SCE FUNCTION IMPAIRED ENHANCEMENT

TO SAP AND FSR

FOR MIDLT INFOSHARING

8 JUNE 2016

Rev 0.6

Copyright of Royal Dutch Shell plc 1

WHAT WE WANT FROM MIDLT (APPROVED BY MIDLT 26 APRIL,
2016)
 Decision to add one new field into SAP Blueprint to identify Notifications where
the Safety Critical Element functionality has been impaired (ie SCE does not
meet all the Functions relevant in the SCE Performance Standard)
 Decision to use this field instead of CMPT = 3/4/5 as the main parameter to
define Task Criticality eg in FSR Traffic light rules and SCE Compliance reporting

CONTENT OF THIS PACK

 Overall Summary
 Feedback from the UK Pilot
 Proposed change to SAP Core
 Proposed change for “full blown solution”
 SCE management – Equipment vs Task Criticality
 Change management engagements so far

Copyright of Royal Dutch Shell plc

OVERALL SUMMARY
WHAT PROBLEM TRIGGERED THESE CHANGES
 During 2015 the UK was under intense pressure from the UK Regulator to improve its Management of
Safety Critical Elements, provide clarity on impaired SCE barriers, and demonstrate the involvement of
Technical Authorities and show a working process to follow up on declared Mitigations.
 Whilst above is UK specific, many Integrity Assurance and Maintenance Execution assessments have
shown weaknesses in CMPT application and inconsistencies in risk assessment for deviations, which have
the effect of “hiding” SCE failures from intended governance (visibility in FSR, compliance KPIs …)
 Parallel initiative to improve quality of SCE Identification for Shearwater and Gannet
 Current MIE process has inconsistencies that can be tidied & LEAN’d
WHAT CHANGES HAVE BEEN INITIATED
 Identification of SCE Impaired using [SCE] text in Deviation title as an Identifier
 Recording of Mitigations in Deviation, and manual process to manage and assure these
 Intensive field pilot of above (including some FSR changes) during Q4 2015
 IA & ME DEN endorsed’ team (inc. ESP & MoC team) convened to share best practices and steer initiative
 Workshop conducted in Aberdeen to learn lessons from pilot and recommend future global approach
 Ensure that proposals are aligned with other SCE Improvement initiatives across RDS group
WHAT WILL BE IMPROVED – IE WHAT DOES GOOD LOOK LIKE
 Laser like clarity and focus on SCE Impaired barriers – dramatic improvement in operational risk
management and Discipline Communications
 Increased confidence in existing tools such as FSR, BW KPIs. “We can see the Wood from the Trees”
 Global process implemented in SAP and FSR
 Initial feedback from the UK Regulator and Asset management was positive: regained their confidence
Copyright of Royal Dutch Shell plc
 SCE IMPAIRED PROCESS - FEEDBACK FROM THE UK PILOT
THEY CAN
START NOW SEE
Observation
THE WOOD
Raise Z1 CMPT is based on Mitigated Risk and so FROM THE
Notification
Technical Authority will often not be aware TREES
Daily Notification CMPT severity of 1 or 2 bypasses FSR Traffic
Meeting
Lights, deviation controls and Compliance
OVERALL Set CMPT and
Required End KPIs a Deviation – involves TA to review.
Raise
UK Short Term Date
approach is too
Approve
(No short term fix for FSR/KPIs).
manual, but has been
endorsed by both Notification CMPT recorded as the highest of P.E.A.R
Operations
Approve Work
(People / Environment / Asset / Reputation)
Management and the Order
UK HSE Regulator as Unable to identify SCE Impaired Work Orders
giving much better FSR Deviation
focus on Impaired (if required) Add a manual flag [SCE] into the Deviation Title
SCEs and their
Mitigations
FSR Deviation which can be used as a filter for Work Orders
Review &
Approval

Manage Mitigations are buried in the long text of the

Mitigations
Z1 Notification.
Continue Process to manage Mitigations is ineffective
Operations

WO Closed
Mitigations documented in FSR.
END Manual (intensive) process to create Mitigations
Check lists for Operator rounds.

Copyright of Royal Dutch Shell plc

SCE IMPAIRED PROCESS – PROPOSED DEFAULT FOR
UPSTREAM
START
Observation

Raise Z1
Notification

Daily Notification
Meeting

SCE Function New flag in SAP

Impaired ? No credit allowed for mitigations/sparing/other barrier
Yes/No
Set CMPT and Ideally display SCE Group and Reason on IW28
Required End
Date

Approve No change to remainder of process

Notification

Approve Work “SCE Function impaired” flag used instead of

Order
CMPT = 3,4,5 to determine Safety Critical WO in
FSR Deviation
FSR, Compliance reporting and deviation
(if required) management
FSR Deviation
Review &
Additional reporting of SCE Impaired work orders to
Approval
be made possible via FSR to facilitate TA spot
Manage checking
Mitigations

Continue
Operations

WO Closed
END

Copyright of Royal Dutch Shell plc

SCE IMPAIRED PROCESS – PROPOSED FULL BLOWN SOLUTION ON
DEMAND CONFIGURABLE BY
START
Observation Planning/Maintenan
ce Plant/ Plant
Raise Z1
Notification
Section

Daily Notification
Meeting

SCE Function Yes SCE Function New flag in SAP (around 10% of Z1’s)
Impaired ? Impaired = YES No credit allowed for mitigations/sparing/other barrier
No
Set CMPT and
User Defined Ideally display SCE Group and Reason on IW28
Required End
CMPT Priority “S” New “S” Priority (similar to P8 priority)
Date

Approve Approve Must not override “E” Notifications from eWIMS

Notification Notification

Maximum Required End Date set to 5 days

Approve Work Approve Work
Order Order

FSR Deviation FSR Deviation

Allows work to continue to fix problem
(if required) Created

FSR Deviation FSR Deviation Deviation always created to obtain TA review and
Review & Review & document Mitigations using usual process
Approval Approval

Manage Manage Updates LAFD to Deviation Valid to date

Mitigations Mitigations

Continue Improved method to document one or several

Operations mitigations and assign users / due dates etc and
produce check lists for Operator rounds
WO Closed
END

Copyright of Royal Dutch Shell plc

ALIGNMENT OF APPROACH WITH DOWNSTREAM

 Downstream identify equipment (not functional locations) as HEMP critical and

record using a Room field in GSAP{ (synonymous with HSSE critical or Safety
Critical Element)

 Classification is not as mature as Upstream and there are wide differences

between facilities.

 Notifications are reviewed at each Daily meeting

and flagged when HEMP Barrier is lost

 These are given a fixed 30 day time to repair

and deferrals routed via the GM

Copyright of Royal Dutch Shell plc

SCE MANAGEMENT – EQUIPMENT VS TASK CRITICALITY

High

SCE Group PC001 …

Compliance Category Compliance Category

PM
P (Production Critical Routine) A (Assurance) > Perf Standard

Criticality A
R (Others) I (Safety Critical Routine )
Equipment Criticality

SCE
2 1

CM
SCE Function Impaired = NO SCE Function Impaired = YES

PM Compliance Category Compliance Category

P (Production Critical Routine)
Criticality B, C

I (Safety Critical Routine)

Non-SCE

R (Others)

4 3
All CMPT
CM

Exceptional (bad data) cases only

Low SCE Function Impaired = No
SCE Function Impaired = YES

Low High
Task Criticality
These Quadrants (numbered only to help discussion) would be used in the definition of :
 FSR Traffic lights rules
 Safety Critical KPI calculations
 FSR Deviation Reviewers and Approvers selection
 Safety Critical PM Work Order Cancellation process
Copyright of Royal Dutch Shell plc
ENGAGEMENTS CARRIED OUT
Date Who Comments
16-Mar-16 ME Core DEN inc Steve Harvey/Babatunde General understanding and support
Salami/ Matthew Falzone/ Ed Clausen and Michel
Jansen
14-Mar-16 Frank Udo for IT No real issue, other than a desire to do more in SAP. Need to revise the SAP Z1
creation screen and re-show as he was somewhat confused over the fields and layout.
07-Mar-16 Cor van Alphen for Inspection & CIMS Minor concern over the real need.
04-Mar-16 SAP PM focal points (2 sessions large attendance) Minor concern over OU's needing to adopt a UK driven solution
29-Feb-16 Sander Zijlmans Major concern over requirement for all OUs to adopt the Deviation process for all SCE
Impaired Notifications. Proposal modified as result to make this a configuration item.
17-Feb-16 Wim Verdaasdonk Mostly discussed Temporary Repairs. Should have a more focused SCE Impaired
session in April
15-Feb-16 Joe Gandolfo - process owner for IA
09-Feb-16 IA Core DEN
03-Feb-16 Arnaud Kappe for OI especially Mitigations First meeting. Will need several followup meetings to finalise proposal

03-Feb-16 IA DEN Data Quality working group Support from Bobby Schaff as will resolve a similar issue and audit comment from Ram
Powell audit
14-Mar-16 Frank Udo (IT)

18-Mar-16 Anne Birsa (SEIC) Very interested /supportive of Mitigations improvements

01-Apr-16 Don Kerridge, Darren Lim and UK Team Confirmation that SAP solution will not negatively impact Wells
08-Apr-16 Babur Imirzalioglu Likes the new field for SCE Function Impaired Concern over risk changing with time.
Prefers use of CMPT for traffic light rules. Highlighted the need to follow the MOC
process for this change
11-Apr-16 UK Team on Mitigations Like the proposals

11-Apr-16 Wim Verdaasdonk Joe Gandolfo/ Willem Lodder GPO’s and Willem fully support.
26-Apr-16 MIDLT Decision making meeting ??

Copyright of Royal Dutch Shell plc

BACKGROUND AND PURPOSE OF THE MEETING

BACKGROUND
 During 2015 the UK was under intense pressure from the UK Regulator to improve its Management of
Safety Critical Elements, provide clarity on impaired SCE barriers, and demonstrate the involvement of
Technical Authorities and show a working process to follow up on declared Mitigations.
 Whilst above is UK specific, many Integrity Assurance and Maintenance Execution assessments have
shown weaknesses in CMPT application and inconsistencies in risk assessment for deviations, which have
the effect of “hiding” SCE failures from intended governance (visibility in FSR, compliance KPIs …)
 Q4 2015, a Short term fix to improve the process was implemented using FSR
 Initial feedback from the UK Regulator and Asset management was positive

PURPOSE
 Review the Short term fix – what worked well, what didn’t, what could be improved
 Decide what future improvements should be proposed for the whole of Upstream (scope limited to Facilities
using SAP Blueprint and FSR)
 Ensure that proposals are aligned with other SCE Improvement initiatives across RDS group
 This document will be used to communicate the output of the workshop and gain support of the next steps

Copyright of Royal Dutch Shell plc

SCE IMPAIRED PROCESS – CURRENT – SAME AS ANY OTHER
Z1
START
Observation

Raise Z1
Notification

Daily Notification
Meeting

Set CMPT and

Required End
Date

Approve
Notification

Approve Work
Order

FSR Deviation
(if required)

FSR Deviation
Review &
Approval

Manage
Mitigations

Continue
Operations

WO Closed
END

Copyright of Royal Dutch Shell plc

 SCE IMPAIRED PROCESS - ISSUES

START
Observation

Raise Z1 CMPT is based on Mitigated Risk and so

Notification
Technical Authority will often not be aware.
Daily Notification CMPT severity of 1 or 2 bypasses FSR Traffic
Meeting
Lights, deviation controls and Compliance
Truly Impaired SCEs and Set CMPT and
KPIs.
their Mitigations are Required End
Date
buried
Risks less focused and Approve
not visible
Notification CMPT transfers leading risk indicator only of
Too many work orders Approve Work
PAER.
swamp TAs Order
eg high Asset risks can mask significant P&E
We - leaders and risks
FSR Deviation
regulators do not know if (if required)
we are in control
FSR Deviation
Review &
Approval

Manage Mitigations are buried in the long text of the

Mitigations
Z1 Notification.
Continue Process and visibility of mitigation
Operations
management is ineffective
WO Closed
END

Copyright of Royal Dutch Shell plc

SCE IMPAIRED PROCESS – WHAT THE UK IS DOING IN THE
SHORT TERM
START
Observation

Raise Z1 CMPT is based on Mitigated Risk and so

Notification
Technical Authority will often not be aware.
Daily Notification CMPT severity of 1 or 2 bypasses FSR Traffic
Meeting
Lights, deviation controls and Compliance
Set CMPT and
Required End KPIs.a Deviation – involves TA to review.
Raise
Date

Approve
(No short term fix for FSR/KPIs).
Notification CMPT recorded as the highest of P.E.A.R
Approve Work
(People / Environment / Asset / Reputation).
Order
Unable to identify SCE Impaired Work Orders
FSR Deviation
(if required) Add a manual flag [SCE] into the Deviation Title
FSR Deviation which can be used as a filter for Work Orders
Review &
Approval

Manage Mitigations are buried in the long text of the

Mitigations
Z1 Notification.
Continue Process to manage Mitigations is ineffective.
Operations

WO Closed
Mitigations documented in FSR.
END Manual (intensive) process to create Mitigations
Check lists for Operator rounds.

Copyright of Royal Dutch Shell plc

SCE IMPAIRED PROCESS – PROPOSED – SYSTEM
CONSIDERATIONS
START
Observation

Raise Z1
Notification

Daily Notification
Meeting

SCE Function Yes SCE Function Field needs to be added to SAP interface (exists in
Impaired ? Impaired = YES FSR)
No Consider also adding to EPAF Z1 auto-generation
Set CMPT and
User Defined
Required End
Date
CMPT Priority “S” May need to be IW28-like to add SCE Group/Reason
RED can be changed but only up to 5 days
Approve Approve
Notification Notification
SCE Impaired flag mandatory on Z1 approval.
Approve Work Approve Work
Order Order Grey out when approved. Change not possible

FSR Deviation FSR Deviation

(if required) Created
FSR is now able to handle situations where Z1 is
FSR Deviation FSR Deviation deviated first and Work Order created second
Review & Review &
Approval Approval

Manage Manage
Mitigations Mitigations Several reports will be needed in FSR
Continue • SCE Impaired work orders
Operations
• Mitigations by Location for OIM checking
WO Closed • Check lists for Operator rounds
END

Copyright of Royal Dutch Shell plc

POSITIVES / NEGATIVES WITH PROPOSAL

Positives
1. Existing functionality adjusted slightly conceptually. SAP usage preserved
with minimal SAP changes
2. Laser-like focus on MAH
3. Value-add input from TAs at earlier stage (Before LAFD reached) - Quality
of input increased with focus
4. Removal of large % of non-integrity deviations from SCE work Backlog
5. TAs released to more value-add work
6. CMPT consequence severity >=3 as marker has not been effective ->
clear and unambiguous marker from now
7. If incorrect "marker" given, it can be remedied under clear control and we
know who's done it for coaching
8. SCE KPIs: MAH laser-like focus
9. Improved transparency of true "impaired" SCEs and status and mitigations
management + OIM assurance
10. Will allow "easy" demonstration of what we know to regulators and
leadership
11. Clear single tool repository and reporting of SCE Mitigation management -
greater admin efficiency
12. Consistency across assets / Ous --> methodical approach
13. More to RAM rather than CMPT in line with MAH risk management
14. More towards risk management not Maint. Dev management
15. Pilot demonstrated genuine reduction of SCE Impaired Wos due to focus
16. New workflow forces improved discussions / alignment on risk / deviations
between TAs and Ops
17. Reducing quantity of SCE Impaired allows operations team more change
of truly being in control of live/cumulative risk and mitigations
18. FSR beyond asset / zone view in geographical layout views can be
enabled
19. Soft-start minimizes recording of deviations otherwise impact of
reclassification needs evaluating/resourcing - negative of soft start means
true status slow to establish
20. More extended deviations and escalations to leaders but rest escalation
rules now "chaff" gone (is a +ve)
Negatives
1. Change in $28 barrel world
2. Retraining needed for a lot of organisation
3. Risk management consolidated in FSR so criticality of its
availability goes up - Tech support for interfaces and
responsiveness of system in poor comms sites
4. Increase in CM workload: must continue focus on CM
compliance performance too
5. Potential increase in Z6 work which would need continued focus
on CM backlog management
6. Further customization of SAP over 4 SAP entities (Global,
Nigeria, Brunei, Crystal)
7. (5 day) time-lapse between noting SCE Impaired and limited
time approved deviation
- Will be in ops minds and ways to raise WO possible
8. Time wasted when initiators CMPT work overwritten by DNR
(around 2 mins - 15min = Train techs to avoid this)
9. Protect against gaming the Y/N Q is SCE Impaired by time
stamping changes and assurance
OVERALL
Based on Proposal,
should we proceed ?

Copyright of Royal Dutch Shell plc

NEXT STEPS

What Who When Comments

Finalise workshop PC end Jan Done
Review with other risk stakeholders Arnaud/Joost/Cor MW mid Feb Will need help from Graeme / Chris
Joe / Wim Verdaasdonk/ Sander / Tunde / Brian / Lodder MW mid Feb inc agreement for timewriting
SCE Impaired - set up meeting PC/MW mid Feb Buy in / roads blocks?
IA DEN inc extended DEN MW end Feb MW to get on agenda
ME DEN MJ mid Feb DR to get on agenda
Feedback results of workshop (business case) CB mid Feb Goodfellow & James
Inform Process Safety Global Expertise team RN March endorse direction
Define MRTA Comms plan DL/MW end March
Align with ME eLearning team (Chad Mouton) MW mid Feb
Process Safety x-business team MW mid-April endorse direction
FSR CAB (inc eWIMS - Don Kerridge) PC Feb Get support/budget
SAP CAB (including Interface and KPI) DL Feb Get support/budget
FSR impact analysis PK end Feb High level estimate
MIDLT and PLT review MW May/June Endorse solution and changes to Measures
SAP impact analysis DL end Feb High level estimate
Complete functional spec FSR PC end March Aim for 5 min video, to explain intent
Complete functional spec SAP DL end March
Complete functional spec Interface DL May/June
Would be valuable as long as overall time not
Early implementation of FSR Mitigations ++?? PC Q3 delayed
Turn off Asset and Reputation from FSR TL PC Q3 Phased approach to TL changes
Start SAP development DL May/June
SAP and Interface UAT DL Oct
SAP and Interface Go-live DL Nov
FSR - phase 2; soft go-live PC Nov Could be phased, but via SAP control
Global KPIs reflect new logic PC/DL Jan 1 2017

Copyright of Royal Dutch Shell plc

 ACTION ITEMS
No Action
1Refine model: Perform raising notification walkthrough with typical case
2Impact on wells notification, both manual and from eWIMS
3Potential similar process usage for TR
4Identify additional reporting needed
- Targets and Trends
5Decision points on Operation Risk Assessment grace period
6Finalize and agree on FSR Traffic light rules update
7Provide global guidelines on minimum "must-have" questions to include Z1
standard text templates
8Develop next steps and key milestones
9Document Asset How-to, good practice and scenario based cheatsheets
10Technical feasibility of system to support SCE Impaired process
Review governance, control and R&R in managing mitigations
Review whether EPAF Z1 always by default equates to SCE Impaired
Discussion of eVision and how it will enable mitigation checksheet information to be
recorded and reported
Determine proforma report layout
Confirm where does HAZID and bow-tie recorded
Discussion on how long checksheets should be kept once SCE Impaired has been - Potentially follow local PTW archiving rules
completed Copyright of Royal Dutch Shell plc
Review and map out "As-Is" process and gaps
Globalizing EDCC Standards
Details Action Action
By Party
- Typical positive use case
- Edge cases such as SCE I = Y to N., SCE I=N to Y (escalating deterioration)
- What about P1/P2 where we need to do the work immediately? How we set SCE Impaired, what if
we need WO immediately before ORA is completed?
- SCEs with Impairment
- Non SCE Impaired exceeding LAFD
- Split deviations into extended LAFD / SCE Impaired / TR?
- PB7 IA measures
- Proposal is to go with 5 days
- Update Region 1 CM to only flag SCE I = Y
'- Update Region 2 CM to flag SCE I = N to all Severity
- Maintain Region 3 CM to Sev = 3,4,5
- Inconsistency for Non-SCE CM Box 3
- Performance Standard not met (Y/N), Facility safe to continue operation (Y/N)
- Develop messaging of separating RAM and CMPT, Operation Risk Assessment vs Deviation
terminology
- Endorsement of process by relevant leadership (GPO), networks, Downstream, Gas-GAME
- Change Management for IW28-like customized transaction
- Implementation guidance
- Next steps: Bridging Solution
- Document scenario of how to review SCE Impaired for EPAF Z1 where only 1 FG detector failed
when F&G detection system still maintained
Positive use cases
'- Priority = User Defined "S" set if SCE Impaired = Yes
- Change log on SCE Impaired
- Restricted security profile to set SCE Impaired
- Automations of updating Notification APPR interface
- Review what is the value of SCE Group, Description and SCE Reason OR just prompt if non-SCE
- SCE Group possible values = Yes or No
- IW28-like custom transaction with SCE Group and SCE Reason - what are the available dormant
fields?
- What are other OUs doing? Manageable standardization
- Is this a master data issue, any guidelines on how to address equipment failure but not impacting
barriers at a system level
- Real Sample reports appendices Table A1.1.
- EDCC Coding implementation in Brown field
CMPT ANALYSIS 2016 YTD

Data from Jan – April 2016, for all global OUs (all except Nigeria, BSP or PDO)

ABC = A. 17262 Notifications against SCEs EPAF = YES. 687 Notifications for
Performance Standard Failures
Cons Cat 1 2 3 4 5
Consequence Consequence Consequence Consequence Consequence Consequence
A 7284 3980 1703 164 11 Category Severity 1 Severity 2 Severity 3 Severity 4 Severity 5
E 273 153 61 7 0 A 159 86 300 2 0
P 966 871 525 190 10 E 23 0 1 0 0
R 606 326 130 2 0 P 50 31 23 5 0
Total 9129 5330 2419 363 21 R 5 1 1 0 0
84% 16% Total 237 118 325 7 0

84% do not get tracked by FSR or BW 80% classified as “Asset”

4% classified as People, 3/4/5 Severity

Wide variations between different OUs

Copyright of Royal Dutch Shell plc

CMPT ANALYSIS 2016 YTD CONTINUED

Wide variations between distribution for EPAFs in different OUs

OU Consequence Consequence Consequence Consequence Consequence Consequence
Category Severity 1 Severity 2 Severity 3 Severity 4 Severity 5
A5 A 3
CA A 29 19 57 1
EG A 3 2
GA A 31 14 11
GB A 19 14 108 1
IE A 1 5
IQ A 1 10
MY A 8 2 9
NL A 10 12 41
NO A 1 5
NZ A 1 2 2
PH A 8 8 1
RU A 4 4 13
US A 47 7 33
NL E 1
US E 23
CA P 4 4 13
GB P 8 15 4 5
IQ P 1
MY P 3 2
NL P 3 4 1
NO P 2 1
PH P 1
RU P 3 5 3
US P 27
CA R 1
GB R 4 1
US R 1

Copyright of Royal Dutch Shell plc

 MITIGATIONS CHECKLIST - ONEGAS LEMAN ALPHA

Mitigation Actions check sheets for Leman AD Fire water Pump:

\\europe.shell.com\europe\E & P\SUKEP Lowestoft\Department\Assets\Shared\Leman\Management of Change\SCE and Mitigation Assurance

Copyright of INSERT COMPANY NAME HERE 21

 MITIGATIONS VERIFICATION

OIM 14-day verification example

Facility Manager

Copyright of Royal Dutch Shell plc

 DOCUMENT CHANGE CONTROL
Versio
n Date Changed By Changes
0.0 25-Jan-16 Phil Corringham First entered into Sharepoint
0.1 28-Jan-16 Phil Corringham Removed CMPT P&E from Quadrant 1/2 (Steve McHattie feedback)
0.2 5-Feb-16 Phil Corringham Added Overall Summary/ Background/Purpose of meeting/ Document Change Control page/ Greyed out flag on Z1
approval,
0.3 16-Feb-16 Phil Corringham CMPT matrix added to current process slide,/Quadrant text size and issue cloud/example of mitigations reports
0.4 02-Mar-16 Phil Corringham Quadrant changed to just SCE Impaired; separate slide for UK vs rest of Upstream
0.5 26-Apr-16 Phil Corringham Adapted for MIDLT decision making meeting - APPROVED
0.6 6-Jun-16 Phil Corringham Slide added re alignment with Downstream

Copyright of INSERT COMPANY NAME HERE 23