Offshore Safety Management: Implementing a SEMS Program

1

Risk Management

This chapter describes the principles of risk management as they apply to the offshore oil and gas industry, the impact the Deepwater Horizon/Macondo event had on the industry and how safety management systems have evolved in response. The fundamentals of safety management are described including: acceptable risk, process safety and culture, the use of risk matrices, the economics of offshore safety, means of measuring progress, and leading and lagging indicators. The distinction between prescriptive and nonprescriptive systems is discussed.

Keywords

Safety management systems; Deepwater Horizon; Macondo; risk management; acceptable risk; ALARP; leading and lagging indicators; economics of safety

Chapter Contents

Introduction

Impact of Deepwater Horizon/Macondo

Process safety trends

Offshore

The pipeline industry

Safety management systems

Organization of this book

Historical background

Onshore developments

Occupational safety, process safety, and culture

Occupational safety

Process safety

The Baker Report

The incident triangle

Risk management

Perception of the consequence term

Performance-based/prescriptive programs

Nonprescriptive

Performance-based

Fiberglass composite pipe example

Acceptable risk

Uncertainty

Cost-benefit analysis

Risk reduction

As low as reasonably practicable risk—ALARP

Setting ALARP

Difficulties with ALARP

Reverse ALARP

Risk matrices

Consequence matrix

Frequency matrix

Risk matrix

Safety management systems

Fundamentals

Safe limits

Holistic

Involvement and thoroughness

Operators

Elements of an SMS

1. Facility description

2. Technical information

3. Risk assessment

4. Risk acceptance

5. Report

6. Audit

Economics

Benefits

Costs

BOEMRE data

Measuring progress

Lagging and leading indicators

Lagging indicators

Leading indicators

Key performance indicators

Tier 1—Process safety event

Tier 2—Process safety event

Tier 3—Challenge to safety systems

Tier 4—Operating discipline and management system performance

Safety as a causal factor

Culture

References

Introduction

The offshore oil and gas business is hazardous. Some of the many issues to be concerned about include the following:

• Explosions and fires.

• Weather conditions can be harsh and unforgiving.

• Toxic gases, particularly hydrogen sulfide (H2S), are a frequent by-product of the oil and gas that is produced.

• Emergency response can be a challenge; platforms and rigs are small and congested. And the people on board have to respond with the resources they have; outside help is not usually quickly available.

Thus, from its very beginning this industry has had to pay particular attention to the safety of the workers and the prevention of catastrophic events. Generally these efforts have been successful, particularly with regard to occupational or personal safety, as illustrated in Figure 1.1, which shows the progress that has been made in recent years in the United States (mostly the Gulf of Mexico).

Figure 1.1 Safety trends—United States Outer Continental Shelf. (Source: United States Mineral Management Service, 2009)

Figure 1.1 was first published by the United States Mineral Management Service (MMS)—the government agency responsible, at the time, for offshore safety regulation and enforcement. These responsibilities for the MMS are now handled by the Bureau of Safety and Environmental Enforcement—BSEE. The chart provides data to do with the number of offshore safety incidents for the period 1996 to 2011. The trend is impressive: in just 12 years the recordable injury rate declined from 3.39 to 0.75, a drop of around 80 percent. And the number of lost workdays dropped by a similar percentage. Moreover the trend is quite smooth and steady, showing that the results are not a fluke or one-time event. And these advances were made as the industry has worked in ever-more challenging conditions—particularly as it has moved into very deep water operations.

Figure 1.2 shows a similar positive trend with respect to the industry’s environmental record. The data, which are provided by the United States Coast Guard, include some land-based facilities, and also spills from inshore (state) waters. If the two bars for each of the years in Figure 1.2 are combined, it can be seen that the amount of oil spilled annually has declined from just under 6 million gallons in the early 1980s to an almost negligible amount by the year 2005.

Figure 1.2 Environmental trends—Offshore United States.

Impact of Deepwater Horizon/Macondo

The trends shown in Figures 1.1 and 1.2 are largely attributable to improvement in occupational or personal safety. And prior to the year 2010, the trends to do with major events such as fires and blowouts also seemed to be favorable, although the level of improvement was not as great for personal safety and the quality of the data was not nearly as good.

Then came the Deepwater Horizon explosion and fire followed by the spill of oil from the Macondo well.

To say that this catastrophe was a shock to the industry would be a gross understatement. Not only was the initial impact of the loss of life, the destruction of the rig, and the massive spill dramatic enough, but the event showed that systems were not in place to respond promptly to a catastrophe of this magnitude. In particular, it took 5 months before the well could be sealed; and during those 5 months, dramatic scenes were broadcast around the world showing oil pouring into the ocean 1 mile down. Equally compelling footage of events onshore, such as the death of wild birds and the closure of many small businesses, added to the impression of a situation out of control. In other words, the Deepwater Horizon event had public relations implications that went way beyond the losses associated with just one drilling rig. As the National Commission Report (2011) described on page 75 to President Obama said:

Deepwater energy exploration and production, particularly at the frontiers of experience, involve risks for which neither industry nor government has been adequately prepared, but for which they can and must be prepared in the future.

Moreover, the event revealed structural flaws in the safety management systems of offshore facilities.

The discussion concerning Titanic disaster in Chapter 2 provides the following quotation (Brander 1995):

The Titanic disaster suddenly ripped away the blindfolds and changed dozens of attitudes, practices, and standards almost literally overnight.

The same comment could be applied to the Deepwater Horizon catastrophe.

At the time of writing, the consequences raised by Deepwater Horizon are not confined to the offshore oil and gas industry. At the time of this writing, the consequences of the severe damage to the Fukushima nuclear power plants in Japan are still being ascertained. But it is clear that those consequences will be profound; substantial quantities of radioactive materials have been released, a significant fraction of Japan’s power-generating capability is lost forever, and the cost of clean-up and remediation is going to be enormous. Indeed, the Fukushima accident may result in a massive slowdown in the construction of new nuclear power plants worldwide. Clearly, the offshore oil and gas industry is not the only one facing major challenges with respect to the management of safety and environmental performance.

Process safety trends

Figure 1.1 shows the impressive improvements that have occurred in occupational safety over the last two decades. It is difficult to develop comparable data with respect to process safety events because such events occur much more rarely, and because there are no broadly-agreed upon measurement parameters for them. However, process safety does not appear to be improving at the same rate—at least for the offshore and pipeline industries.

Offshore

Trends to do with offshore process safety were summarized in a December 2010 Wall Street Journal article entitled Far Offshore, A Rash of Close Calls (Gold, 2010). The following quotations are taken from that article.

The oil industry has said the Deepwater Horizon rig catastrophe was a unique event, the result of an unprecedented series of missteps that are unlikely to be repeated. The recent history of offshore drilling suggests otherwise.

In the months before and after the rig exploded and sank, killing 11 and spilling millions of barrels of oil into the Gulf of Mexico, the industry was hit with several serious spills and alarming near-misses, some of them strikingly similar to what happened aboard the Deepwater Horizon.

A blowout off the coast of Australia left oil flowing into the Timor Sea for weeks. An out-of-control well in the Gulf of Mexico dislodged a 4000-pound piece of equipment on the deck of the Lorris Bouzigard drilling rig as workers scurried to safety. A gas leak in the North Sea aboard a production platform came within a rogue spark of a Deepwater Horizon-scale disaster off the coast of Norway.

Data from regulators around the world suggest that after years of improvement, the offshore-drilling industry’s safety record declined over the past 2 years.

The Wall Street Journal reviewed statistics from four countries with large offshore oil industries and modern regulatory systems: the United States, Great Britain, Norway, and Australia. (A fifth, Brazil, declined to make its data available.) Each country uses different approaches to measure losses of well control or spills, but they reveal a similar trend.

In the U.S. portion of the Gulf of Mexico in 2009, there were 28 major drilling-related spills, natural gas releases, or incidents in which workers lost control of a well. That is up 4 percent from 2008, 56 percent from 2007, and nearly two-thirds from 2006. Taking into account the number of hours worked on offshore rigs, the rate of these incidents rose every year from 2006 to 2009.

The United Kingdom’s Health and Safety Executive counted 85 serious oil and gas releases in the 12 months ended March 31, up 39 percent from a year earlier. Taking into account the number of hours worked offshore, the rate of incidents was the highest since 2004 to 2005.

In Norway, companies had 37 oil and gas releases and well incidents in 2009, according to the country’s offshore regulator. That is up 48 percent from 2008 and is the highest level since 2003. Norway’s rate of incidents per man-hour rose 42 percent in 2009, to its highest level since 2005.

In Australia in the first half of this year, there were 23 oil spills, gas releases, and incidents in which oil or gas entered a well, threatening a blowout, according to Australia’s National Offshore Petroleum Safety Authority. That is almost as many as the 24 such incidents in all of 2009. The incident rate, accounting for hours worked, has more than doubled since 2005.

Reflecting the uncertainty associated with reporting process safety trends, the following responses were made to the Wall Street Journal reporters:

The industry’s faith in its ability to safely develop oil and gas from facilities at sea is largely unshaken. The Deepwater Horizon was an isolated incident, says Erik Milito, a senior official at the American Petroleum Institute. We do not believe there is a systemic failure across the industry.

The industry points to a lengthy track record—50,000 wells drilled in the Gulf of Mexico without a catastrophe similar to what unfolded earlier this year.

The American Petroleum Institute, which represents the U.S. oil industry, cautions against reading too much into the statistics. Drawing sweeping conclusions from a limited analysis of this data are simply not valid, the institute said in a statement… I do not believe there is an outbreak or a rash of accidents, says Lee Hunt, president of the International Association of Drilling Contractors, a trade group.

Although the number of incidents in the Gulf of Mexico are small the authors of the article note that deepwater projects are much more risky.

…some experts say such statistics mask the increasing challenge of offshore drilling. With each passing year, the wells are getting more complex because the easy drilling locations already were tapped. Most of those 50,000 wells were easy compared to the Deepwater Horizon’s well.

David M. Pritchard, a petroleum engineer and consultant, studied a database of 5000 Gulf of Mexico wells since 1993. The data is compiled by industry to allow companies to compare their performance against their peers. The wells are indexed by drilling difficulty. Mr. Pritchard looked for wells that were at least as complex as the well the Deepwater Horizon was trying to drill. He found 43.

What is the real risk of occurrence of a catastrophic failure? Is it one in 50,000, or is it now one in 43? asks Mr. Pritchard. He says he worries the industry is in total denial about the risks it faces.

By contrast with the Piper Alpha tragedy, when the explosion and fire occurred on the Deepwater Horizon rig 25 years later, 11 men died instantly; but the other 135 persons on board survived the blast and subsequent fire. This is an indication that the safety measures that have been designed into rigs and platforms in the years following Piper have had a positive effect on safety improvement.

It is also important to note that there have been major improvements in the design of offshore facilities. For example, the Piper Alpha catastrophe of 1988 resulted in 144 fatalities. The Deepwater Horizon fire and explosion in 2010 resulted in a significantly smaller death toll—11 fatalities. It is probable that the toll on Deepwater Horizon would have been much greater had it not been for the safety systems that are now installed on offshore rigs.

The pipeline industry

The offshore oil and gas industry is not the only one that is having problems improving its process safety record. In May 2013 the Pipeline and Gas Journal published an editorial—part of which is quoted below.

API’s annual liquids pipeline conference last month in sunny San Diego was instead a scene of uneasiness for many of those in attendance…the conference really culminated with the terse announcement that there were no winners among large operators for API’s prestigious Pipeline Distinguished Safety and Environmental Performance Award. Good for API, which has raised the bar to qualify for the award. None of them deserved to win.

The article quotes a string of incidents—all suggesting an unfavorable trend. Major companies are named including Enbridge, Chevron, ExxonMobil, and Shell. Some of these companies have reported several events. Table 1.1 provides a summary of these incidents.

Table 1.1

Pipeline Incidents

Safety management systems

In order to reduce the number and severity of major events companies need to develop and implement a Safety Management System, or SMS. The details of an SMS vary from company to company and agency to agency, but they all tend to have broadly the same structure and content. In the United States, the agency responsible for offshore safety, the Bureau of Safety and Environmental Enforcement (BSEE), issued its Safety and Environmental Management System (SEMS) rule.¹ The management elements of SEMS are shown in Table 1.2.

Table 1.2

Elements of SEMS

1. General

2. Safety and environmental information

3. Hazards analysis

4. Management of change

5. Operating procedures

6. Safe work practices/JSAs

7. Training

8. Quality and mechanical integrity of equipment

9. Prestartup review

10. Emergency response and control

11. Investigation of incidents

12. Auditing

13. Records and documentation

14. Stop work authority

15. Ultimate work authority

16. Employee participation

17. Reporting unsafe conditions

These management elements are referred to frequently throughout the rest of this book.

Organization of this book

This book has been written both for those who design offshore facilities and those who operate and maintain them. The focus of the book is on the management of offshore safety. Another book in this series, Process Risk and Reliability Management, provides detailed information on the technical aspects of safety management.

This book is organized into the nine chapters listed in Table 1.3.

Table 1.3

Book Structure

Historical background

The development of formal safety management systems for offshore oil and gas facilities can be said to have started with the Piper Alpha catastrophe that occurred in 1988. Offshore platforms had had safety programs before that time, of course, usually built around Safety Cases (described in Chapter 8). But Piper Alpha ushered in a new and much more thorough approach to system safety.

Following the accident, an investigation was conducted by a committee headed by the Scottish High Court judge, Lord Cullen. The committee’s report was highly critical of the safety programs that had been in place in the North Sea facilities prior to the accident.

In response to the Cullen report, the offshore industry took two different tracks as shown in Figure 1.3. Companies operating in the North Sea (and, later on, other areas of the world such as Australia) continued with the safety case approach as shown in the bottom track of Figure 1.3, but radically improved the thoroughness and quality of the technical analyses and put in place more stringent measures to ensure that the recommended measures were implemented.

Figure 1.3 Impact of Piper Alpha.

In the United States (principally the Gulf of Mexico) the response to the Piper Alpha incident was equally vigorous, but followed a different path. The American Petroleum Institute (API) developed their Recommended Practice 75 (RP 75), which recommended that offshore facilities develop a Safety and Environmental Management Program (SEMP). Like a safety case, RP 75 is mostly nonprescriptive. However, it makes extensive reference to industry standards (mostly from the American Petroleum Institute), and so it is perceived as being considerably more prescriptive then the safety case approach. Nor does RP 75 require that a formal assessment of acceptable risk (ALARP) be determined.

Reasons for not using safety cases in the United States include the following:

• The Gulf of Mexico has between 5000 and 6000 platforms—many of them small and in shallow water. It is simply not economically feasible to write a safety case for each platform. Arnold (2010) uses the example of the response to a proposed requirement from the MMS to carry out a Failure Modes and Effects Analysis (FMEA) on each facility. Instead of doing this, generic FMEAs and HAZOPs (Hazard and Operability Studies) were carried out on 13 facilities. This was done because the process equipment and instrumentation are very similar to one another for these platforms.

• The multiple small platforms are generally very similar to one another. Therefore it makes more sense to develop universal standards (typically written and published by the API) than to conduct a formal analysis for each platform.

• The use of API standards and related documents has proven to be successful. The Deepwater Horizon incident was the first major release in U.S. waters since the Santa Barbara blowout of 1969, thus indicating that SEMP-based systems have been effective. Furthermore, the recent Montara incident that is discussed in Chapter 2 occurred in an area of the world that does use safety cases.

• The preparation of safety cases is time-consuming and involves a large amount of paper work. It is not clear if this administrative effort truly improves safety.

• When all platforms are designed and operated to the same standards it is relatively easy to audit them. The auditor simply has to look up the appropriate code or rule in order to determine compliance. Such is not the case with a safety case system, where each platform has its own unique program against which it has to be evaluated.

Onshore developments

The development and improvements in offshore safety discussed above and shown in Figure 1.1 were matched by corresponding changes and improvements in the onshore process industries in roughly the same time frame, as can be seen from Figure 1.4 (courtesy DNV). The data shown are for individual companies and for groups of companies.

Figure 1.4 Onshore safety trends.

The radical improvement in safety over a period of 20 years that was noted in Figure 1.1 is repeated for these onshore facilities.

Figure 1.5 provides a simple overview as to how regulations and standards in the onshore process industries developed.

Figure 1.5 Onshore safety programs.

In the 1980s a series of serious incidents occurred in chemical plants throughout the world. With over 3500 fatalities, the Bhopal catastrophe of 1984 was the worst-ever industrial event in terms of loss of human life (although that event may well have been caused by sabotage). But there were many other high-profile incidents, including a sequence of explosions and fires in Pasadena, Texas in the mid to late 1980s.

Consequently, various nations enacted process safety-type legislation, such as the Seveso Initiative in Europe. In the United States, the Amendments to the Clean Air Act, which was signed by President George H.W. Bush just before he left office, required (among its many provisions) that the Occupational Safety and Health Administration (OSHA) and the Environmental Protection Agency (EPA) put in place Process Safety Management (PSM) and Risk Management Program (RMP) regulations. The Act was written such that the technical sections of the respective regulations are very similar to one another, thus minimizing duplication of effort. (The legal and reporting sections of the two systems are, however, very different from one