Golden Rule No. 1 High-Risk Situations

1. Golden Rule No. 1 High-Risk Situations

3. What is a high-risk situation? Downgraded situations, complex operations and operations performed infrequently temporarily increase risk. • Start-ups, commissioning and shutdowns • Any transition phases in a continuous and stable process • Any critical operation carried out infrequently • Any long and complex operation requiring particular knowledge and management of several interfaces • Any temporary operation using temporary equipment • Any temporary operation with provisionally disabled, automated safety system(s) • Any operation involving equipment that is found to be faulty Do you know of any more?

4. Do not start up or shut down equipment or installations without using the appropriate, written operating procedure • Are there operating procedures for every task relating to the start-up/shutdown of equipment or installations? • Are they checked regularly at formal field audits, as required by the recommendations of our safety management systems, and are they kept up to date? • Are the operating procedures used in training newcomers and for regularly testing the knowledge of personnel? • Are they understood and applied by everybody concerned? • Are the operating procedures accessible and easily consultable by the individuals concerned?

5. Workers must ne encouraged to routinely report downgraded situations • What process can personnel use to report downgraded situations? • Are the observations made by field personnel… • listened to • taken into consideration …by management? • How is reporting of downgraded situations encouraged?

6. Workers must be aware and involved, and increase their vigilance in downgraded situations • Are personnel informed of downgraded situations? • How? • How often? • By whom? • In downgraded situations, does management release specific, written recommendations, including a reminder of the applicable operating procedures? • Is there a formal system for monitoring the situation (e.g. specific daily report)?

7. Standby workers must support workers carrying out non-routine work • What kinds of non-routine operations are carried out? • Is the organisation adjusted in such cases with regard to: • preparation of the operation • actual execution of the operation • attribution of the tasks • checks at the different critical phases • the final diagnosis? • Who is entitled to decide on the standby workers required? • How are these workers assessed? • On what criteria are they selected?

8. And in your unit … (1/2) • What are the high-risk situations you see most often on your site? • What are the main reasons for this, based on your own analysis? • What are the downgraded situations you see most often on your site? • Have you witnessed (an) accident(s) on your site resulting from a situation where the risk was not properly assessed? • What should have been done to avoid this/these accident(s)? • What do you generally consider to be a downgraded situation? • Do you feel that your operating procedures are: • definitely useful in your daily work • useful documents for providing newcomers with good training • obsolete documents of little use • ….

9. And in your unit … (2/2) • What needs to be improved? • What do you suggest? • In your opinion, which practices are good practices?

10. Some recent accidents (1/2) In your view, what constituted a breach of Golden Rule no. 1 in the accidents summarised below? • Refinery:During a Light Cycle Oil (LCO) purge from a burner's fuel feed pipe to a 300-litre barrel placed beneath the furnace, the barrel caught fire. The operators immediately took action to isolate the LCO and bring the fire under control, pending intervention of the safety service to put out the fire. The operators were not injured, but the fire beneath the walkway resulted in the destruction of electrical cables, in particular for instruments and lighting. • Refinery:T-051 is a collecting tank for hydrocarbons and process water. As a result of heavy rain and of operations for washing equipment with gasoil, the tank filled up very quickly and at a time when the water extraction pump was defective. The high-level alarm sounded repeatedly but was simply acknowledged each time. The amount of overflow was even reduced, at the request of the processing station. Overfilling of the reservoir ruptured a frangible weld in the roof. Hydrocarbons streamed through and their fumes ignited, which caused a fire to break out. • Chemicals:The shift team commenced acid treatment on the unit and the operator in charge of the utilities then went to attend to another task. A problem occurred on a butene compressor (seal rupture), tripping several alarms. At the same time, a pH warning alarm sounded but went unheard. A short time later, an operator noticed a strong smell of acid on the unit. After searching for the source, he found that the purge valve of the acid treatment feed pump was open. He immediately diverted the drains to the remote tank.The automatic pH-controlled servo valves for re-routing the flow in the gutters were set to manual operation and therefore had not functioned. Most of the volume of water and acid was recovered. Nevertheless, as a result of this accident, the quantity of water discharged was far in excess of the thresholds set by the Prefectural decree (pH 2.6 and 529kg COD).

11. Some recent accidents (2/2) • Refinery - Furnace explosionAn explosion originating from an excess of combustion gases occurred during a furnace start-up operation. The operator had been progressively increasing the flow of gas in anticipation of the ramp-up of the furnace load and the consequent power demand. He was a trainee in unit operations and his supervisor left him on his own just moments before the incident occurred.The oxygen analyser for the fumes was out of order and the operators were not in the habit of using the combustion analyser to monitor changes in CO content. It was not covered under any preventive maintenance plan. On top of this, the alarm threshold for the oxygen content was set to a level too low for the type of furnace concerned. These analysers were not listed as critical equipment and the operators had no operating procedure for adjusting the furnaces' heat capacity. • E&P – Failure of an offloading buoy The purpose of an offloading buoy is to serve as a link between the FPSO vessel that extracts the oil offshore and the oil tanker which comes to take a cargo load. The buoy has a 100 m3 tank, and if there is overpressure in the connecting line, a burst disk ruptures and the oil flows into the tank. The tank volume is calculated such that it factors in the closure time of the upstream safety shutdown valve (SDV). All safety systems on the buoy are managed by an integrated automaton but the (fibre-optic) link between this and the FPSO was broken on 10 Oct. Personnel were notified of this situation several days later. Various incidents occurred in succession over the following days and the SDV was forced into the open position, but the document declaring this downgraded situation was not updated. A month later, the SDV was again overridden and forced into the open position because the remote link was not working.15 Feb. During a transfer, the FPSO mariners observed a pressure peak due to the valve openings and closures on the oil tanker. The height of the pressure caused the protective disk to rupture, but the automated security system had been inhibited and therefore did not react. The tank filled up and its overflow device discharged 3,000 m3 of oil into the sea. The tanker personnel alerted the FPSO that there was a smell of oil coming from the sea and the transfer was halted immediately. Clean-up operations finished 19 days later.