What is a barrier
A barrier is a defence system to avoid or reduce the consequences of accidental events. Barriers have several nicknames like safeguards, safety systems and protective systems. Accidental events are irreversible physical events that may harm either humans, the environment, properties, production regularity or the market reputation. Example of accidental events are:
- Unintentional flow from an oil and gas reservoir to the surface
- Impacts on people inside a car
- High temperature penetrating through a space shuttle
- Radiation to the environment from a nuclear power plant
Some barriers are made to prevent accidental events. These are called pre-accident barriers. Others barriers are made to reduce the consequences of accidental events. They are called accident or post-accident barriers depending on the time to be used.
Barriers typically change with operational phases. Well barriers are different for the drilling phase, production phase and intervention phases. Well barriers may also change from one operational step to another during the same phase (like during installation).
Barriers are designed to resist predefined worst case scenarios. The heat shield on a space shuttle is designed to withstand the frictional heat between the space shuttle and the air when the space shuttle enters into the atmosphere. The safety systems on nuclear power plant close to the sea in a earthquake area are designed for both worst case ground vibrations from the earthquake itself and the following worst case tsunami. If the worst case scenario is wrongly described, the barrier will fail. Dependency between multiple barriers should be avoided. High level of redundancy have no function if all systems can fail by a common cause failure, like all barriers on a nuclear power plant fail due to sea water exposure.
Rules and regulations are thus not barriers, but risk influencing factors.
Barrier systems consist of one or more barrier elements. Barrier systems are often described as a barrier envelopes to underline their function. Several barriers may be introduced for the same purpose. Such barriers are often illustrated as multiple barrier envelopes called the primary barrier envelope, the secondary barrier envelope, etc.
A barrier description should include:
- What is the accidental event
- Is the barrier a pre-accident, accident or post-accident barrier
- Is the barrier an active or passive barrier
- What operational phases are the barrier designed for
- Barrier system - what does it look like and how does it work
- Barrier system - worst case load scenarios
- Barrier system - how can the barrier be re-established upon a failure
- Barrier system - unwanted effects of the barrier system
- Barrier system - limitations to the operational system when a barrier is non-functional
- Barrier system - number of barrier envelopes (redundancy)
- Barrier system - dependability between more barriers systems (common cause failure)
- Barrier element - worst case operational conditions
- Barrier element - performance
- Barrier element - qualification testing and acceptance criteria
- Barrier element - factory acceptance testing (FAT) and acceptance criteria
- Barrier element - initial operational testing and acceptance criteria
- Barrier element - regulat operational testing and acceptance criteria
- Barrier element - maintenance program
Unwanted effects of a barrier could be premature activation of the barrier. A production barrier could thus cause an unexpected production stop. A drilling barrier could cause an unexpected drillpipe cut-off. A barrier for preventing burglars to break into your house could prevent evacuation during a fire. Different barriers have different purposes. The three basic barrier categories (pre-accident barriers, accident barriers and post-accident barriers) are illustrated the following risk model.
The barrier definition has been discussed for several years without ending up with a clear and practical definition. The model described here is based on an 'old' but logical and simple structure.
Pre-accident barriers are introduced to avoid accidental events related to worst case scenarios like:
- Unacceptable operational condition (like pressure and temperature)
- Unacceptable state of individuals (like a drunk person)
- Human errors
- Component failures
Different pre-accident barriers categories are:
- Barriers that will prevent triggering events
- Barriers that will cause full recovery after triggering events
- Barriers that will make a stabile or labile control after triggering events
Reduced functionality of the system is accepted during these situations. Some pre-accident barriers are also taking over a failed function.
An example of a pre-accident barrier that will prevent a triggering event is when a barrier is activated when the operational conditions are reaching critical values. This could be the high pressure alarm in the control room on a processing plant giving order to the operator to regulate pressure down in the production pipeline (active pre-accident barrier). Another example in the same category is the heat protective elements on a space shuttle to protect people and equipment as the space shuttle enters into the atmosphere (passive pre-accident barrier). A third example of a pre-accident barrier that will prevent a triggering event is when a alcohol ignition lock is used to prevent a drunk individual to drive a car. This will ensure that the driver skills are maintained during a worst case scenario (like skidding in a turn). An example of a pre-accident barrier that may cause full recovery is when a car is coming close to the road shoulder (human error) and the driver is warned by a rough shoulder marking, and corrects the car back to the road.
Pre-accident barriers could be active and passive. Active barriers include:
Each of these functions could be executed by technology or humans. Detection of a failure could thus be sensors or human observations like vibration, noise, smell, smoke, leakage and alarm. The operator or the technical device must then make a correct diagnose. Options for actions must be clarified and the selected action must be performed. Pre-accident barriers are the first protection layer and designed to prevent an accidental event.
Technical redundancy, organisational redundancy and human recovery will normally be pre-accident barriers but not necessarily. It depends on the situation. They will be pre-accident barriers if an accident is prevented. Technical redundancy as dual braking circuits in an automobile is a passive pre-accident barrier. Technical redundancy as dual wiring to the cigarette lighter in an automobile would not be a pre-accident barrier since no accident is prevented upon a cable failure. It is just an action for increased reliability of the power supply. Organisational redundancy is one kind of human recovery. Organisation redundancy requires at least two humans while human recovery can also be achieved when humans are working alone. A general introduction to technical redundancy, organisational redundancy and human recovery follow:
Pre-accident barriers from traffic and oil production follow:
Accident barriers are introduced to reduce the consequences of the accidental event, and become true if the pre-accident barriers fail. Accident barriers take place immediately after the accident. Accident barriers could be active and passive. Active accident barriers are not taking over the failed function, but limit the consequence. Active barriers typical include:
- Detection (automatic by sensors or manual by humans)
- Decision (CPU, relay, human pushes the emergency button)
- Action (e.g. automatic or manual valve closure)
Passive accident barriers are embedded in the design and independent of the active accidental barriers.
Post-accident barriers are also introduced to reduce the consequences of the accidental event, and become true if the accident barriers fail. Post-accident barriers are in other words the same as the first phase in emergency preparedness and include:
- Emergency preparedness plan describing responsibilities, routines and recovery
- Emergency communication system
- Emergency light
- Emergency power
- Fire and evacuation alarm
- Evacuation (like lifeboats, rafts and escape ways)
- Fire-fighting brigade
- First aid
- Medical treatment
Emergency preparedness plans should be established based on an analysis of different accidental scenarios with consequences on personnel, environment and materials. Efficient handling of an emergency situation requires good routines and training. It may also be costly. The emergency preparedness analyses should include practical issues that require people with experience. The analysis for a fire evacuation should e.g. include issues like:
- Restricted view due to smoke
- Reduced view due to tears
- Difficult to breathe
- Hot smoke
- Hot door handle
- Availability to the escape doors, etc
The second phase in emergency preparedness is recovery back to normal. Actions in this phase are not barriers but still a critical phase for the companies involved in the incident. This phase includes actions like:
- Press conference
- Campaigns to regain market position if the market reputation is damaged
Also this phase require plans and training to be handled correct and efficient.
A barrier system could be separated or integrated into equipment. Examples are:
- Totally independent of normal equipment functionality (like the air bag in a car)
- Using parts of the normal equipment functionality (like the anti-lock brakes in a car)
- Being a part of the normal equipment functionality (like the brakes in a car)
The braking system in a car has two main functions. The first function is to safely bring the vehicle to a stand-still anytime. The second function is to guarantee the shortest possible stopping distance in emergency braking situations like when having an elk on the road.
The quality of the barriers and the dependability between different barriers are well as important as the number of barriers. The quality of the barrier is found by qualifying the barrier the same way as other functional equipment. Independence between humans and technical barriers requires humans with theoretical and practical knowledge about the technical barriers. That includes how humans shall act if the technical barrier is down due to e.g. maintenance. Also aim at independence between more technical or between more human barriers. Even qualified barriers require regularly inspection, monitoring and maintenance to function properly in the long term.
Influencing factors are often mixed with barriers. Examples of risk influencing factors from the traffic that often are defined as barriers follow.
The barrier system for the well is called the ‘well barrier’. This system includes both active barrier elements (like DHSV and master valves) and passive barrier elements (like casing, tubing and production packer). More details about the well barriers follow:
Copyright © 2009 ExproSoft AS - Phone: +47 73 200 400.
Any use of information on this web site is subject to terms of creative commons license. The information on the site are under no circumstances intended to substitute individual counseling.
ExproSoft will accept no liability for any type of use of this information as a result of information being inaccurate or incorrect.