PFEER, DCR AND VERIFICATION

If by some chance you have stumbled on this article by accident, and are actually looking for something else entirely I would advise you to move on. Verification, as the word is applied to the UK safety case legislation is so complex that even those deeply involved seem to have only a limited understanding of the related statutes.

 When the original safety case legislation was enacted in 1993 it seems that the law makers thought they had not actually covered everything and so they passed a number of subsidiary bits of legislation in 1995. These bits were the PFEER (Prevention of Fire Explosion and Emergency Response) Regulations, DCR (The Design and Construction Regulations) and MAR (The Management and Administration Regulations). Among other things PFEER and DCR are both concerned in their own way with verification. PFEER requires that the duty-holder, the owner of the safety case, by a process of risk analysis, identifies those elements which will reduce the possibility of fire or explosion and assist with emergency response, and if they do not already exist, put them in place. DCR requires that the elements of the structure or equipment of the offshore installation which are critical to safety be identified by expert review.

 It can be seen that the two requirements are slightly different, but because it seemed impractical to have two separate schemes, they are invariably combined into a “combined scheme”. As far as PFEER is concerned it seems likely that it was intended that as well as hardware, personal, skills and procedures should be included but no-one has ever done this so the schemes as they exist today consist solely of hardware, with nods towards computer programmes. These items are known as Safety Critical Elements and once they have been identified they have to be provided with performance standards.

So who is going to do all this stuff, and who is going to make sure that what has been done fits the bill. By 1995 the UK Health and Safety Executive were beginning to realise that the cost of monitoring safety cases was going to be enormous and so included in the legislation was the requirement that the Verification Schemes should be effectively self monitoring. Hence a duty-holder, who would be most likely to be a rig owner or an oil company,  would commission some-one to write the scheme and it would then be reviewed by an ICP (Independent and Competent Person). And while the legislation does not say who should write the schemes it does make rules about who can be the independent and competent person, saying that they should have sufficient expert resources to do the job, and that they should be financially independent of the duty-holder. A few duty holders have installed their own ICPs who are supposed to be independent of the line management, but in most cases engineering experts are used, and invariably for mobile units – drilling rigs – the expertise is provided by the classification societies.

It is difficult to keep to the point at this juncture, because the relationship between class (the classifications societies) and their clients, who are essentially the marine insurance companies, and the people who pay the bills, who are the owners of the objects surveyed, is so confusing. The ship or rig owner chooses the classification society who they want to periodically inspect their marine object and survey it during construction if that process is applicable. If they don’t like the way one classification society works they can change to another. There are a number to choose from; Lloyds in UK, DNV in Norway, ABS in America, RINA in Italy, Bureau Veritas in Begium, Germanicher Lloyd in Germany and RMSR in Russia. But of course these organisations are not limited by national boundaries and so, as far as the oil industry is concerned, nearly all semi-submersibles are classed with DNV (Det Norsk Veritas) and nearly all jack-ups are classed with ABS (the American Bureau of Shipping).

Hence when it came to verification it was natural that the mobile unit owners chose their classification society to be their ICP. After all they were doing inspections anyway, and together with the flag state work on the emergency equipment, almost everything required by verification would be fulfilled. But part of the DCR legislation requires that the ICP should review the Verification Scheme before issue, both in terms of the list of SCEs (Safety Critical Elements) and the content of the scheme. There is nothing to prevent the ICP also writing the scheme, so some of the classification societies will suggest to their clients that if they write the schemes everything will be fine. After all, they will be unlikely to find anything wrong with their own work. It would also appear to be difficult for a non class organisation to be the ICP, or for a different classification society to be the ICP. Well, it just depends on how the Verification Scheme is written; and here it begins to look as if we are spinning in ever decreasing circles.

The control of the process by the classification societies, something which the original writers of the legislation cannot possibly have foreseen, and worse, any efforts by anyone to be genuinely independent, are often stifled by threats of one difficulty or another, from those who see it as their right to be doing the work.

If only this was the end of the story. But lamentably it isn’t. Despite the fact that in legislative terms the HSE OSD (The Health and Safety Executive – Offshore Safety Division) have absolutely nothing to do with verification, they will keep putting their oar in, and as time passes different assessors will take a view and suggest to the owners of the schemes that they should make changes, in order to conform to…what? Because the legislation is “goal setting” the writers and owners of the schemes may have their own ideas as to what they should contain, and how the performance standards should be presented. Even the ICPs, if they are not the writers of the schemes, do not have the right to demand changes. They can table a “reservation” which must be noted by the owner of the scheme, but no other action is required by law.

But the HSE, are generally able to force their views on offshore installation owners, because disputes would require recourse to the courts, and judgements by the judiciary, and the costs of waiting for a case to be heard would amount to a fine so serious that assets would have to be sold to pay for it. The 2005 safety case legislation actually allows an appeal to be made to the secretary of state, but in the meantime the unit related to the various documents in dispute would be prevented from going to work. Who is going to challenge the regulators in this situation? It’s get on with it and do what they want, or challenge them and have a prohibition order posted on you, probably based on the 1974 Health and Safety at Work Act, which requires employers to provide a safe place of work. Hence, “if you don’t do what we want, what you are doing  must be unsafe because we are the experts”.

It would be wrong to suggest that HSE assessors and inspectors are motivated solely by a need for personal advancement in what appears to be a bureaucratic organisation, which charges fees approaching £200 per hour for their assessments and inspections. Many of them are dedicated men and women motivated by a desire to keep people alive and uninjured in the workplace. But in the end we cannot get away from the fact that the HSE OSD draws its workforce from diverse sources, and even those with limited experience of what is a complex and sometimes hazardous working environment, may still feel that they have the right to impose their ideas on the owners and operators of offshore installations.

So what is to be done? Ideally a review of the legislation is required to iron out the difficulties outlined in this article, because there is little doubt that of all the safety case legislation, a set of risk based performance standards may be the most useful, and in the end the least complex, means of keeping the guys safe out there.

Victor Gibson. December 2010.