Design and Engineering Manual (DEM) 2 – Process Safety Basic

Requirements
Shell HSSE & SP Control Framework Mandatory
Process Safety Manual Restricted
Version 8, February 2016

Purpose
To prevent re-occurrence of known major Process Safety Incidents by focussing on their main causes and key Barriers.

Who is this for?

• Asset Managers;
• Project Managers; and
• Wells Managers.

What situations are/are not covered?

This manual section applies to:
• Company Assets that have process Hazards with Risk Assessment Matrix (RAM) red Risks or yellow 5A or 5B
Risks and that are used for exploring, drilling, producing, processing, transporting or storing Hazardous
Substances or energy, including:
• Wells;
• pipelines, including midstream and local gas distribution;
• Upstream production facilities;
• refineries and chemical plants;
• gas liquefaction plants and re-gasification installations;
• coal gasification and gas/coal to liquid plants; and
• product storage and handling facilities for:
x road transport, and
x rail and ship loading and discharge;
• contracted third party Assets, including temporary boilers, liquid nitrogen storage, and power generators; and
• land transport activities by Vehicles used to transport Hazardous Substances.

This manual section does not apply to:

• small bulk consumer facilities, Liquefied Petroleum Gas (LPG) customers’ installations and LPG cylinders;
• ships and other maritime vessels as defined in the Maritime Safety Manual Section, and for which requirements
are covered by the Shell Maritime Safety Requirements for Design, Engineering, Construction and Operations;
• aircraft and aviation activities; including activities related to the refuelling of the aircraft; or
• Abandonment Activities.

Terms in green are included HSSE & SP Control Framework Glossary.

Terms in blue reference manuals and manual sections in the HSSE & SP Control Framework.
This document is not controlled when printed. See the Change Log for version control information.
121
Requirements
The Asset Manager is Accountable for requirement 1.
1. Meet the Process Safety Basic Requirements (PSBRs) that are specified in Table 1.
1.1 Derogation of the application of PSBRs requires approval by the Shell Chief Executive Officer.
1.2 A temporary exception to allow time for implementing the PSBRs requires approval in line with the
Exception to Shell HSSE & SP Control Framework Requirement manual section.
1.3 Derogation of the application of PSBRs for Assets of a Joint Venture Non-Shell Operated Venture (NOV),
where the Joint Venture has adopted this manual section, requires approval by the Joint Venture.

Table 1 Process Safety Basic Requirements

PSBR 1 Safe siting of occupied portable buildings

PSBR 2 Emergency Shutdown (ESD) valves on platform risers

PSBR 3 Temporary refuges

PSBR 4 Permit To Work

PSBR 5 Management Of Change

PSBR 6 Avoid liquid release relief to atmosphere

PSBR 7 Avoid tank overfill followed by vapour cloud release

PSBR 8 Avoid brittle fracture of metallic materials

PSBR 9 Alarm management

PSBR 10 Sour Gas (H 2 S)

PSBR 11 Deepwater Well Design and Construction

Explanation to Table 1

PSBR 1 Safe siting of occupied portable buildings

Purpose
To manage the Risk of harm to people occupying portable buildings.
What situations are covered?
Onshore Assets that have process Hazards with RAM red Risks or yellow 5B Risks.
Requirements
1. Portable blast-resistant modules shall be rated for a peak side-on overpressure of at least 55 kPa with a duration
of at least 100 ms.
2. Their location shall be assessed and approved in accordance with DEP 34.17.10.33-Gen. “Portable blast
resistant modules”.
3. Their design shall be in accordance with DEP 34.17.10.33-Gen. “Portable blast resistant modules”.
4. All other portable buildings shall be located in accordance with DEP 34.17.10.35-Gen “Siting of onshore
occupied portable buildings”.
Major Incidents in industry
BP Texas City Isomerisation Unit Explosion, Texas, USA, March 23, 2005

122
 PSBR 2 ESD valves on platform risers

Purpose
To manage the Risk of harm to people occupying offshore installations.
What situations are covered?
Offshore pipelines or production installations that have process Hazards with RAM red Risks or yellow 5B Risks.
Requirements
1. For offshore pipelines containing flammable or toxic fluids1 an ESD valve shall be located at the top of each
riser connected to a manned2 offshore installation. The ESD valve shall be located:
x where it can be safely inspected, maintained and tested;
x above water;
x where its exposure to topside Incidents is minimised; and
x subject to the above, where the distance from the ESD valve to the base of the riser is as short as
Reasonably Practicable.
2. For pipelines containing flammable or toxic fluids1 and connected to a manned2 offshore installation, an
additional Subsea Isolation Valve (SSIV) (such as a Riser Isolation Valve (RIV), keel valve or pontoon valve) shall
be evaluated as specified in the Managing Risk Manual Section and the results included in the Documented
Demonstration Of ALARP.
3. For pipelines other than those in requirement 2, and for risers, the Risk of harm to people occupying the offshore
installation shall be managed to ALARP as specified in the Managing Risk Manual Section and the results
included in the Documented Demonstration Of ALARP.
Notes
1
: Flammable and toxic fluids are Category B, D and E fluids as defined in ISO 13623:2009 “Petroleum and natural
gas industries – Pipeline transportation systems”.
2
: A “manned installation” is an “installation on which people are routinely accommodated” and “accommodation is
the place where personnel onboard sleep and spend their off-duty time” as per DEP 37.17.10.11-Gen “Design of
offshore temporary refuges” and ISO 13702:1999 “Petroleum and Natural Gas Industries - Control and Mitigation
of Fires and Explosions on Offshore Production Installations - Requirements and Guidelines”.

Major Incidents in industry

Piper Alpha Platform, UK, North Sea, July 6, 1988

123
 PSBR 3 Temporary refuges

Purpose
To manage the Risk of harm to people occupying offshore installations.
What situations are covered?
Offshore installations that have process Hazards with RAM red Risks or yellow 5B Risks.
Requirements
1. Every offshore installation has a Temporary Refuge1 (TR).
2. The main function of the temporary refuge is to provide a place where the total personnel on board (POB) can
muster without undue Risk and still have access to the communications, Monitoring and Control equipment
necessary to ensure their personal safety, and from where, if necessary, safe and complete evacuation can be
effected.
3. The escape and evacuation routes and embarkation areas provide1:
x secure means of escape to the temporary refuge; and
x secure means for a complete evacuation from the temporary refuge.
Notes
1
: DEP 37.17.10.11-Gen “Design of offshore temporary refuges” specifies means of satisfying these requirements.
Major Incidents in Industry
Piper Alpha Platform, UK, North Sea, July 6, 1988

PSBR 4 Permit To Work (PTW)

Purpose
To manage hazardous work and work that could interfere with other hazardous operations, using a written
Procedure that establishes and communicates the Controls necessary for safe working.
What situations are covered?
Hazardous work that does not have established Controls; and
Work that could adversely affect the management of HSSE Risks in other hazardous operations occurring at the
same time or that could itself be adversely affected by those operations.
Requirements
1. Meet the requirements for the Permit To Work systems specified in the Permit to Work (PTW) Manual Section.
2. Verify the effectiveness of the PTW system of the Asset using a tiered approach ranging from daily monitoring to
less frequent self-assessments.
3. Make the effectiveness of the PTW system and the PTW verification process part of each Independent HSSE MS
audit.
Major Incidents in Industry
Piper Alpha Platform, UK, North Sea, July 6, 1988
Motiva Enterprises LLC, Delaware, USA, July 17, 2001
Shell Port Edouard Herriot Depot, Lyon, France, June 2, 1987
BP Grangemouth Flare Line Fire, Scotland, UK, March 13, 1987

124
 PSBR 5 Management Of Change

Purpose
To avoid Incidents resulting from unforeseen Consequences of Process Changes, Procedural Changes or
Organisational Changes.
What situations are/are not covered?
Applies to:
x Process Changes (Hardware Changes, Process Control Changes and Process Condition Changes);
x Procedural Changes;
x Organisational Changes.
Does not apply to:
x Procedural Changes that do not affect HSSE critical content;
x Changes managed by other established Shell change management processes that include HSSE Risk
management, such as Major Capital Projects, IT releases, skillpool and succession planning;
x Business continuity planning, and acquisitions and divestments;
x Like For Like Replacement (equipment or people);
x Organisational changes that do not involve transfer of HSSE Critical Activities.
Requirements
1. The requirements are specified in the Management of Change Manual Section.
2. Verify the effectiveness of the Management Of Change system of the Asset using a tiered approach ranging
from daily monitoring to less frequent self-assessments.
3. Make the effectiveness of the Management Of Change system and the Management Of Change verification
process part of each independent HSSE MS audit.
Major incidents in industry
Dutch State Mines Nypro Plant, Flixborough, UK, June 1, 1974
Chernobyl, USSR, April 26, 1986

PSBR 6 Avoid liquid release relief to atmosphere

Purpose
To manage the Risk of harm to people due to release and ignition of flammable hydrocarbons.
What situations are covered?
Assets that have process Hazards with RAM red Risks and yellow 5B Risks and that are used for producing,
processing, transporting or storing hydrocarbon liquid above its flash point.
Requirements
1. Create for each Asset an inventory of all atmospheric vents that have the potential to release hydrocarbon liquid
above its flash point.
2. Assess the Risk of each of these vents and define the Risk Mitigation in accordance with the Managing Risk
Manual Section.
3. Document and implement the resulting remedial steps.
Major Incidents in Industry
BP Texas City Isomerisation Unit Explosion, Texas, USA, March 23, 2005

125
PSBR 7 Avoid tank overfill followed by vapour cloud release

Purpose
To manage the Risk of harm to people due to release and ignition of flammable hydrocarbons.
What situations are covered?
Assets that have process Hazards with RAM red Risks or yellow 5B Risks and that are used for producing,
processing, transporting or storing fluids that have the potential to form a vapour cloud.
Requirements
1. Create for each Asset an inventory of all Storage Tanks containing fluids that have the potential to overfill
resulting in a vapour cloud explosion. Examples of such fluids are finished gasoline, gasoline components,
naphtha(s), benzene, methyl ethyl ketone, Methyl Tertiary Butyl Ether (MTBE), acetone, pentane, special boiling
point solvents SBP1 and SBP2, and natural gas liquids (condensates) and crude oils with a Reid Vapour
Pressure (RVP) > 2.5 psi.
2. Assess the Risk of each tank and define the Risk Mitigation in accordance with the Managing Risk Manual
Section.
3. Document and implement the resulting remedial steps.
Major Incidents in Industry
Buncefield storage terminal explosion, UK, December 11, 2005

PSBR 8 Avoid brittle fracture of metallic materials

Purpose
To manage the Risk of harm to people due to release and ignition of flammable hydrocarbons.
What situations are covered?
Assets that have process Hazards with RAM red Risks or yellow 5B Risks and that are used for producing,
processing, transporting or storing LPG, Liquefied Natural Gas (LNG) or compressed flammable low molecular
weight hydrocarbon gas.
Requirements
1. For each Asset, determine the Lower Design Temperature (LDT) or alternatively the Minimum Allowable
Temperature (MAT) for all unfired pressure vessels, heat exchangers, piping, piping components and valves
(including control valves) or rotating equipment, containing liquefied gas or compressed flammable low
molecular weight hydrocarbon gas1.
2. Take measures to prevent the equipment being at a pressure below the LDT or alternatively verify the equipment
metal temperature is not below the appropriate MAT at any given operating pressure. Consider scenarios in
which equipment temperature can drop such as blow-downs, as well as scenarios of subsequent (re-
)pressurization of equipment1.
Notes
1
: DEP 30.10.02.31-Gen “Metallic materials - prevention of brittle fracture in new assets” and Run & Maintain
Practice RMP 30.10.02.50 “Metallic Materials – Prevention of brittle fracture in existing assets” specify means of
satisfying these requirements.
Learning From Incidents
Esso Longford Gas Plant Explosion, Australia, September 25, 1998

126
PSBR 9 Alarm management

Purpose
To manage the Risk of harm to people and the environment due to lack of oversight in abnormal operational
situations.
What situations are covered?
Assets that have process Hazards with RAM red Risks or yellow 5B Risks and that are used for exploring, drilling,
producing, processing, transporting or storing Hazardous Substances or energy.
Requirements
1. Each Asset shall have an alarm management system that provides the operator with an adequate set of
warnings against excursions beyond its safe Operating Limits both during normal operation and during
Abnormal Situations (start-ups, shutdowns and Upsets)1.
2. Actions necessary to bring the process back to its normal state shall be defined for every safe Operating Limit
and details shall be available to the operator. The operator shall be made Responsible to execute such actions1.
3. The alarm management system shall also minimise and where necessary suppress standing alarms, nuisance
alarms, repeating alarms and alarm floods1.
Notes
1
: DEP 32.80.10.14-Gen “Alarm management” or, in an operational context, compliance with the Ensure Safe
Production Initial Set-Up (ESP ISU) process as defined in:
x DSM-2015001-ST_Ensure_Safe_Production – Sections 2.1.1 and 2.1.2;
x DSM-2015001-PR-01 Initial Setup;
x DSM-2015001-SP-14_ESP_Measurement_Model_and_Metrics_Definition, specifies means of satisfying these
requirements.
Major Incidents in Industry
Three Mile Island Nuclear Reactor Core Meltdown, Pennsylvania, March 28, 1979
Esso Longford Gas Plant Explosion, Australia, September 25, 1998

PSBR 10 Sour Gas (H2S)

Purpose
To manage the Risk of harm to people and the environment by exposure to Sour Gas.
What situations are covered?
x Facilities and activities where Sour Gas may be present.
Requirements
1. Meet the requirements specified in the Health Hazard Management Specification.
2. Assess the safety Risks for Sour Gas operations, including non-routine operations, Concurrent Operations and
Confined Space Entry.
3. Meet the requirements specified in the Emergency Response Management Manual Section.
4. Base Emergency Incident scenarios on Sour Gas dispersion modelling and take into account local regulations.
5. Include identification of evacuation sites and evacuation activities in the testing of the Emergency Response Plans
and Procedures.
Major Incidents in Industry
Chuandongbei gas well blow-out, Gao Qiao, China, December 23, 2003

127
PSBR 11 Deepwater1 Well Design and Construction

Purpose
To manage the Risk of harm to people and the environment due to release or ignition of hydrocarbons.
What situations are covered?
x Well design; and
x Well construction.
Requirements
PSBR11 applies to all new1 Sub-sea, deepwater wells (greater than 1000 feet water depth) excluding Tension Leg
Platform (TLP) and Spar wells and requires that:
1. During drilling or when hydrocarbon zones are being completed, well barrier elements related to exposed
protective and production casing strings shall be designed to enable a cap-and-shut off of anticipated
hydrocarbons from the borehole to the surface2 external environment.
2. Plans shall be in place to mobilise the capping (shut-off) and containment (collection) equipment.
3. After surface casing has been installed3, if a pressure differential exists that may cause uncontrolled outflow from
the borehole or well to the surface2 external environment, there shall be two well barriers4 available during all
well construction operations.
4. Fit-for-purpose5 dual shear rams shall be installed on all subsea deepwater blow-out preventers.
Notes
1
Legacy well activities including sidetracks will be handled using a Risk-based approach with a requirement for the
Business Head to approve the Risk Assessment and Mitigation plan. Legacy wells are defined as those whose casing
strings were installed prior to January 1, 2012.
2
Interpretation of the wording should not lead to the exclusion of designs that rely on subsurface venting. Well designs
that rely on subsurface venting will be handled using a Risk-based approach with a requirement for a panel of experts to
approve the Risk Assessment and Mitigation plan. For clarity, it is not intended to support designs that rely only on cap-
and-flow (collection).
3
Surface casing accommodates the drilling of top-hole sections prior to installation of a blow-out preventer (BOP) stack.
4
Suitable barriers as defined in the Pressure Control Manual for Drilling, Completion and Well Intervention Operations.
5
Use the definition of fit for purpose in the Pressure Control Manual for Drilling, Completion and Well Intervention
Operations.
Major Incidents in Industry
Macondo well blow-out, Gulf of Mexico, April 20, 2010

128