SYMPOSIUM SERIES NO 167 HAZARDS 30 © 2020 Crown copyright

Safe reinstatement of process plant

Learnings from HSE’s regulation of the UK offshore oil and gas industry
Ashley Hynds, MEng Dip.Occ.H&S PPSE CEng FIChemE, HM Principal Inspector of Health & Safety
Scott Templeton, BEng (Hons) Dip.Occ.H&S CEng MIChemE, HM Inspector of Health & Safety

Health & Safety Executive, Energy Division Offshore, Redgrave Court, Bootle, Merseyside, L20 7HS
Reinstatement of process plant following intrusive maintenance is an inherently hazardous activity. Inadequate
control risks loss of containment of flammable and toxic substances, with the potential for fire, explosion and
serious injuries to persons and fatalities. Since 1992, 773 hydrocarbon release incidents have been reported to
the HSE by UK offshore oil and gas operators, associated with poor control of reinstatement of plant. HSE’s
recent proactive inspections of the topic have also found frequent instances of poor practice. This paper
describes three recent serious reinstatement-related incidents and their underlying causes, as well as several
common areas of weakness and learnings found during inspection of operators’ arrangements. It sets out the
minimum expectations HSE’s Energy Division has for the control of reinstatement of offshore process plant,
and identifies examples of emerging good practice. Whilst the observations derive from the UK offshore oil
and gas industry, it is believed that the learnings are equally applicable across all sectors and locations, where
hazardous substances are handled within process plant.
Keywords:- process safety, plant isolation, plant reinstatement, offshore oil and gas, hydrocarbon release, loss
of containment

1 Introduction
Risks associated with safe isolation and reinstatement of plant
Similar to onshore chemical plants and refineries, offshore oil and gas production installations incorporate large scale
assemblies of pipework, process vessels and other equipment which contain hazardous substances. These substances are
typically flammable, toxic, and processed at high temperatures and pressures.
Maintenance of process plant on an installation often requires the equipment to be emptied of hazardous substances to allow
‘breaking of containment,’ i.e. opening it up to the atmosphere. This involves isolation of the system under maintenance
from any connected sources of pressure, and typically a combination of:- i) draining of liquid; ii) venting of pressure; iii)
purging with nitrogen and/or air; and iv) flushing with water or solvent. These are performed until a safe residual level of
substances is achieved. Such processes are often referred to as DVPF (Draining, Venting, Purging, Flushing).
Once maintenance is complete, reinstatement of plant requires application of equivalent controls to those associated with the
original isolation and cleaning activity, but in reverse. These include processes for removal of isolations, checking of plant
for leak tightness, and control of start-up. See Figure 1 below for an overview of the process.

Figure 1 Safe isolation and reinstatement of plant lifecycle

A failure to robustly control the above processes, at any stage within the lifecycle, could allow a release of hazardous
substances to occur. This could have immediate and serious consequences for people in the vicinity, including the risk of
death or serious injury, due to the occurrence of fires, explosions or exposure to toxic substances. It is also possible that the
release could cause damage to adjacent plant and the installation as a whole, with the potential for further losses of
containment, and consequently greater risks to the environment, and everyone on board the installation.
Historical context
Within the process industries there have been many well documented incidents, associated with the failure to install secure
isolations (or carryout effective DVPF) prior to breaking of containment of plant.
Numerous incidents have also occurred due to inadequate control of reinstatement and start-up of process plant, with the
Piper Alpha disaster being particularly notable. Failings associated with the restart of one of the installation’s condensate

1
SYMPOSIUM SERIES NO 167 HAZARDS 30 © 2020 Crown copyright

injection pumps ultimately led to the loss of 167 lives. The incident also prompted major changes to the way that safety
within the offshore oil and gas industry is managed and regulated.
Following the Lord Cullen Public Inquiry, the arrangements for reporting of offshore losses of containment changed. In
addition to their statutory duty to report certain dangerous occurrences, offshore operators now also voluntarily provide The
Health and Safety Executive (HSE) with further information with respect to unintentional hydrocarbon releases (HCRs).
This includes details such as the quantity and type of any substances released, and any causal factors identified. The HSE
maintains a public database of the reports arising, and regularly assesses it to determine the existence of any trends or
common findings. HSE investigates many of the reported HCRs to determine their causes. It also performs routine
inspections of operators’ arrangements for control of hydrocarbon containment to assess their adequacy.
Through this work, HSE has identified that failings in the control of reinstatement of process plant continue to be of concern,
with multiple recent examples of poor practice, and several associated losses of containment. Many such releases have been
of a greater magnitude than the initiating event at Piper Alpha.
HCRs relating to reinstatement and start-up of process plant
The UK offshore HCR database (HSE 2020) contains detailed information on unintentional hydrocarbon releases reported to
HSE since 1992. This includes information on the severity (in terms of potential to cause a major accident), causal factors,
and operational mode, for each release.
For the period 1 October 1992 to 31 December 2015, there were 4656 reported HCRs. Of these, 773 (16.6%) HCRs had ‘re-
instatement’ or ‘start-up’ as the primary or secondary operational mode of at the time of the release. Given that these two
phases would be expected to represent a small proportion of the time within an installation’s overall lifecycle, the data
supports the prevailing view that reinstatement and start-up of plant are particularly high-risk activities.

2 Incidents
Three recent, serious offshore loss of containment incidents have been selected as case studies, to exemplify typical failures
in the control of reinstatement of plant. Each example including a description of what happened, an explanation of the
immediate and underlying causes identified through HSE’s investigations, and a summary of the corrective actions taken by
the operator.
Case 1 – Floating Installation, UKCS – High Pressure Gas Release
Incident: Release of c. 550kg of gas from 220barg fuel gas suction pipework
Immediate Cause: Vibration induced failure of Small Bore Tubing (SBT)
Underlying Cause(s): Inadequate management of change; Failures in work site control / leak testing; Poor line walk and
reinstatement checks
Description
Following a period of intrusive maintenance, the high-pressure fuel gas compressor (220 barg suction pressure) was returned
to service. After approximately 11 days of operation, a gas release occurred due to failure of a section of SBT on the
compressor. The fixed gas detection system identified the release and successfully shutdown the plant however the release
continued for approximately 40 minutes until blowdown of the affected plant section was manually initiated. The release
size was calculated to be c. 550kg of gas with the potential for jet fire had an ignition source been found. The immediate
cause of the release was due to vibration induced failure of the SBT. Further investigation however revealed several other
failures which, had they not occurred, could have prevented the release.
(a) Deviations in the work scope during the maintenance period resulted in isolation boundaries being extended, which were
not cross-referenced on any associated work permits. Additional work relating to installation of a tapped flange was also
carried out which was not detailed on any work permits.
(b) Deviations in the original work scope resulted in the original leak test methodology being unsuitable. The leak test
methodology was changed at site with no discussion with supervision / management or modification of approved work
permits. The original leak test location had a purpose-built connection for compressor purging and leak testing. This
connection would have been suitable for the new leak test requirements with a minor amendment to the leak test procedure,
but this was not identified by the work force. The revised leak test connection point had no such purpose-built arrangement
and instead required a new SBT arrangement to be connected.
(c) Inadequate communication between work force and platform management resulted in confusion with regards to the
purpose of the SBT. In particular, the work force believed the SBT to be a permanent modification whereas it was intended
to be utilised for the leak test only. This confusion resulted in the SBT section remaining attached post-leak test and
remaining in place following restart of the compressor. The affected plant section included a reciprocating compressor and
was a known vibration risk. This risk failed to be considered during installation of the SBT.
(d) Leak test permits were signed off by the Area Authority on the basis of trust. No site checks were completed to ensure
that the system was returned to its original configuration as per the P&IDs.

2
SYMPOSIUM SERIES NO 167 HAZARDS 30 © 2020 Crown copyright

(e) Plant line walk checks were completed by multiple persons prior to restart of the compressor. Production personnel also
monitored the disturbed connections over a period of days including ‘snoop’ testing of the SBT in question. Individuals
recognised the presence of the SBT during these routine checks, but failed to challenge why it was present.
Action Taken: Adherence to PTW controls and corporate life-saving rules reinforced. Formalised mechanism for
conducting and recording line walk checks introduced and additional training provided to the work force in relation to Major
Accident Hazards (MAH), risk assessment and management of change (MOC).
Case 2 – Fixed Installation, UKCS – Medium Pressure Gas Release
Incident: Release of c. 270kg of gas from level bridle on test separator
Immediate Cause: Open ended connection on level bridle drain point
Underlying Cause(s): Inappropriate leak testing; Poor line walk checks
Description
The installation had recently completed a shutdown and was in the process of restarting the plant when a gas release
occurred from the level bridle on the test separator. Work had been planned on the level bridle during the shutdown but was
removed from the scope due to insufficient time to complete the task ahead of the planned restart date. A gross leak test of
the test separator using nitrogen at low pressure had been completed with no leaks identified. Offshore personnel proceeded
to introduce process gas to the vessel in a controlled manner until, at a pressure of c. 35 bar, there was a sudden release of
gas. This was later identified as originating from an open-ended connection on the bridle drain line. No personnel were in
the immediate vicinity of the release point at the time however personnel had routinely passed the area as the service test was
ongoing. The overall size of release was estimated at c. 270kg and had an ignition source been found there was the potential
for a sustained jet fire. Whilst the immediate cause of the release was the open-ended connection, further investigation
revealed:
(a) Duty Holder procedures for leak testing were inadequate and open to interpretation with regards to how to conduct leak
testing activities. The requirement for risk assessment, or approval for conducting service tests on hydrocarbon bearing
systems, was detailed within the procedure but had not been followed. Service testing of hydrocarbon bearing systems had
become common place on the installation, contrary to recommended practice.
(b) Statement of Fitness (SOF) checks had been carried out prior to the introduction of process gas however these failed to
identify the open-ended connection on the level bridle. The checks were completed by a lone individual with no verification
by other members of the work force. Site management accepted the completed SOF without further review.
(c) The gross leak test was carried out by a 3rd party vendor who deemed the test to be successful even though minor
pressure drops were evident during the test hold points. Platform management accepted the conclusions of the 3 rd party
vendor without further review of the leak test records. The gross leak test was successful due to a blockage within the
system which later dislodged when exposed to higher pressures. The potential for blockages had not been identified during
development of the leak testing methodology.
(d) Plant modifications had taken place some years previously which were not reflected on the P&IDs. In particular, an
additional isolation valve and SBT drain line had been connected to the bridle. A number of valves had historically been
removed with this change also not recorded on the P&IDs. Line walk checks for plant reinstatement and the leak test failed
to identify these discrepancies and erroneously identified valves to be in the correct position even when they were no longer
present.
Action Taken: Leak testing procedures were amended to remove ambiguity around leak test requirements and reinforce the
requirements for the review / approval of any deviations. The Duty Holder also rolled out the revised requirements across all
parts of the business rather than the one affected area to ensure consistency of approach.
Case 3 – Fixed Installation, UKCS – Low Pressure Gas Release
Incident: Release of c. 70kg from flanged connection on flare header
Immediate Cause: Incorrectly torqued flange connection
Underlying Cause(s): Inadequate leak testing; Poor flange management
Description
Removal, recertification, and replacement of a Pressure Safety Valve (PSV) on the installation had been carried out during
the previous annual shutdown without incident. Approximately 9 months later, whilst carrying out a scheduled blowdown
test, there was a gas release from a flanged connection on the outlet of the PSV. The immediate cause of the incident was a
bleed valve on the discharge of the PSV being left in the open position and the associated blind flange being loose. The low
normal operating pressure of the flare system meant that the loose flange remained undetected until introduction of increased
back-pressure as a result of the planned blowdown. Further investigation identified that:
(a) There was no requirement for P&IDs to be marked up to highlight disturbed joints nor was there a requirement for
isolation points to be identified on P&IDs.

3
SYMPOSIUM SERIES NO 167 HAZARDS 30 © 2020 Crown copyright

(b) Duty Holder procedures for flange management relied on the disturbed joint register (DJR) and Permit to Work (PTW)
system for identification of disturbed joints. The disturbed joint on the bleed valve was not recorded on the DJR, which,
combined with the failure to identify the disturbed flange as part of the isolation or PTW, led to the flange being missed.
(c) The Duty Holder operated a four-part tagging system for disturbed joints however the procedures only required them to
be used by contractor personnel. The PSV in question had been changed out by platform personnel and as such the joint had
not been tagged.
(d) The discharge flange of the PSV was not leak tested due to the lack of isolation point to the primary flare system. The
Duty Holder had no other arrangements in place for management of joints which could not be subjected to formal leak test,
e.g. witness joint certification, service testing, etc.
Action Taken: Duty Holder fully reviewed and revised their procedures for reinstatement of plant to provide greater clarity
with regards to flange management. In particular, the clear identification of disturbed joints on P&IDs used as part of
isolation schemes, requirement for disturbed joint register to be included with any relevant permits and consistent use of the
four-part flange tagging system. The Duty Holder also adopted industry good practice (Energy Institute guidance) for the
management of joints which could not be subjected to formal leak test, in particular the requirement for secondary joint
inspection during the flange make-up.

3 Benchmark standards and guidance on safe reinstatement of plant

There are a limited number of publications which provide guidance on this topic.
The expected elements of control relating to reinstatement of plant are described by HSE (HSE 2018, App 6).
Guidance is also provided by HSG253 ‘The safe isolation of plant and equipment,’ (HSE 2006). Although this is the most
authoritative source of guidance on safe isolation and reinstatement more generally, the sections on reinstatement are limited
in detail.
The Center for Chemical Process Safety (2010, ch. 16) provides high level guidance on measures to ensure operational
readiness. It is limited in detail however on such topics as line walks, leak testing, flange break management etc. Similarly
The Energy Institute (2016) also describes controls associated with operational readiness and process start-up within
Element 13. The latter usefully provides flowcharts to illustrate the typical sequence of activities that should be in place to
safely reinstate and start-up plant, depending on the nature of the preceding work or production outage.

4 Reinstatement of process plant activities

Typical controls for reinstatement of plant are described in HSG253 (HSE 2006) in paragraphs 184-188. Key steps in the
process are also shown in Figure 2 below.

Figure 2 Typical sequence of plant reinstatement activities

It should be noted however that individual operator practices vary, and it may be appropriate for there to be repetition,
overlap, or differences in the sequencing of some of the steps according to the specific circumstances of the equipment being
reinstated. This is particularly an issue with respect to the ‘leak test’ and ‘remove isolations’ steps, where the removal of
positive isolations may lead to a requirement for additional leak testing of disturbed joints (or alternative controls) to take
place.
At each step, it is expected that there will be some level of supervisory oversight, risk assessment and authorisation before
proceeding to the next. This typically takes the form of a checklist or pro-forma embedded within the documentation for
each process (e.g. flange break register or leak test record), or may be a stand-alone document (such as an operational
readiness review).

5 UK Offshore Oil and Gas Industry plant reinstatement inspection findings

HSE routinely inspects offshore installations to sample operators’ compliance with the major hazard control arrangements
described by their respective safety cases, as well as the above benchmark standards. A review of the findings of these

4
SYMPOSIUM SERIES NO 167 HAZARDS 30 © 2020 Crown copyright

inspections relating to plant reinstatement, carried out since 2015, has identified several commonly occurring issues,
including legislative non-compliances, as well as some individual examples of good practice.
Underlying causes of the weaknesses found include inadequate supervision and oversight of reinstatement activities;
weaknesses in hazard awareness and competence; failure to manage change; and inadequate consideration of human factors,
including management of safety critical tasks, and provision of suitable operating instructions. Operators’ own monitoring
and audit systems have also often failed to identify and correct deficiencies in their arrangements for plant reinstatement. A
summary of the issues found is provided below.
Managing the integrity of disturbed joints
It is essential to ensure the integrity of all bolted joints that are disturbed as a result of maintenance activity. Many operators
utilise a multipart joint tagging system, in combination with joint registers and marked up P&IDs/isometric diagrams, in
order to maintain an accurate record of the status of every disturbed joint (Energy Institute 2007, pp27-28). This good
practice helps to ensure that each step in the joint disassembly/reassembly process is completed correctly, before hazardous
fluids are reintroduced to the equipment. A similar approach to the management of disturbed small bore tubing connections
is also becoming more commonplace.
Some operators have been found to apply joint tagging and recording systems only during larger scale activities (e.g.
overhauls, turnarounds or project work), and have allowed more informal arrangements for smaller scale day-to-day
maintenance works. Depending on the scale of the systems being maintained, less formal arrangements may be appropriate
in some cases. There is however the potential for an increased risk of loss of containment associated with human error, if all
stages of joint disassembly/reassembly are not completed correctly as required. In some cases the choice as to whether to
apply joint tagging and recording, versus less formal arrangements, has been a matter of custom and practice at a particular
installation, rather than mandated by company standard or procedure.
Broken joint registers are typically developed at the planning stage of a task, and joint tags applied before breaking of
containment occurs. As well as helping to manage the integrity of the joint throughout the maintenance task, the tags can
also help with identification of the correct locations for any break-ins to occur, and hence minimise the risk of working on
the wrong (potentially live) equipment. Examples have been seen however of tags being fitted to plant retrospectively (i.e.
after breaking of containment) such that this secondary benefit is lost, and with a risk that earlier stages of the joint integrity
management process are not completed correctly (or at all).
Maintaining broken joint registers is a critical task, as decisions to progress through the various stages of plant reinstatement
are made on the basis of the joint status information described. Examples have been seen however of joint registers not
reflecting the status of the plant, for a variety of reasons.
Updating of joint registers typically occurs towards the end of a working period, as permits to work are handed back, and
part joint tags are returned. This is often a busy time for permit co-ordinators, and consequently there is an increased risk of
an error being made, particularly when there are a large number of register entry changes. Those managing the registers
need to have sufficient time available to perform the task well. An effective filing and storage system also needs to be in
place to manage the individual part tags, and help maintain an audit trail. Deficiencies have been seen arising from the loss
of part joint tags, or the lack of unique or legible identification numbers on them, such that cross referencing with the
registers has not been immediately possible.
As a maintenance task progresses, it is possible for the work-scope to change, and additional joints being required to be
broken than originally planned for. Examples have been seen of these additional joints not being tagged or added to the
original broken joint register for the work, leading to a loss of control.
Problems have also arisen when operators have not effectively co-ordinated their disturbed joint management systems with
others carrying out work on their behalf which may impact on joint integrity, such as specialist controlled joint tightening or
leak testing contractors. All parties must agree in advance of the work commencing, which recording systems will be used,
such that there can be a clear understanding of the status of all disturbed joints at all times, and particularly at any point
where equipment status is about to be changed or handed over between parties (e.g. immediately prior to leak test or
reintroduction of hazardous fluids).
Leak testing
Checking that equipment is leak tight is a vital stage in the reinstatement of plant. The process to do so must be well
controlled via a robust procedure, and all disturbed joints checked to an appropriate standard.
Deficiencies have arisen when the leak testing has not been effectively planned, such that not all joints have been checked.
The expected practice is for a marked-up P&ID/isometric drawing showing the leak test envelope, disturbed joints, and
connection for leak test fluid, as well as the procedure to be applied to perform the test to be generated as part of the overall
work pack production. This should help ensure that all joints are identified, and any equipment, procedures or additional
approvals necessary for the test can be identified and obtained in good time, thus minimising the chance of any shortcuts or
compromises being made.
Any changes to the work-scope or system isolations for a task which occur during work execution, may impact on the
suitability of the planned leak test method. Any such changes should therefore be identified, and the leak test plan
reviewed, and revised with any necessary approvals also obtained, before use.

5
SYMPOSIUM SERIES NO 167 HAZARDS 30 © 2020 Crown copyright

It is typically not possible to leak test all disturbed joints, due to the plant configuration, or a lack of a means of suitable
isolation. This includes joints such as the last connection onto an open flare/vent system, or the connection to a leak test
fluid supply. For such joints, the risk of a leak occurring during reinstatement may be greater, and as such additional steps
should be considered (Energy Institute 2007, p15). Examples have been seen of a failure to recognise such joints as being of
higher risk, and to provide suitable procedural controls or arrangements (e.g. witnessing assembly or tightening) to manage
them.
Leak tests should be conducted at a pressure representative of normal (and potential) operating conditions, and as such
typically up to 90% of any associated relief valve set pressure for the system. Leak tests have been seen to have been
performed at lower pressures than this, such that integrity issues have not been revealed, and subsequently caused a problem
during start-up.
With some operators, service testing (i.e. the controlled use of the normal operating fluid, typically with staged increases in
pressure) has become the routine option, instead of leak testing with a lower hazard fluid such as water or nitrogen. In the
event of a leak, this may give rise to a hazardous situation, as flammable or toxic substances are released. Use of
hydrocarbons to carry out integrity testing of systems should be by exception only, and supported by robust risk assessment
and managerial approval. Instances have been seen of such deviations from the expected standards taking place without
involvement of relevant Technical Authorities. Reinstatement procedures should clearly identify the required approval
process for any deviation from the baseline requirements, including review/approval by relevant competent person(s).
Reversal of DVPF activities
Following leak testing, and final plant re-assembly, process equipment may contain residual flushing or leak test fluids (e.g.
water) and/or oxygen. Instances have been observed of the failure to recognise the hazards that these fluids may present
once process hydrocarbons are re-introduced, and subsequently to take appropriate corrective action. Hazards include the
potential for the formation of a flammable mixture, blockage due to hydrate or ice formation, or enhanced rates of corrosion.
Line walking
Good practice is for a full visual inspection of the plant being reinstated to occur, prior to both leak-testing, and re-
introduction of hazardous substances. The inspections, commonly known as line walks, are intended to help identify any
remaining hazards that may lead to a loss of containment or other dangerous occurrence during the reinstatement and start-
up process, if not rectified.
When performed well, line walking checks should be effective at identifying faults such as:-
• Open ends on pipework (e.g. blanks missing from drain lines, caps/plugs missing from vent connections)
• Valve alignments (including for locked open/locked closed valves) not being correct (e.g. isolation valves in line
with blowdown valves or pressure safety valves being closed, bypass valves being open, or instruments with an
operational or safety function being isolated, counter to requirements).
• Level bridle/sight glass tappings not being in the open position, or water being present within dry-legs of differential
pressure/level transmitters.
• Interlocks and keys not being in the correct position
• Motors/drives not being electrically de-isolated
• Analyser systems not being re-instated correctly
• Critical heat tracing being offline (typically on impulse lines and level bridles)
• Temporary equipment not having been removed (e.g. leak testing equipment, drain hoses)
• Discrepancies between the installed plant and the P&ID, perhaps as a result of modifications or incomplete work
• Local isolations and tags remaining in place
• Accessibility issues, such as ability to operate plant equipment, blockage of emergency escape routes, access to
firefighting or safety equipment and lighting.
Problems have been seen when operators have not clearly defined their standards for line walking, or communicated these
effectively to staff. This has led on occasions to systems not being line walked, or not being line walked effectively, such
that hazards remain on start-up. The latter have included open ends being left on pipework, instruments being isolated such
that they cannot perform their operational or safety function, pumps being electrically isolated such that they cannot start
remotely on demand etc.
Good practice is for a line walking procedure to be in place which explains the situations when it is required, the issues that
should be checked for, how line walks should be documented, and how any actions arising should be managed. It is
common practice for pre- leak test line walks to have a different (reduced) scope to that of final pre- reintroduction of
hazardous fluids line walks. The former typically have a predominant emphasis on ensuring that the mechanical scope of
work has been completed, and there are no open ends, such that the leak test may be performed safely.

6
SYMPOSIUM SERIES NO 167 HAZARDS 30 © 2020 Crown copyright

Some operators have only applied the formal process of line walking following major maintenance, overhauls or project
work. Good practice however is for line walking to take place after every maintenance task which has involved breaking of
containment.
A checklist of issues to look for during line-walks, has also been seen to support compliance, when combined with a written
sign off by the technician and supervisor that each of the items has been checked, and a requirement to retain the paper
records.
The scope of the line walks should be well defined. A combination of a marked-up P&ID showing the extent of the process
lines and equipment to be checked, and a plot plan (or description) of the general area in which the equipment is located is
typically used for this. The latter helps ensure that ancillary issues such as housekeeping, lighting etc are also addressed.
Typically, line walks are performed by one (or preferably two) technicians who walk the plant equipment, marking the
P&ID and plot plan as they go with a highlighter pen to show the extent of the check so far performed. Any issues arising
requiring rectification are recorded on a ‘punch list’. Each should be risk assessed, and acted upon as required as
reinstatement is progressed.
Manage change
Process plant often undergoes deliberate shutdown, maintenance and reinstatement in order to effect planned change or
modification (e.g. addition of new sample point or change in pump impeller size etc). The act of shutting down equipment
can also require changes to be made, in order to allow the activity to take place (e.g. inhibits/overrides of safety systems or
temporary process plant connections to other systems etc). All such changes should be managed, and importantly risk
assessed, in accordance with a management of change procedure
Actions arising from such management of change assessments need to be completed in a timely manner, and some may need
to be completed before the process plant is put back into service. It is essential therefore that there is a cross linkage
between the management of change system, and any processes for reinstatement of plant, to ensure that any required pre-
start-up actions are known about by staff performing the reinstatement, and completion can be checked. A reinstatement (or
start-up or readiness review) checklist, specific to the plant outage, and prepared upfront of the work, can be used as a
document to prompt a check of the status such actions. A good practice seen is to record on the checklist the specific actions
requiring attention before start-up as they are identified during the management of change assessment process.
Examples have been seen where equipment has been put back into service before management of change related actions
have been completed. These have included failures to remove instrumented system inhibits/overrides, failures to reinstate
locked open/locked closed valve controls, failures to remove temporary test equipment, and failures to provide operating
teams with suitable information and instructions relating to the change.
Competence assurance systems
Technicians required to carry out the various plant reinstatement tasks above need to be suitably competent to do so. Many
operators’ competency management systems recognise the importance of ‘control of work,’ ‘energy isolations,’ and ‘permit
to work,’ or similar themes at a high level. HSE inspection experience is however that the training and competence
assessment modules which relate to these elements predominantly focus upon the design, installation and control of safe
isolation schemes. There is typically limited recognition of the key controls that need to apply during the de-isolation and
plant reinstatement phases, and checking that technicians are competent to perform them. For both safe isolation and
reinstatement processes, there is also limited evidence that individuals are expected to complete periodic refresher training
and competence re-assessment.
Compliance Monitoring and Effectiveness Audit
Most installations have some form of compliance monitoring in place for their permit to work system. Many rely upon an
‘audit checklist’ which is embedded within their electronic permit to work system, with questions often of little direct
relevance to control of reinstatement. Some installations also do not have regular checks in place for compliance with their
isolation procedures, and very few have been seen to have compliance monitoring in place for reinstatement activities (such
as line walking, leak testing, flange break management etc).
At a company or regional level, periodic audit of control of work processes is often in place. Of the audit reports seen
however, very few have been seen to address the suitability or effectiveness of the organisation’s reinstatement activities
(such as line walking, leak testing, flange break management etc).
The weaknesses in operators’ arrangements for compliance monitoring and effectiveness audit of their reinstatement of plant
controls are a significant, cross-industry concern.
Operational Readiness Review/Start-Up Risk Assessment
Several operators use a system of operational readiness review (ORR) to control plant start-up following turnarounds,
projects, or extended outages. This usually consists of a checklist of potential hazards to be considered, systems to be
checked, and records to be assembled, to authorise the various stages of plant reinstatement. Individuals responsible for the
various checks (typically at a supervisory level or above) are identified on the ORR proforma, and are required to sign the
document to indicate satisfactory completion of their element. An overarching authority (often the OIM or above) is then
responsible for reviewing the document for completeness and suitability, and authorising start-up to take place.

7
SYMPOSIUM SERIES NO 167 HAZARDS 30 © 2020 Crown copyright

A small number of operators apply this good practice not just to major works, but to all reinstatement activities over a certain
scale or duration. In most of these cases, the authorisation level for start-up varies according to the scale of the reinstatement
activity.
Questions typically addressed by such readiness reviews include:-
• Has the work-scope associated with the outage been completed and have all associated permits been closed?
• Have all disturbed joints been controlled, tags removed as required, and are registers up to date indicating equipment
ready for service?
• Have leak tests been successfully completed?
• Have management of change assessments associated with the outage been authorised, and have all pre- start-up
activities been completed?
• Have any engineering technical queries associated with work within the outage been resolved?
• Have plant line walk checks been completed, and any outstanding issues addressed?
• Are there any overdue safety critical maintenance work orders, significant verification findings, live operational risk
assessments, instrument inhibits/overrides, or weeps/seeps etc within the work area which could impact on safe start-
up?
• Are approved procedures in place for plant start-up?
• Are sufficient numbers of competent staff in place to support start-up at the planned time?
• Are necessary supporting plant systems (e.g. flare, closed drains etc) available to support start-up?
• Are other installations, terminal, standby vessel, onshore support etc available to support start-up?

6 Conclusions
Reinstatement and start-up of process plant are high risk activities. HSE’s investigations of offshore hydrocarbon releases,
and its proactive inspections of installations, continue to find weaknesses with operators’ arrangements to control them,
across a range of aspects. Whilst there is some published guidance on the topic, it is weak in relation to line walking, start-
up risk assessment, and assurance as a whole.
Further work is recommended to more thoroughly identify and establish appropriate standards for control of reinstatement of
process plant, and to share these with the offshore oil and gas industry.

8
SYMPOSIUM SERIES NO 167 HAZARDS 30 © 2020 Crown copyright

7 References
CCPS, 2010, Guidelines for Risk Based Process Safety, Center for Chemical Process Safety, J Wiley and Sons, New Jersey
Cullen, W., 1990, The Public Inquiry into the Piper Alpha Disaster, Department of Energy, H.M. Stationery Office, London,
accessible at https://www.hse.gov.uk/offshore/piper-alpha-disaster-public-inquiry.htm
Energy Institute, 2007, Guidelines for the management of the integrity of bolted joints for pressurised systems, 2nd Edition,
Energy Institute, London
Energy Institute, 2016, Guidance on meeting expectations of EI Process safety management framework: Element 13
Operational readiness and process start-up, 1st Edition, Energy Institute, London
Health & Safety Executive, 2006, The safe isolation of plant and equipment, HSG253, 2nd Edition, HSE books, London,
accessible at https://www.hse.gov.uk/pubns/books/hsg253.htm
Health & Safety Executive, 2018, ED Inspection Guide Offshore Inspection of Loss of Containment, Rev. 2, accessible at
https://www.hse.gov.uk/osdr/assets/docs/inspection-of-loss-of-containment.pdf
Health & Safety Executive, 2020, Offshore Hydrocarbon Releases 1992-2016, accessible at
https://www.hse.gov.uk/offshore/statistics/index.htm