Offshore Safety Management: Implementing a SEMS Program

Table of Contents

Cover image

Front Matter

Copyright

Preface

Warning—Disclaimer

Chapter 1. Offshore safety management

Chapter 2. Major events

Chapter 3. Safety and environmental management programs

Chapter 4. Safety and environmental management systems

Chapter 5. Implementing SEMS

Chapter 6. Safety cases

Chapter 7. Formal safety assessments

Chapter 8. Offshore safety developments

References

Index

Front Matter

Offshore Safety Management

Implementing a SEMS Program

Ian Sutton

AMSTERDAM • BOSTON • HEIDELBERG • LONDON • NEW YORK • OXFORD PARIS • SAN DIEGO • SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO

William Andrew is an imprint of Elsevier

Copyright

William Andrew is an imprint of Elsevier

225 Wyman Street, Waltham, MA 02451, USA

The Boulevard, Langford Lane, Kidlington, Oxford OX5 1GB, UK

First edition 2012

Copyright © 2012 Ian Sutton. Published by Elsevier Inc. All rights reserved.

No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher's permissions policies and arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions.

This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein).

Notice

Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods, professional practices, or medical treatment may become necessary.

Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information, methods, compounds, or experiments described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility.

To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use operation of any methods, products, instructions, or ideas contained in the material herein.

Library of Congress Cataloging-in-Publication Data

A catalog record for this book is available from the Library of Congress

British Library Cataloguing in Publication Data

A catalogue record for this book is available from the British Library

ISBN: 978-1-4377-3524-6

For information on all Elsevier publications visit our web site at elsevierdirect.com

Printed and bound in Great Britain

12 13 1410 9 8 7 6 5 4 3 2 1

Preface

Deepwater Horizon changed everything.

Before that April 2010 accident—in which 11 men died, record quantities of oil flowed into the ocean, and nearly $1 billion dollar's worth of investment plunged to the seabed—the safety record of the offshore oil and gas industry was good, and had been steadily improving. Which was why Deepwater Horizon was such a shock—it was so unexpected.

One of the most important consequences of the event was that the Minerals Management Service (MMS) that had had up to that time the overall responsibility for enforcing offshore safety went through a fundamental reorganization, and renamed itself the Bureau of Ocean Energy Management and Regulatory Enforcement (BOEMRE). And one of the first actions of the new agency was to issue the Safety and Environmental Management Systems (SEMS) rule.

But the impact of Deepwater Horizon goes beyond the United States—the accident caused oil companies all over the world to think through the effectiveness of their safety management programs. Moreover, events such as the Montara blowout in Australian waters in the year 2009 showed that these events are not confined to one place.

This book, Offshore Safety Management, has been written for those working in this new world—the world created by Deepwater Horizon. The book starts by describing the management of safety offshore. Topics covered include a brief history, the types of safety, risk management, and the role of regulations. The book then describes many of the major events and accidents that have occurred over the last 40 years or so, some of which occurred onshore, that led to the development of modern safety management systems and regulations.

The discussion then moves on to the Safety and Environmental Management Program (SEMP—the standard issued by the API in the early 1990s) and the newly published SEMS. These topics are front and center stage for any company operating in US waters. But they possess universal relevance. The principles and application of the elements of SEMS can be applied to any production platform or drilling rig anywhere in the world.

In Europe, Australia, and other locations around the world, companies in the offshore oil and gas business manage safety through the use of safety cases. This description is followed by a discussion of Formal Safety Assessments, which analyze technical topics such as fires, explosions, noise, and emergency escape.

This book should be read in conjunction with Process Risk and Reliability Management, published by Elsevier in 2010. That book provides much more detail regarding the implementation and management of the elements of SEMS such as operating procedures and mechanical integrity.

This book concludes with a discussion to do with likely developments in offshore safety management. The statement that Deepwater Horizon changed everything goes beyond a recognition that existing safety programs such as SEMS and safety cases need to be improved—it forces managers and professionals to consider new ways of thinking, including the need for leadership as distinct from management and an understanding of the long-tail or Black Swan events.

As always when I write, the most difficult challenge I face is knowing when to stop. When I first arrived in New York I was taught the phrase Enough is enough already. There is always a good time to stop writing—and that time is now.

I must, of course, acknowledge the support of many colleagues working in the offshore safety management business, in particular the support provided by my employer AMEC Paragon in encouraging me to write articles, attend conferences, and participate in professional society committee meetings. And, as always, my deepest thanks to my wife Val for her patience and support—particularly at those times when I was writing instead of helping around the house.

Finally, in every publication that I have written so far I have concluded the preface with the words Edmund Spenser used in the introduction to his poem Faerie Queene, ‘Goe little book: thy selfe present.’ So it is with this book—it is now in your hands gentle reader. I hope you find it useful.

Other books on the topic, seminars and further information for the Process Industries can be found on the author's website: http://www.stb07.com/bookshop/book-offshore-safety-management.html

Warning—Disclaimer

This book provides information in regard to the subject matter covered. It is distributed with the understanding that the publisher, the author, and any other advisors are not engaged in rendering legal, accounting, or other professional services. If legal or expert assistance is required the services of a competent professional should be sought.

It is not the purpose of this book to reprint all the information that is available to the author and/or publisher, but to complement, amplify, and supplement other texts. You are urged to read all the available material, learn as much as possible about the topics covered, and to tailor the information provided here to your needs. For further information and other sources, see the references provided at www.stb07.com/citations.html.

Every effort has been made to make this book as complete and as accurate as possible. However, there may be mistakes, both typographical and in content. Therefore this text should be used only as a guide and not as an ultimate source of information and guidance on the topics covered. Furthermore, information on these topics may have changed since the release date of this book.

The examples provided, which are fictional, have been created specifically for this book series. This book does not present information about any specific plant, process, company, or individual. Nor does it describe the policy of any company.

The purpose of this book is to provide information in the subject areas covered. The author and publisher of this book shall have neither liability nor responsibility to any person or entity with respect to any loss or damage caused or alleged to be caused, directly or indirectly by the information and/or guidance provided in this book.

Chapter 1. Offshore safety management

Chapter Contents

Introduction1

Value of Safety Management Systems2

Structure of this Book2

Industry Trends2

Impact of Deepwater Horizon6

Safety Management Systems7

Historical Background9

Occupational, Process, and Technical Safety12

Risk Management17

Regulations25

Rule-Making Process (United States of America)29

Regulatory Agencies (United States of America)30

BOEMRE32

PFEER Regulation (United Kingdom)38

International (SOLAS)38

Special Safety Issues Offshore39

References43

Introduction

The production of oil and gas offshore is risky. The danger of fires and explosions is always present and the toxic gas hydrogen sulfide (H2S) is a frequent byproduct of the oil and gas that is produced. Drilling rigs and platforms are generally crowded with equipment and machinery, and—if there is an accident—there are few places to which to escape. Moreover, in locations such as the North Sea, weather conditions can be harsh and unforgiving.

Thus, from its very beginning, this industry has had to pay particular attention to the safety of the workers and the prevention of catastrophic events. Generally, these efforts have been successful, particularly with regard to occupational or hard hat safety. However, as discussed in Chapter 2, major accidents do occur quite frequently, and the costs of such accidents in terms of human life, environmental damage, and economic loss can be enormous.

This book has been written to help those who design and operate offshore facilities to build and improve on the industry's good safety record, and to take actions that will help prevent and control catastrophic events. Specifically, the book shows how to develop, implement, and operate a Safety Management Systems (SMS). The primary purpose of such a system is to identify the hazards that could lead to a major event, to assess the risk associated with them, and then to implement the appropriate safeguards and corrective actions in order to ensure that such events do not actually occur, or that their consequences are minimized.

At the time of writing, new safety management regulations are being put into place in the United States as a result of the Deepwater Horizon incident (Chapter 2). Because of their topicality, these new regulations, known as the Safety and Environmental Management Systems (SEMSs), are discussed in detail in Chapter 4 and Chapter 5. Although these regulations apply only to the United States of America, the principles embodied within them are general in nature and can be applied to offshore installations worldwide. In other words, developing and implementing a SEMS is good practice, wherever a facility may be located.

Value of Safety Management Systems

Given that the development, implementation, and maintenance of Safety Management Systems are expensive and time consuming, it is important to establish that they are providing value, and that safety is improving.

The section on Industry Trends (see below) shows that, over the last 15 years or so, occupational safety trends have been very impressive. But SMSs are more concerned with the control of catastrophic events, such as those described in Chapter 2. Given that such events happen only rarely, it is difficult to develop trend lines in the same manner.

However, it is probably fair to say that most professionals in the offshore oil and gas industry accept that the management of catastrophic events has improved, but not nearly as dramatically as it has for occupational safety. The reason for this cautious response may be that an SMS program by itself is not enough—it is a necessary but not sufficient condition. To be effective, the SMS has to affect the culture of the organization, and the way people behave and act. The effectiveness of the program also depends on the leadership and decisiveness of the company management, as discussed in Chapter 8.

The conclusion that can be drawn is that, if the catastrophic events are to be controlled, an SMS provides a necessary foundation. However, it is just a foundation—it also has to be implemented and it requires forceful leadership.

Structure of this Book

This book is organized into eight chapters as listed in Table 1.1.

Industry Trends

The offshore industry has made great strides in improving safety. Figure 1.1 shows the progress that has been made in the USA (mostly the Gulf of Mexico).

The chart in Figure 1.1 was published by the US Mineral Management Service (MMS)—the government agency responsible for offshore safety regulation and enforcement. (Following the Deepwater Horizon incident, this agency was renamed the Bureau of Ocean Energy Management, Regulation, and Enforcement, or BOEMRE.) The chart provides data on the number of offshore safety incidents for the period 1996–2008. The trend is impressive: in just a 12-year period the recordable injury rate declined from 3.39 to 0.64: a drop of around 80%. The number of lost workdays dropped by a similar percentage. Moreover, the trend is quite smooth and steady, showing that the results are not a fluke or one-time event. And these advances were made as the industry has worked in ever-more challenging conditions—particularly as it has moved into very deep water operations.

The improvements shown in Figure 1.1 are not confined to the offshore industry. Similar trends are reported by onshore process facilities in the USA, as shown in Figure 1.2 (based on data from Pitblado, 2008).

The overall trend line in Figure 1.2, which is built on data from many large companies, demonstrates an order-of-magnitude improvement in occupational safety in the 12-year period covered. This is comparable to the trends shown in Figure 1.1.

Figure 1.3 shows a similar positive trend with respect to the industry's environmental record. The data, provided by the United States Coast Guard (USCG), include some land-based facilities, and also spills from inshore (State) waters. If the two bars for each of the years in Figure 1.3 are combined, it can be seen that the amount of oil spilled annually has declined from just under 6 million US gallons in the early 1980s to an almost negligible amount by the year 2005.

So, up until the year 2010, the offshore oil and gas industry was able to demonstrate a good and steadily improving safety and environmental performance.

And then came Deepwater Horizon.

Impact of Deepwater Horizon

To say that the Deepwater Horizon catastrophe was a shock to the industry would be a gross understatement. Not only was the initial impact dramatic enough—the loss of life, the destruction of the rig and the massive spill—but the event showed that systems were not in place to respond promptly to a catastrophe of this magnitude. It took 5 months before the well could be sealed. And during those 5 months dramatic scenes were broadcast around the world showing oil pouring into the ocean 1 mile under the surface. Equally-compelling footage of events onshore, such as the death of wild birds and the closure of many small businesses, added to the impression of a situation out of control. In other words, the Deepwater Horizon event had implications that went way beyond the losses associated with just one drilling rig.

Deepwater energy exploration and production, particularly at the frontiers of experience, involve risks for which neither industry nor government has been adequately prepared, but for which they can and must be prepared in the future.

National Commission (2011)

The incident's 11 fatalities and the spill of approximately 150 million US gallons of oil will require the trend lines in FIGURE 1.1 and FIGURE 1.3 to be rescaled. But catastrophic incidents such as this are often found to be not as much of an aberration as was thought at the time. They frequently reveal structural flaws in SMSs. Deepwater Horizon was no exception.

The oil industry has said the Deepwater Horizon rig catastrophe was a unique event, the result of an unprecedented series of missteps that are unlikely to be repeated. The recent history of offshore drilling suggests otherwise.

Gold (2010)

The above quotation from the Wall Street Journal cites a number of events and near-misses that occurred worldwide in a 12-month period prior to the Deepwater Horizon blowout. The frequency of such events suggests that the move to evermore-technically-challenging conditions (particularly drilling in deep water) have created problems that have not been fully overcome. Incidents that the article described included the following:

▪ In the Gulf of Mexico (GoM) there were 28 major well control spills or incidents in 2010. This number is up 4% from 2008, 56% from 2007 and over 60% from 2006.

▪ The number of serious incidents in the United Kingdom is up 31% from 2009 to 2010.

▪ The number of releases and well incidents in Norway is up 48% from 2009 (one of these—the Gullfaks C gas release—had the potential to be very serious).

Furthermore, the issues raised by Deepwater Horizon are not confined to the offshore oil and gas industry. At the time of writing, the consequences of the severe damage to the Fukushima nuclear power plants in Japan are still being ascertained. But it is clear that those consequences will be profound; substantial quantities of radioactive materials have been released, a significant fraction of Japan's power-generating capability is lost forever, and the cost of clean-up and remediation is going to be enormous. Indeed, the Fukushima accident may result in a massive slowdown in the construction of new nuclear power plants worldwide. Clearly, the offshore oil and gas industry is not the only one facing major challenges with respect to the management of safety and environmental performance.

Safety Management Systems

Many approaches to managing offshore safety are in use. Almost all of them require that an SMS is developed for each facility or group of facilities. Most of these systems, regardless of a facility's location or the legislative environment in which it operates, will be organized in a manner similar to that shown in Figure 1.4.

The six steps shown in Figure 1.4 are described briefly below, and are explained in greater detail in subsequent chapters of this book.

(1) Facility Description

The first step in the development of an SMS is to describe the facility for which the study and analysis is being conducted. Items to be considered include the following:

▪ The physical location of the facility;

▪ Its function (production, drilling or pipeline transportation);

▪ The organization that owns the facility, and which is responsible for its safe operation;

▪ The role of contractors and their relationship with the owner/operator;

▪ The connections (both physical and organizational) that the facility has with other facilities;

▪ The management of contractors and the way in which their safety programs are integrated with that of the owner/operator; and

▪ The regulatory regime in which the facility operates.

(2) Technical Information

Technical information provides the foundation for most of the analyses and studies that comprise an SMS. Such information includes Piping and Instrument Diagrams, Layout Diagrams, and Drilling Plans. Guidance to do with the development and use of Technical Information is provided in Chapter 3 and Chapter 4.

(3) Risk Assessment

Once the facility description is complete and technical information is gathered, the next step in the development of an SMS is to conduct a risk assessment. Such an assessment consists of the following five steps:

(i) Identify the hazards;

(ii) Evaluate the consequences (safety, environmental, and economic) of those hazards should they materialize;

(iii) Estimate the predicted frequency of the hazards;

(iv) Determine the effectiveness of the system safeguards; and

(v) Assess the overall level of risk.

(4) Risk Acceptance

Management has to decide if the calculated level of risk is acceptable and, if it is not, what actions need to be taken to reduce it. Some SMSs—in particular many safety cases—are built around the concept of a numerical value for As Low as Reasonable Practicable (ALARP) value. If the risk lies above/below the predetermined ALARP value then corrective actions must be taken.

Other SMSs (including SEMP and SEMS) do not discuss acceptable risk per se, nor do they provide numerical values for acceptable risk. Instead they are largely driven by the acceptable levels of risk that are implicit in industry standards from bodies such as the American Petroleum Institute (API) and the American Society of Mechanical Engineers (ASME).

For example, the following text from API's Recommended Practice for Analysis, Design, Installation, and Testing of Basic Surface Safety Systems for Offshore Production Platforms (RP 14C) states:

The safety system should provide two levels of protection to prevent or minimize the effects of an equipment failure

In this example, an expert committee has decided that two levels of protection provide an acceptable level of risk control. In effect, the determination as to what level of risk is acceptable has been transferred from the facility's engineers and managers to an expert committee that has then developed a consensus standard.

(5) Report

The next step in the development of an SMS is to report on the results of the work that has been conducted up to that point. The word report is used rather loosely here because some systems, such as the process safety management (PSM) regulation from the Occupational Safety & Health Administration (OSHA) or the SEMS rule, do not require that companies submit an actual report. Still, the management of those facilities needs internal reports to advise them on the progress that they are making.

Other management systems, in particular safety cases, frequently require that a detailed report is prepared, showing how safety was analyzed and how it is to be managed. This report is frequently submitted to the regulators.

(6) Audit

All management systems must include an audit process. In the words of one plant manager, There is always news about safety, and some of that news is bad. Audits, reviews, and gap analyses are needed to ferret out the bad news. The audit results are used as the basis for the next SMS iteration.

The development and implementation of a SMS never ends. Risk can never be low enough; improvements can always be made. Therefore, once the six steps shown in Figure 1.4 have been implemented, management will start the whole process over again—usually at the risk analysis and planning steps—in order to achieve ever-higher levels of safety and economic performance.

For facilities that are still in the design stage, the actions taken, particularly during the Risk Assessment step, will change for each iteration. For example, early evaluations of risk will use a Hazard Identification (HAZID) technique; later on, as detailed engineering information becomes available, the more comprehensive Hazard and Operability Study (HAZOP) method will be used.

Historical Background

Safety programs are developed in response to incidents—particularly catastrophic events. Some of the events that led to the development of SMSs offshore are described in Chapter 2. An overview of some of the more important regulatory and standards-setting developments (offshore and onshore) is provided here.

Offshore

The development of formal SMSs for offshore oil and gas facilities can be said to have started with the Piper Alpha catastrophe that occurred in 1988. Offshore platforms had safety programs before that time, of course, but Piper Alpha ushered in a new and much more thorough approach to system safety.

Following the accident, an investigation was conducted by a committee headed by the Scottish High Court judge, Lord Cullen. The committee's report was highly critical of the safety cases that had been in place prior to the accident.

In response to the Cullen report, the offshore industry took two different tracks, as shown in Figure 1.5. Companies operating in the North Sea (and, later on, other areas of the world such as Australia) continued with the safety case approach, as shown in the bottom track of Figure 1.5, but radically improved the thoroughness and quality of the documents, and put in place more stringent measures to ensure that the recommended measures were actually implemented.

In the USA (principally the GoM) the response to the Piper Alpha incident was equally vigorous, but followed a different path. Rather than following the safety case approach, it was recommended that companies develop a Safety and Environmental Management Program (SEMP) as described in API Recommended Practice 75. Like a safety case, an SEMP is non-prescriptive. However, it makes extensive reference to industry standards (mostly from the API), and so is perceived as being considerably more prescriptive than the safety case approach. Nor does a SEMP require that a formal assessment of acceptable risk (ALARP) be determined.

Reasons for the non-use of safety cases in the USA include the following:

▪ The GoM has 5000–6000 platforms, many of them small and in shallow water. It is simply not economically feasible to write a safety case for each platform. Arnold (2010) uses the example of the response to a proposed requirement from the MMS to carry out a Failure Modes and Effects Analysis (FMEA) on each facility. Instead of doing this, a generic response based on FMEA and HAZOP analyses of 13 representative facilities was conducted. The use of a generic study was justified because the process equipment and instrumentation function in the same manner regardless of the specific design of the facility.

▪ The multiple small platforms are generally very similar to one another. Therefore, it makes more sense to develop universal standards (typically written and published by the API) than to conduct a formal analysis for each platform.

▪ The use of API standards and related documents has proven to be successful. The Deepwater Horizon incident was the first major release in the US waters since the Santa Barbara blowout of 1969, thus indicating that the SEMP-based systems have been effective. Furthermore, the recent Montara incident (discussed in Chapter 2) occurred in an area of the world that does use safety cases.

▪ The preparation of safety cases is time-consuming and involves a large amount of paper work. It is not clear if this administrative effort truly improves safety.

▪ When all platforms are designed and operated to the same standards, it is relatively easy to audit them. The auditor simply has to read the appropriate code or rule in order to determine compliance. Such is not the case with a safety case system, where each platform has its own unique program against which it has to be evaluated.

Onshore

The development and improvements in offshore safety discussed above and shown in Figure 1.1 were matched by corresponding changes and improvements in the onshore process industries in roughly the same timeframe.

Figure 1.6 provides a simple overview as to how regulations and standards in the onshore process industries developed.

In the 1980s, a series of serious incidents occurred in chemical plants throughout the world. With over 3500 fatalities, the Bhopal catastrophe of 1984 was the worst-ever industrial event in terms of loss of human life (although that event may well have been caused