safely. Similarly there are requirements under OPPC21 and OCR22 to prevent
pollution from offshore operations. The decisions and arrangements made by
operators to ensure compliance with DCR, OPPC and OCR will contribute to
meeting the safety and environmental requirements of SCR2015.

131. The operational status of relevant plant, equipment and systems should be
summarised. This includes plant and arrangements for:

Page 34 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

a. gas, vapour, oil mist, smoke or toxic fume detection,

b. fire detection, prevention and mitigation,
c. facilitating escape, evacuation and rescue,
d. mechanisms for loss of containment detection.

132. Sufficient detail should be included to demonstrate that the management systems,
including emergency arrangements, can be effectively implemented.

Principle 35

Any additional major accident hazards arising from decommissioning or

dismantlement should be identified

133. Many of the hazards during decommissioning or dismantlement will be similar to

those that arise during the production phase for plant and equipment, and during
the construction phase for structures. However, an additional hazard identification
exercise should be carried out. This should take account of the changing activities
and changes in the installation's ability to respond to hazards. For example, in-
service deterioration or modifications to the structure may affect its strength for
lifting operations.

134. It may be appropriate to screen each significant phase of the decommissioning

and dismantlement process separately. This allows full account to be taken of the
safety and environmental risks associated with concurrent activities.

Principle 36

The management system should demonstrate that effective control will be

maintained throughout decommissioning or dismantlement

135. The description of the management system should follow the guidance in
principle 2, but should also highlight:
a. any significant changes in the management and organisation occurring during
decommissioning or dismantlement,
b. any special management controls,
c. arrangements for management of emergencies for each phase of
decommissioning or dismantlement,
d. arrangements for appointment of competent contractors and for effective
coordination of work,

Page 35 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

e. arrangements for verification of SECEs.

Corporate Major Accident Prevention Policy (CMAPP)

Principle 37

The Corporate Major Accident Prevention Policy (CMAPP) must provide the
commitment of the duty holder’s management board, or equivalent, to preventing
major accidents, giving a high level overview of how the management and control
of major accident hazards will be implemented and achieved throughout the
organisation.

136 The CMAPP must be prepared by the legal entity that is the duty holder, contain
the specified information and demonstrate a commitment to achieving the
regulatory requirements, as a minimum.

Environmental Emergency Response

Principle 38

The safety case should demonstrate that in the event of a major accident with the
potential to cause pollution response arrangements are in place.

137 The safety case should adequately describe the oil pollution response
arrangements that are detailed in the installation’s Oil Pollution Emergency Plan
as required under the OPRC Regulations23 and associated guidance.

138 The description should cover:

a) the internal response arrangements governing oil pollution response (outlining

who is responsible for all levels of the tiered response to any oil pollution incident
and a summary of how the notification and reporting process will occur); and

b) the OPEP interface arrangements, including the arrangements for combined

operations, well operations and external response organisations

Page 36 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

Environmental Information

Principle 39

The safety case should demonstrate that major accident hazards which have the
potential to cause a major environmental incident have been considered and the
environmental consequence (environmental effects) assessed.

139 The safety case should provide an adequate summary of recent environmental
baseline information and assessment of major environmental incident potential. A
major environmental incident could only occur as a result of a major accident
causing damage to protected species and natural habitats and has significant
adverse effects on reaching or maintaining the favourable conservation status of
such protected habitats or species. Where a major accident could result in a major
environmental incident, its likelihood and the potential environmental
consequence (environmental effects) should be assessed and an adequate
summary presented in the safety case, or relevant notification, including a
description of the technical and non-technical measures envisaged to prevent,
reduce or offset them, including monitoring. The summary should include links or
references to existing environmental impact assessments for the production
installation (in PETS Production Application EIA) where the detailed assessment
should be presented.

References

All references are correct at the time of publication. Some references are subject to revisi
on to reflect SCR2015, and other changes. Reference should be made to ON8426 and car
e should be taken to locate the current version of any material referred to.

1a A Guide to the Offshore Installations (Offshore Safety Directive)(Safety Case etc.)

Regulations 2015 L154 HSE Books 2015
http://www.hse.gov.uk/pubns/books/l154.htm)

1b A guide to the Offshore Installations (Safety Case) Regulations 2005 L30 HSE
Books 2006 (www.hse.gov.uk/pubns/books/l30.htm)

3 Offshore Installations (Prevention of Fire and Explosion, and Emergency

Response) Regulations 1995. Approved Code of Practice and guidance L65 HSE
Books 1997 ISBN 0717613860

Page 37 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

4 A guide to the Pipelines Safety Regulations 1996 L82 HSE Books 1996 ISBN
07176 11825

5 A guide to the Offshore Installations and Pipeline Works (Management and

Administration) Regulations 1995 L70 Second edition HSE Books 2002 ISBN 0
7176 2572 9

6 Managing for Health and Safety HSG65 3rd Edition HSE Books 2013 ISBN
9780717664566

7 Guidance on Risk assessment for Offshore Installations, Offshore Information

Sheet No 3/2006. (http://www.hse.gov.uk/offshore/sheet32006.pdf)

8 Reducing risks, protecting people HSE Books 2001 ISBN 071762151 0

(http://www.hse.gov.uk/risk/theory/r2p2.pdf)

9 The tolerability of risk from nuclear power stations revised edition HSE Books
1992 ISBN 0118863681

10 Principles and guidelines to assist HSE in its judgements that duty holders have
reduced risk as low as reasonably practicable
(www.hse.gov.uk/risk/theory/alarp1.htm)

11 Assessing compliance with the law in individual cases and the use of good
practice (www.hse.gov.uk/risk/theory/alarp2.htm)

12 Policy and Guidance on reducing risks as low as reasonably practicable in Design

(www.hse.gov.uk/risk/theory/alarp3.htm)

13 Reducing Error and Influencing Behaviour HSG48 HSE Books 1999 ISBN 7176
2452 8

14 Guidelines for Quantitative Risk Assessment Uncertainty Issue 1 EHS08 UK

Offshore Operators Association Limited 2000

15 Industry Guidelines on a Framework for Risk Related Decision Support EHS13

UK Offshore Operators Association Limited 1999

16

17 Management of Health and Safety at Work Regulations 1999.

Page 38 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

18 Improving inherent safety HSE Research Report OTH96 521 HSE Books 1996
ISBN 0717613070 (http://www.hse.gov.uk/research/othpdf/500-599/oth521.pdf)

19 A guide to the well aspects of the Offshore Installations and Wells (Design and
Construction, etc) Regulations 1996: Guidance on Regulations L84 HSE Books
1996 ISBN 0717611949

20 A guide to the integrity, workplace environment and miscellaneous aspects of the

Offshore Installations and Wells (Design and Construction, etc) Regulations 1996:
Guidance on Regulations L85 HSE Books 1996 ISBN 0717611647

21 The Merchant Shipping (Oil Pollution Preparedness, Response and Co-operation

Convention) Regulations 1998 (as amended)

22 The Offshore Chemical Regulations 2002 (as amended)

23 The Offshore Petroleum Activities (Oil Pollution Prevention and Control)

Regulations 2005 (as amended)

24 The Offshore Petroleum Production and Pipelines (Assessment of Environmental

Effects) Regulations 1999 (as amended)

25 Environmental Management System Requirements In Relation To OSPAR

Recommendation 2003/5 To Promote The Use And Implementation Of
Environmental Management Systems By The Offshore Industry –
(https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/31
0709/DECC_Guidance_and_Reporting_Requirements_-_updated_May_2014.pdf)

26 SCR2015 and SCR2005: The Dual Regime, Differences in Terminology and

Interpretation, and Impact on Guidance Material - Operations Notice 84 1/1/2016
(http://www.hse.gov.uk/osdr/assets/docs/operations-notice-84-scr-2015-scr-
2005.pdf)

Other sources of information

1 The Provision and Use of Work Equipment Regulations 1998 SI 1998/2306

HMSO 1998 ISBN 0110856252

2 Application of QRA in operational safety issues HSE Research report 025 HSE
Books 2002 ISBN 0 7176 2570 2
(http://www.hse.gov.uk/research/rrhtm/rr025.htm)

Page 39 of 40
OFFSHORE MAJOR ACCIDENT REGULATOR

3 A guide to the Offshore Installations (Safety Representatives and Safety

Committees) Regulations 1989 L110 HSE Books 1998 ISBN 0717615499

4 Commercial diving projects offshore Diving at Work Regulations 1997 Approved

Code of Practice L103 HSE Books 1998 ISBN 0717614948

5 Diving equipment systems inspection guidance note (D.E.S.I.G.N.) AODC 052

International Marine Contractors Association 1995

6 Guidelines for fire and explosion hazard management EHS03 UKOOA 1995

7 Guidelines for the management of emergency response for offshore installations

Issue 2 EHS02 UKOOA 2002

8 Guidelines for management of safety-critical elements - a joint industry guide

EHS04 UKOOA 1996

Page 40 of 40