Page 154 - Pipeline Risk Management Manual Ideas, Techniques, and Resources

Operation 6/131
occur without engineering supervision, safety training of In this schedule, points may be added for each application up
maintenance crews should include education on the condi- to a maximum point value of 5 points. An application is valid
tions potentially leading io slope failure or other only if the mechanical preventer is used in all instances of the
stabilityisupport issues. Standard procedures should be writ- scenario it is designed to prevent. Ifthe section being evaluated
ten to require notification of an engineer should such condi- has no possible applications, award the maximum points (5
tions be found to exist. points) because there is no potential for this type of human
error.
Emergent? dri1l.v The role of emergency drills as a proactive Three-way walwes It is common industry practice to install
risk reducer may be questioned. Emergency response in general valves between instruments and pipeline components. The abil-
is thought to play a role only after a failure has occurred and ity to isolate the instrument allows for maintenance of the
consequently is considered in the leak impact facfor (Chapter instrument without taking the whole pipeline section out of
7). Drills. however, may play a role in human error reduction as service. Unfortunately, it also allows the opportunity for an
employees think through a simulated failure. The ensuing instrument to be defeated if the isolating valve is left closed
analysis and planning should lead to methods to further reduce after the instrument maintenance is complete. Obviously if the
risks. The evaluator must decide what effect emergency drills instrument is a safety device such as a relief valve or pressure
have on the risk picture in a specific case. switch, it must not be isolated from the pipeline that it is pro-
tecting.
Job proceditres As required by specific employee duties, the Three-way valves have one inlet and two outlets. By closing
greatest training emphasis should probably be placed on job one outlet, the other is automatically opened. Hence, there is
procedures. The first step in avoiding improper actions of always an unobstructed outlet. When pressure switches, for
employees is to document the correct way to do things. Written instance, are installed at each outlet of a three-way valve. one
and regularly reviewed procedures should cover all aspects of switch can be taken out of service and the other will always be
pipeline operation both in the field and in the control centers. operable. Both pressure switches cannot be simultaneously iso-
The use of procedures as a training tool is being measured lated. This is a prime example of a very effective mechanical
here Their use as an operational tool is covered in an earlier preventer that reduces the possibility of a potentially quite seri-
variable. ous error. Points are awarded accordingly.
Scheduled retraining Finally, experts agree that training is Lock-ouf dewices These are most effective if they are not the
not permanent. Habits form, steps are bypassed, things are for- norm. When an operator encounters a lock routinely. the atten-
gotten. Some manner of retraining and retesting is essential tion-grabbing effect is lost. When the lock is an unusual feature.
when relying on a training program to reduce human error. The signifying unusual seriousness of the operation about to be
evaluator should be satisfied that the retraining schedule is undertaken, the operator is more likely to give the situation
appropriate and that the periodic retesting adequately verifies more serious attention.
employee skills.
Key-lock sequence programs These are used primarily to
C7. Mechanical error preventers (0-6 pts) avoid out-of-sequence type errors. If a job procedure calls for
several operations to be performed in a certain sequence. and
Sometimes facetiously labeled as “idiot-proofing,” installing deviations from that prescribed sequence may cause serious
mechanical devices to prevent operator error may be an effec- problems, a key-lock sequence program may be employed to
tive risk reducer. Credit toward risk reduction should be given prevent any action from being taken prematurely. Such pro-
to any such device that impedes the accomplishment of an grams require an operator to use certain keys to unlock specific
error. The premise here is that the operator is properly trained- instruments or valves. Each key unlocks only a certain instru-
the mechanical preventer serves to help avoid inattention ment and must then be used to get the next key. For instance. an
errors. A simple padlock and chain can fit in this category, operator uses her assigned key to unlock a panel of other keys.
because such locks cause an operator to pause and, it is hoped, From this panel she can initially remove only key A. She uses
consider the action about to be taken. A more complex error keyA to unlock and close valve X. When valve X is closed, key
prevention system is computer logic that will prevent certain B becomes available to the operator. She uses key B to unlock
actions from being performed out of sequence. and open valveY. This makes key C available, and so on. At the
The point schedule for this category can reflect not only the end of the sequence, she is able to remove key A and use it to
effectiveness of the devices being rated, but also the possible retrieve her assigned key. These elaborate sequencing schemes
consequences that are being prevented by the device. Judging involving operators and keys are being replaced by computer
this may need to be subjective, in the absence of much experi- logic, but where they are used, they can be quite effective. It is
ential data. An example of a schedule with detailed explana- important that the keys be nondefeatable to force operator
tions follows: adherence to the procedure.
Three-way valves with dual instrumentation 4 pts Compuferpermissiwes These are the electronic equivalent to
Lock-out devices 2 pts the key-locks described in the last section. By means of soft-
Key-lock sequence programs 2 pts ware logic ladders. the computer prevents improper actions
Computer permissives 2 pts from being taken. A pump start command will not be executed
Highlighting of critical instruments I Pt if the valve line-up (proper upstream and downstream valves