At the beginning of September 2013 your scribe was asked to present a paper at a safety conference in Houston which was mainly concerned with the new rules to which all operators in US water have to conform. These rules relate to SEMS (Safety and Environmental Management Systems) Regulations which have been put in place since Macondo. So they may not want that North Sea S**t in the Gulf of Mexico, but it may be that they have something more onerous and less effective to deal with now. One of the themes of the presentation was the manner in which the oil industry will do almost anything rather than embrace any regulatory requirements.

THE SAFETY CASE – HISTORY

In the UK offshore oil industry no-one had ever heard of a safety case before Piper Alpha, although that is not to say that there had not been any problems out there. Back in 1965 shortly after it had made the first discovery of hydrocarbons on the UKCS the rather primitive jack-up Sea Gem was preparing to move to another location a couple of miles away, and was beginning to jack down when two of the legs collapsed and the rig was tipped over into the sea. 13 men died, the remainder being rescued by the British cargo ship the Baltrover and an RAF rescue helicopter.

The result of this tragedy was the inception of the role of OIM, the Offshore Installation Manager on all offshore installations and mobile units operating in the UK sector of the North Sea, and the requirement that they all be provided with standby vessels, in case of further misfortunes of a similar nature. The regulatory body with the responsibility for overseeing the regulations was the UK Department of Transport, of which the UK Coastguard was a department.

So after the inception of the Minerals Workings Act, actually in 1971 all offshore installations in the UKCS were provided with a standby boat, a small craft given the task of being available to rescue anyone who fell overside, or the whole crew if a disaster or if a helicopter fell into the sea. It may be a symptom of the disdain with which the oil companies viewed the regulations that the standby vessels provided were usually former deep sea trawlers of which many had become available due to the great Icelandic cod war. Because of their former work they were more or less able to look after themselves, and mostly spent their time drifting about since they were equipped with rod and chain steering, and were never provided with an autopilot. They often ran out of food and water and were assisted either by the installations they were supposed to be looking after, or by the visiting supply vessels. And incidentally on semi-submersibles the OIM was frequently little more than a clerk, who did the paperwork for the rig while the Toolpusher, sometimes now call ‘the Rig Superintendent’ remained in charge.

PIPER ALPHA

 

The Piper Alpha disaster on 6th July 1988 in which 167 of the 248 crew members died caused everyone in the business in UK to take a deep breath. Almost immediately the government commissioned a public enquiry chaired by Lord Cullen a Senator of the College of Justice in Scotland.

The enquiry sought to answer two questions

1. What were the causes and circumstances of the disaster on the Piper Alpha platform on 6th July 1988, and

2. What should be recommended with a view to the preservation of life and the avoidance of similar accidents in the future.

The enquiry’s findings are contained in two volumes and resulted in 106 separate recommendations. The first 13 of the recommendations relate directly to the provision of a Safety Case for every offshore installation whether fixed or mobile.  Incidentally the report featured the standby vessel, the Silver Pit. Lord Cullen said  “I am entirely satisfied that in the above respects (manoeuvring capability) the Silver Pit was essentially unsuitable for the purpose of effecting the rescue of survivors”.

Lord Cullen borrowed the concept of the Safety Case – making the case for safety – from the nuclear industry. Here it had been deemed essential that all risks should be identified and means found to reduce them to a level considered to be as low as reasonably practicable. It was necessary in the nuclear industry since an accident could result in fall-out over a large area, with consequent deaths in the community. Subsequent to the Flixborough chemical accident in 1974 Safety Cases were also introduced for chemical plants.

The recommendations contain the following statements which are particularly pertinent to the manner in which the risk assessment is carried out and the resulting recommendations acted on:

2.ii that the potential major hazards of the installation and the risks to personnel thereon have been identified and appropriate controls provided.

4.ii A demonstration that so far as is reasonably practicable the exposure of personnel on the platform to accidental events and their consequences has been minimised.

The words  “so far as is reasonably practicable” are derived from the ALARP principle which states that risks must be “as low as is reasonably practicable”. These statements indicate the requirement for the industry to move from a prescriptive form of legislation to a goal setting form of legislation.

THE UK SAFETY CASE LEGISLATION

As a result of the Lord Cullen's recommendations the HSE were appointed as the single regulatory body for offshore safety, and the HSE legal departments framed the Safety Case Legislation in a manner which followed the Cullen recommendations for goal setting legislation and which also caught some existing prescriptive regulations.

The resulting statutes were as follows:

Offshore Installations (Safety Case) Regulations 1992

Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995

Offshore Installations and Wells (Design and Construction, etc) Regulations 1996.

Offshore Installations and Pipeline Works (Management and Administration) Regulations 1995

The Safety Case regulations require that the Safety Case should demonstrate the following:

 i) that the management system is adequate to ensure compliance with the statutory health and safety requirements.

 ii) that adequate arrangements have been made for audit and the preparation of audit reports.

iii) that all hazards with the potential to cause major accidents have been identified, their risks evaluated, and measures taken to reduce risks to persons to as low as reasonably practicable.

Related statutes and templates are as follows:

 1993 IADC Mobile Unit Safety Case Template

2002 IADC European HSE Case Template

2006 The Safety Case Regulations 2005

2006 The IADC International HS&E Case Template

The original Safety Case Regulations required the Duty Holders to put in place means of identifying and reducing risks using the latest available technology, and so it was expected that, at each three year revision, there would be recommendations made, although it was likely that they would become less costly as time passed.

Today the regulations require that a major review be carried out every five years which seems to indicate that the HSE do not expect there to be major technical changes taking place as time passes, although they do constantly carry out studies and release reports, to enhance the knowledge of the safety practitioners, the offshore management and hopefully the workforce.

THE SAFETY CASE TODAY (This presentation did not take into account the latest EU requirements).

In general the content of the UK safety cases has not changed much since about 2000, and the IADC European Template issued for the use of mobile unit owners remains a good example of the way in which the job can be done. Some people might choose to put forward the IADC 2006 International Template, but in fact it is unlikely to be acceptable to many regimes which have a formal requirement for a safety case.

Typically the content of a case for a mobile unit which is suitable for submission to the HSE in UK today may have the following sections and subsections:

SECTION 1............................................................. INTRODUCTION

    Subsection 1.1             Introduction

    Subsection 1.2             SCR Compliance

    Subsection 1.3             HSE Case Reviews And Updates

Some of the sections are pretty straightforward. Section 1 will contain the introduction to the case, and will include a roadmap to the rest of the document and a summary of the content which is intended to provide information, particularly for the workforce. Some cases contain a checklist which is based on what the HSE inspectors look for in the document, showing where each item of information can be found.

SECTION 2................................................... MANAGEMENT SYSTEM

    Subsection 2.1             Policies And Objectives

    Subsection 2.2             Organization, Responsibilities, And Resources

    Subsection 2.3             Standards And Procedures

    Subsection 2.4             Performance Monitoring

    Subsection 2.5             Management Review And Improvement

Section 2 summarises the safety and environmental management system in place. In UK this section, or more correctly the safety management system, is usually based on HSE guidance. And since there is a tendency for organisations to carry out modifications to their management systems in response to incidents, this section may require revision more often than one might think. One of the requirements is always that the company operates a safety observation programme, and so such programmes are mostly in place using acronyms of one sort or another, and sometimes monitory means of encouraging the workforce to submit reports.

SECTION 3.......MODU DESCRIPTION AND SUPPORTING INFORMATION

    Subsection 3.1             General Information

    Subsection 3.2             Primary Structure

    Subsection 3.3             Drilling, Completion And Well Control

    Subsection 3.4             Plant And Utilities

    Subsection 3.5             Fire And Explosion Protection

    Subsection 3.6             Evacuation And Escape Systems

    Subsection 3.7             Accommodation

    Subsection 3.8             Well Testing

    Subsection 3.9             Diving Support

    Subsection 3.10          Other Third Party Equipment

Section 3 Is usually a presentation of the technical details, and at this point one can hear the detractors expounding on the other locations where all the necessary information concerning the rig equipment can be located. Lord Cullen found that no-one actually knew all about the equipment installed on Piper Alpha, and even today most offshore installations are provided with different documents containing conflicting information. During offshore visits I have had to resort to photographing the brass plates on the actual machines, and in some cases have had to submit the serial numbers to the manufacturers to obtain details of the operational limits.

SECTION 4......................................................... RISK ASSESSMENT

    Subsection 4.1             Introduction

    Subsection 4.2             Qualitative Risk Assessments

    Subsection 4.3             Quantitative Risk Assessment (Qra)

    Subsection 4.4             Temporary Refuge Integrity Assessment

    Subsection 4.5             Conclusions

Section 4 may be the most important section, since it will probably contain the risk assessment processes and their results. This will probably be a summary of the complete risk assessment processes since they have become more complex as the years have passed. Lord Cullen was keen on QRA, Quantitative Risk Assessment, calculating risk by numbers. For this process to make any sense one has to use records and make some assumptions and come up with a number which is acceptable to the company and the regulators. Usually this is an Individual Risk Per Annum of 1x10-3 or giving an individual a chance of dying after working for 1000 years on the installation. Back in the day when we used to use WOAD, the World Offshore Accident Database, we used to reduce the risk by 50% because we thought that we were safer in UK.

There is more. In addition to the QRA, the safety engineers have to calculate the TR integrity (Temporary Refuge Integrity) and the potential for the crew members to be reduced to charred  remnants by the radiation from the blowout as they make their way to and assemble at the evacuation stations. Also for any worthwhile safety case, qualitative risk assessments must be carried out involving representatives from the crew. These will hopefully result in recommendations being made for improvements to many aspects of the rig’s systems, operations and procedures, of which more later.

SECTION 5................................................. EMERGENCY RESPONSE

    Subsection 5.1             Emergency Response Management

    Subsection 5.2             Command And Communication

    Subsection 5.3             Training For Emergencies

    Subsection 5.4             Temporary Refuge Assessment

    Subsection 5.5             Details Of Escape, Evacuation And Rescue (EER) Arrangements

Section 5 may deal with emergency response. In UK the whole emergency response process is governed by the PFEER Regulations, (the Prevention of Fire, Explosion and Emergency Response Regulations). So this section will detail the ER processes, usually as a summary of another document. The intent here is that the whole process is subject to a degree of thought, rather than people just making an assumption that there won’t be any accidents anyway, and so what do we need an emergency manual for,  and that any drills and exercised are performed solely in order to conform with regulatory requirements and are carried out in a way which minimises interference with normal operations. In this process the shoreside emergency processes are important, and it may be worth noting that the Designated Person Ashore for the Costa Concordia has accepted a jail sentence in Italy

SECTION 6............. JUSTIFICATION FOR CONTINUED OPERATIONS

    Subsection 6.1             Recommendation Assessment

    Subsection 6.2             Action Plan/Recommendations

    Subsection 6.3             Cost Benefit Analysis     

    Subsection 6.4             Recommendations Closed Out

    Subsection 6.5             The Demonstration Of Alarp

And so we get to Section 6, which is presented variously by different organisations. It can be noted that this is usually headed ‘ Justification for Continued Operations’. This justification is effectively that the risks to personnel have been reduced to ‘ALARP’ (as low as reasonably practicable). The justification may be that the company has extensive audit processes in place with will ensure that everything is as it should be. Or alternatively it may list the recommendations which have been made as part of an improvement programme together with the dates by which the listed improvements will be carried out. One can than assume that when the improvements have all been done continued operations can be justified.

In addition to these sections the 2005 Safety Case Regulations required that ‘Combined Operations’, activities involving two or more units provided with safety cases, should also be addressed.

SECTION 7............................. COMBINED OPERATIONS ADDENDUM      

    Subsection 7.1            Introduction

    Subsection 7.2             Management Of Simultaneous And Combined Operations Systems

    Subsection 7.3             Joint Review Of Safety Aspects

    Subsection 7.4             Plant Likely To Be Used During Combined Operations

    Subsection 7.5             Monitoring And Review Arrangements

THE SAFETY CASE AND SEMS

It is possible to see from the descriptions above that the safety case template described ticks nearly all the boxes required by SEMS.

The original elements of RP75 which were made mandatory were as follows:

  • General provisions: for implementation, planning and management review and approval of the SEMS program.
  • Safety and environmental information: safety and environmental information needed for any facility, e.g. design data; facility process such as flow diagrams; mechanical components such as piping and instrument diagrams; etc.
  • Hazards analysis: a facility-level risk assessment.
  • Management of change: program for addressing any facility or operational changes including management changes, shift changes, contractor changes, etc.
  • Operating procedures: evaluation of operations and written procedures.
  • Safe work practices: manuals, standards, rules of conduct, etc.
  • Training: safe work practices, technical training – includes contractors.
  • Mechanical integrity: preventive maintenance programs, quality control.
  • Pre-startup review: review of all systems.
  • Emergency response and control: emergency evacuation plans, oil spill contingency plans, etc.; in place and validated by drills.
  • Investigation of Incidents: procedures for investigating incidents, corrective action and follow-up.
  • Audits: rule strengthens RP 75 provisions by requiring an initial audit within the first two years of implementation and additional audits in three year intervals.
  • Records and documentation: documentation required that describes all elements of the SEMS program.

Additional items which are part of SEMS II include:

  • Developing and implementing a stop work authority that creates procedures and authorizes any and all offshore industry personnel who witness an imminent risk or dangerous activity to stop work.
  • Developing and implementing an ultimate work authority that requires offshore industry operators to clearly define who has the ultimate work authority on a facility for operational safety and decision- making at any given time.
  • Requiring an employee participation plan that provides an environment that promotes participation by offshore industry employees as well as their management to eliminate or mitigate safety hazards.
  • Establishing guidelines for reporting unsafe working conditions that enable offshore industry personnel to report possible violations of safety, environmental regulations requirements, and threats of danger directly to BSEE.
  • Establishing additional requirements for conducting a job safety analysis.
  • Requiring that the team lead for an audit be independent and represent an accredited audit service provider.

It is worth noting that API RP 75 was voluntary guidance which first appeared in 1991, but does not seem to have caused much of a stir until it ceased to be voluntary and now firstly has to be put in place and must be audited by an appropriate independent body and have the audit results submitted to the BSEE by November 15 2013. All the additional items must have been addressed by June 4 2015.

Hence, just a suggestion, why not provide the installations with safety cases. Everything required by SEMS can be included in the safety case. This would be particularly useful for mobile units which can move from one jurisdiction to another.

HOW TO MAKE THE SAFETY CASE WORK

The safety case will work for any company which is committed to the process, which will be a company which actually has a safety culture, rather than saying that it has a safety culture. But in any case these simple rules should be followed:

  • Follow any of the accepted guidance for the development of a safety management system and summarise it in the case.
  • Ensure that all local regulations are addressed.
  • Be diligent in the research and description of the technical details
  • Ensure that adequate risk assessments into the prevention and  mitigation of major hazards are carried out.
  • Develop an emergency response philosophy which will actually work.
  • Make sure that any recommendations from the risk assessments are properly addressed, and actioned if appropriate.

And take responsibility for safety commensurate with your position in the organisation.

HOW TO AVOID MAKING THESE PROCESSES WORK

My reason for including the subtitle to this presentation is that in the end we safety professionals are in the hands of the operations people, the financial people and increasingly the legal people. And I or my colleagues used to go out to rigs in any area other than the UKCS they have been frequently greeted by the words ‘We don’t want that North Sea shit here’.

But now one way or another the North Sea stuff is being replaced by something, what ever part of the world you are working in. Some may think that it would be all too easy to write all the procedures, guidance and documentation to conform with the regulatory requirements but actually still carry on as one did before. This was a process often applied by companies faced with the need to implement a quality management system back in the 1990s and before, in UK. Lord Cullen, for instance, heard that the standby boats were nothing more than a token gesture. They were there, but no-one actually thought of using them.

Of course incidents and accidents are littered with instances where the management has been warned of the potential for misfortune and have done nothing, and their failure to take the appropriate action. One result of this is that the managements may try to distance themselves from everything directly related to the operation of their units. We can identify both these approaches today, and one thing both SEMS and the safety case processes should reveal is the degree of commitment of those in charge.

At the same time some believe that commitment leads to exposure. If you have provided the wrong advice, or have provided guidance which has not been followed, then the company may be taken to court and possibly people may be fined, or even in some cases imprisoned. The only sanction finally imposed on the companies involved when the AHTS Bourbon Dolphin sank with the loss of eight lives out in the Atlantic was of GBP 500,000 to Bourbon, whose handover procedures were not followed when the Captains of the ship changed over.

But how is it possible to avoid commitment? Norwegian regulations, for instance, require that the ‘Platform Manager’ receive guidance as to what to do in an emergency. I have seen a document which claimed to conform with this regulation. It said ‘ When the Platform Manager arrives in the Emergency Centre he should assess the situation and take what action he deems necessary’. And I can almost hear some people saying ‘what’s wrong with that then?’

Another way of not taking the appropriate level of responsibility is to ignore or to discount recommendations, or to accept what are obviously unrealistic procedures. Typically a Station Bill may require that mustering takes place in an area which will either not be sufficiently large for the numbers of personnel likely to be mustered, or else will be extremely uncomfortable if mustering is to last more than five minutes. This is mostly to avoid using mess rooms or recreation spaces because the catering staff like to keep them clean.

Not too long ago I was involved in the development of a safety case for a jack-up and one of the qualitative processes used was that of a ‘Compartment Study’ which involved the consultants visiting each of the rig compartments and assessing it for the potential for fire, explosion or flooding. Because it was a new rig the Main Generator Room was a wonderful space, containing only four engines and their associated generators. It was clean tidy and safe. But the associated regulations required that it contain much in the way of firefighting systems, most of them, as far as we could see, unnecessary. On the other hand there was an auxiliary machinery space which contained the daily use fuel tanks, the fuel purifiers and a host of other equipment. This space was therefore vulnerable to fire and possibly explosion, and in such an event the rig would be disabled. It was obvious to the risk assessors that it needed a fixed fire fighting system – but was the recommendation accepted? You can easily guess the answer.

And as far as safety cases are concerned we turn now to the TR or Temporary Refuge. In UK it is not possible to avoid the TR. The regulations, particularly PFEER virtually ensure that the TR will be identified and used as the primary muster area, but elsewhere even where safety cases are in place the OIM is usually given the option of where mustering should take place, with a leaning towards the evacuation stations. This allows the weekly emergency drill to take place, mustering all hands – except those in essential tasks – at the lifeboats, and causing the minimum of disruption to the operation of the unit. Evacuation is a whole subject on its own, and one where I, on behalf of my clients, have argued constantly with the HSE whose topic experts have very fixed views.

AN EXAMPLE

I look back to the Ocean Ranger lost in 1982. The Ocean Ranger Disaster.

This account is distressing to read thirty years on, but what might have been achieved had the rig been the subject of a safety case and its related risk assessments?

If a bowtie risk assessment had been used which involved the Masters and the CROs we might have become aware of the problems relating to the management of the rig and with the lack of a remote draught reading system, which had resulted in the need to read the draughts by opening the port in the column of the rig.

If the technical details had been completed in a responsible manner it is just possible that the means by which all the valves could be opened or closed would have been identified, and it would definitely have been recommended that a switch should be fitted which would isolate the ballast control board. It is possible to say this because all semi-submersible risk assessments carried out in UK recommended the installation of an isolation switch if not already fitted. This was for the very reason that the board might on occasion initiate spurious valve operations.

It is also possible that during the Compartment Study the risk assessors would have identified the port in the control room as a possible source of flooding and have suggested that the deadlight (for non mariners a plate fitted over the port to prevent the ingress of water in the event of the glass being broken) be shut as part of the preparation for adverse weather.

In addition a proper level of research into the evacuation processes might have identified the problems with the availability of helicopters, and might have ensured that a Mayday was broadcast earlier, and that the standby vessels were more suitable for the task and better equipped.

Of course these possible improvements would depend on the company acting on the recommendations. What actually happened was that the Canadian legislators proscriptively made rules for the operation of offshore installations in Canadian waters.

Whatever else, the judge who conducted the investigation into the loss of the Ocean Ranger contributed some succinct phrases which to my mind encapsulate what we should all be doing to keep our guys alive out there. These phrases are:

THE OCEAN RANGER DISASTER COULD HAVE BEEN AVOIDED BY RELATIVELY MINOR MODIFICATIONS TO THE RIG AND ITS SYSTEMS AND IT SHOULD, IN ANY EVENT, HAVE BEEN PREVENTED BY COMPETENT AND INFORMED ACTION BY THOSE ON BOARD.

And

IT IS THE ESSENCE OF GOOD DESIGN TO REDUCE THE POSSIBILITY OF HUMAN ERROR AND OF GOOD MANAGEMENT TO ENSURE THAT EMPLOYEES RECEIVE TRAINING ADEQUATE TO THEIR RESPONSIBILITIES.

 

 

 
Copyright © 2018 Ships and Oil. All Right Reserved.