Upload
others
View
1
Download
0
Embed Size (px)
Citation preview
1
History of Operational Safety Awareness in the US Gulf of Mexico
1964 to 2014
A personal recollection by
Kenneth E. (KEN) Arnold
K Arnold Consulting, Inc.
Introduction
The operational safety of workers and the public during all aspects of offshore activities is of paramount
importance. By “operational safety” I mean safety and environmental protection aspects in the design,
construction, operation and maintenance of drilling and producing systems. The industry has always
been concerned with operational safety. After all no one wants to be killed or be the cause of a fellow
worker or employee to lose his life or be seriously injured. However, our awareness of how to act on
that concern and what is possible from the standpoint of safety has changed over the years.
It could be quite a complicated undertaking to address every change that has taken place in attitudes
and regulations over a half of a century of innovation. In 1964 the industry wondered if it was possible
to develop oil fields in 600 feet of water, we had just seen the building of the first semi-submersible
drilling rig (Bluewater I) and the first subsea wells producing to shore (Molino offshore in California), and
there were no floating production facilities as development options. Rather than attempting to write a
detailed book-length accounting of this subject this is merely a personal recollection of the main
changes as I experienced them.
The history of operational safety awareness by industry in the US Gulf of Mexico (GOM) is one of periods
of slow improvements with dramatic step changes after major accidents. I wish it were otherwise, but
in reality the industry has historically only responded with major changes in the way it designs and
operates its offshore drilling and production activities in the face of negative publicity from a few highly
visible and publicized accidents and the threat of regulations. Thus, the history of safety awareness by
industry is generally, with many specific company exceptions, a history of major accidents, the threat of
new regulations and industry’s response to these threats to assure the regulations are both practical
and efficient.
The Outer Continental Shelf Lands Act of 1953 states:
The Secretary [of the Department of Interior], the Secretary of the Department in which the
Coast Guard is operating, and the Secretary of the Army shall enforce safety and environmental
regulations promulgated pursuant to this subchapter. Each such Federal department may by
2
agreement utilize, with or without reimbursement, the services, personnel, or facilities of other
Federal departments and agencies for the enforcement of their respective regulations.
The industry’s primary safety regulator is the Department of the Interior (DOI). The agency within this
department during this period changed its name and sometimes it’s reporting relationship from the
Conservation Division of the US Geological Survey (USGS), to in 1982 the Minerals Management Service
(MMS), to in 2011 the Bureau of Safety and Environmental Enforcement (BSEE). However, no matter
the name or reporting relationship the professionals within the regulator remained essentially the same.
Although we enjoy grousing about “government bureaucrats” and “paper pushers”, the industry has
been blessed for the most part with a core professional group within the regulator who believe that
safety regulations need to reflect the best safety theories of the time but also be practical to implement,
to inspect and to enforce. As theories of what constitutes best safety practices have evolved with time,
the regulator has forced industry to adopt new ideas in design and operation while also listening to
industry’s input.
There are other regulators who have a responsibility for oversight of specific offshore industry activities.
The main ones with regard to issues of safety are:
1. US Coast Guard (USCG); Over the years there have been several Memorandums of Agreement
(MOA)and Memorandums of Understanding (MOU) between the DOI and USCG which defines
their respective areas of regulation as it pertains to safety and environmental protection.
Basically the USCG is responsible for enforcing regulations relating to the safety of life for
offshore oil and gas operations. For fixed platforms the focus is on fire fighting, emergency
lighting, escape and abandonment. For floating structures it also includes hull integrity, ballast
control, marine systems and manning, and the like.
The USCG requires annual inspections to be done by the operator of fixed platforms on the OCS.
USCG inspectors perform the initial inspection prior to start-up, but subsequently perform only
spot inspections to assure that the other inspections are being performed and documented by
the operator. USCG inspects floating facilities for compliance with USCG regulations and has the
power to withdraw a facility’s Certificate of Compliance. If violations involve potential civil
penalties, USCG refers the case to BSEE.
In 2002, MMS was authorized by USCG to perform annual oversight inspections on behalf of
USCG for USCG-regulated items on fixed platforms. BSEE inspectors carry this out using 27
program-specific Potential Incidents of Non-Compliance (PINCs). BSEE District offices provide bi-
annual reports based on inspection statistics to the USCG’s Assistant Commandant for
Operations to ensure the program of inspections receive appropriate attention at the highest
level.
In 2008, an MOA between the two agencies explained how they divided or shared responsibility
for floating offshore facilities with a detailed Responsibility Matrix. Unfortunately these shared
3
responsibilities have led to inefficiencies and confusion and have complicated and delayed
permit approvals.
2. Environmental Protection Agency (EPA): EPA and DOI entered into a MOU on October 28, 1983
and a MOA on September 12, 1989 assigning inspection responsibilities for NPDES (National
Pollutant Discharge Elimination System) compliance to MMS using a mutually developed PINC
list. If sampling inspections are carried out, they may only be conducted by EPA. The PINC list
allows MMS inspectors to issue warnings, component shut-ins, or facility shut-ins. Further
administrative actions are undertaken by EPA.
To avoid confusion, after the Oil Pollution Act of 1990, DOI, DOT, and EPA entered into a MOU
“Establishing Jurisdictional Responsibilities for Offshore Facilities.” DOI retained jurisdiction for
oil spill prevention and control, contingency planning, and response equipment inspection over
offshore facilities located seaward of the coast line with the exception of deepwater ports and
their associated pipelines.
3. Pipeline and Hazardous Materials Safety Administration (Department of Transportation): The
Department of the Interior has responsibility for offshore pipelines upstream of a point “at
which operating responsibility transfers from a producing operator to a transporting operator”,
and the Department of Transportation has responsibility downstream of this point. Under an
MOU DOI grants right of way permits for DOT pipelines and performs inspections on DOT
pipelines as an agent of DOT.
4. Bureau of Offshore Energy Management (BOEM): After the Macondo blowout in 2010 it was
decided to split MMS into two organizations. BOEM handles offshore lease sales and manages
oil and gas resource evaluations, environmental studies and assessments, leasing activities
including the review of Exploration Plans, Development and Production Plans and Development
Operations and Coordination Documents, fair market value determinations, and geological and
geophysical permitting. Since these plans have an impact on operational safety the division of
responsibilities between BSEE and BOEM introduces major inefficiencies and coordination
challenges in reviewing and approval of plans. This has a potential impact on safety and delays
the issuance of permits. This is a current problem that was created in the effort to separate
scientific and resource management (BOEM) from regulatory enforcement (BSEE). Although the
split of responsibilities appear wise from the standpoint of outsiders, it is not clear that it has
positively impacted safety.
There are other agencies involved in helicopter and marine transportation safety, permitting, data
gathering and research. Although this looks complicated to the uninitiated, for the most part it is clear
that offshore operational safety is in the hands of the DOI, which today means BSEE. The history of
operational safety awareness to a large extent becomes a history of the regulations of BSEE and its
predecessor organizations and how the industry responded to these regulations.
4
This is not to denigrate the importance of USCG involvement in hull integrity, mooring and riser safety of
floating installations, but I was only peripherally involved in these changes and will have to leave their
description to the naval architects and marine engineers.
Pre- Santa Barbara Channel (1964-1969)
Prior to the Unocal blowout and the subsequent beach pollution offshore California in the Santa Barbara
Channel in January 1969, offshore safety and potential pollution were not on the public’s radar. Rachael
Carson’s seminal book, Silent Spring, was published in 1962 and marked the beginning of public
awareness that modern industrial development if unchecked could impact the environment in ways that
was harmful to life. The first major environmental group to focus on this issue, the Environmental
Defense Fund, was only established in 1967 and the EPA wasn’t established by the Nixon administration
until 1970. The Occupational Safety and Health Administration was established in 1971.
Pre-Santa Barbara, offshore operations were regulated by the USGS who between 1958 and 1960 issued
OCS Orders 1 through 5, requiring procedures for drilling, plugging and abandoning wells, determining
well producibility, and the installation of subsurface safety devices. The orders did not specify design
criteria or detailed technical standards, and they did not have any test requirements. Companies had to
have certain equipment, but they did not have to test them to see if they worked.
Lax enforcement contributed to a lack of attention to safety. The USGS freely granted waivers from
complying with orders and did not inspect installations on a regular basis. Federal regulatory bodies
were underfunded and understaffed. In 1969, the USGS Gulf Region had only 12 people overseeing
more than 1,500 platforms.
If pre- Santa Barbara you had asked anyone in the offshore industry whether we were concerned about
safety and the environment we would of replied, “Of course! We work and live offshore; it is our lives at
stake. And we are avid fisherman and hunters; we want to protect the environment as much as
anyone.” Even though we meant it, we were not yet sensitized by the budding environmental
movement or by a true understanding of how safe our operations could become.
We accepted the fact that this was a hazardous business; that accidents will happen. We had a kind of
perverse pride in that we were taking risks. We were doing things that had never been done before and
we were providing much needed energy to the world. As in our sister industry, construction, we took
for granted that people would be hurt and even killed as we went about our business. That is just the
nature of this risky business. We had not yet heard the term, but we were proud of our “machismo” in
the face of the little bit of residual danger we felt we could not sufficiently control.
In my own experience, the walkway from the derrick barge to the jacket we were installing was always a
20 foot long 2x12. If you met someone coming the other way you grabbed each other’s shoulders and
passed around. A broken pad eye I had to inspect 90 feet in the air over McDermott’s yard in Morgan
City could only be reached by way of a crane basket and then a walk on a narrow strip of grating. Real
men (and we were all men in those days) did not show fear and get down on hands and knees. Who
5
needed walkways, handrails or safety lines? The loss of a finger or two was a mark of a driller who had
the necessary field experience “throwing a chain” to make up pipe.
In 1965 I accompanied our Division Safety Man for the annual inspection of the South Pass Block 27
facilities. The inspection consisted of me climbing over pipes to the top of the pressure vessels and
reading the tags on relief valves to verify they had been tested to the proper pressure within the past
five years. I don’t remember us checking anything else. There were no process safety sensors to check
and whatever P&IDs we had were probably out of date. It didn’t matter. We had no rules for
determining pressure specification breaks in the piping system and no shutdown sensors or systems.
Before condemning the industry, remember this was a time when cars did not have seat belts, home
fans did not have guards, motorcycle helmets were not common, and kid’s toys had swallowable parts
and sharp edges.
Downhole safety devices consisted of “storm chokes” in wells which were velocity valves set to close in
the event of a higher than normal fluid velocity. The high velocity could be caused by loss of the tree or
surface choke due to boat collision, explosion, etc. allowing the well to flow freely. Because they were
not controlled from the surface and they had to be set to allow normal surges of the well fluids, storm
chokes were not very reliable and exceptions to their installation were readily granted by the USGS.
Since the term “environmental protection” had yet to be invented and there was no permitting system
or regulations governing point source discharges, we accepted a certain amount of pollution as being
necessary for production. It was not uncommon to dump produced water from free water knockouts
directly into the Gulf without further water treating. When flying over the Gulf of Mexico in one of
Trans-Texas Airlines propeller driven Electras (after the science of fatigue analysis was far enough along
to explain why their wings kept falling off in flight) one could spot the production platforms by following
an oil slick back to the dot where it first appeared. The National Pollutant Discharge Elimination System
did not come into effect until after the Clean Water Act of 1972.
It was also easy to identify marsh fields. They each had a burn pit where produced water and slop oil
were routed for skimming and burning sending a black cloud into the air. Later on in the 1980s the
required elimination of these burn pits created a South Louisiana cottage industry installing produced
water treating equipment and cleaning up the soil underneath and around the old burn pits.
I would like to think that without the efforts of USGS, EPA and OSHA bureaucracies to challenge the
industry, we would have eventually figured out on our own how we could evolve better methods to do
more for safety and for environmental protection. But, I am not sure the industry would have come as
far as we have without the prodding of these bureaucracies.
Towards the end of the 1960s some companies were beginning to adopt new safety practices:
Some operators were starting to use surface safety sensors like high pressure and high level
sensors, shut in valves and emergency shutdown systems; however they were not widely used.
Even where the devices were installed they were not very reliable and not tested frequently.
6
Some operators were paying attention to recording lost time accidents, doctor cases, etc.
Some operators were installing produced water treating equipment and experimenting with
different designs of flotation cells.
But these were the exceptions and not the rules.
And then came Santa Barbara Channel.
Santa Barbara Channel, et al (1969)
We tend to think about the Unocal blowout in the Santa Barbara Channel as a watershed event. It
certainly was, but there was really a combination of events which all occurred at around the same time
and which together lead to a step change in regulations and in the way industry thought about the
environment and safety.
First let’s discuss the events:
1. Unocal Santa Barbara (Figure 1):
On January 28, 1969 there was a blowout on Unocal’s Platform A in the Dos Cuadras Offshore
Oil Field six miles off Santa Barbara County, California. Unocal had obtained an exemption from
the regulations from the USGS and the well had been drilled with an inadequate casing design.
When the well reached its total depth of 3,479 feet only 239 feet of conductor pipe had been
installed and the rest was open hole. In pulling the drill pipe out of the well a suction was
created (the well was “swabbed in”) and the well began to flow. The crew was able to shut-in
the well with blind rams but the pressure at the toe of the conductor pipe was sufficient to
breakdown the formation and cause a flow outside of the conductor pipe to the surface. A
proper design would have had a 300 ft. conductor and an 800 to 900 ft. surface casing.
In the first ten days before the well itself was shut-in with heavy mud and cement pumped from
the surface about 80,000 to 100,000 barrels of oil flowed to the ocean. Seeps which had been
opened up in the shallow rock continued to flow intermittently for over 12 additional months
fowling the beach and local marinas.
2. Chevron Main Pass 41 (Figure 2):
On February 10, 1970 at 3 AM a fire broke out on Chevron’s Platform C in Main Pass 41 Field. A
service representative had left the platform at 2:30 AM. The cause of the fire is unknown but
eventually flow from eight of the wells on the platform was uncontrolled and contributing to the
fire. On March 10 the second attempt to blow out the fire with explosives was successful and
on March 13 the first two wells were capped. Others were capped during the period March 14
to 31 by relief wells, by pumping into them or in one case by shooting off the wing valve or
choke and allowing the storm choke to activate. Most of the oil was consumed in the fire but
about 30,000 to 65,000 barrels of oil entered the Gulf.
7
3. Shell Bay Marchand (Figure 3):
In December, 1970 there was a blowout on a well on which workover operations were being
conducted. At the same time, a rig was drilling a well on the platform and several wells on the
platform which had previously been drilled and completed were producing. Four people were
killed and eventually 11 wells on the platform were contributing to the fire as storm chokes did
not close. Some wells bridged over and plugged themselves, some were extinguished by relief
wells, and in one case a high powered rifle was used to cause failure of a wing valve or choke
allowing the flow to increase and activate the storm choke. The last well stopped flowing after
155 days.
The initial investigation after the Santa Barbara blowout showed that the regulations for drilling were
not adequate. The USGS had granted Unocal a waiver from existing regulations to use the inadequate
casing design without properly analyzing the requests. In August, 1969 USGS issued revised Orders 1 to
5 and a new Order 6 (Completion of Oil and Gas Wells) and 7 (Pollution and Waste Disposal). Order 6
required that wellhead equipment should be rated and pressure tested for shut-in pressures and that
casing pressure between the production casing and the next string should be tested and repaired if
there is sustained pressure. Order 7 required that spills of a substantial size or spills where the size
cannot be determined be reported immediately (Unocal did not do so and USGS found out about the
spill from the press), and established that the leasee had the obligation to pay for any cleanup
operations. It is interesting that the topics in Orders 6 and 7 had not been covered by the existing
Orders 1 to 5.
Initially the industry objected to these revision and the new Orders and claimed they were too
restrictive and not necessary. We will see this seems to normally be the first reaction of our industry to
any new regulation. This is true even to some regulations we eventually came to adopt as critical to
safety in other areas of the world where there are no safety regulations. We forget we ever thought
them an unwarranted burden.
On October 30, 1970 USGS issued Order 8 (Platforms and Structures) which specified requirements for
wellheads (automatic shut-in valves), flowlines (check valves), pressure vessels (high and low pressure
and level sensors, relief valves), gas detectors, firefighting equipment, drip pans, etc. Order 9
(Pipelines), issued the same date, specified requirements for pipeline design, shut-in valves and check
valves.
Initially, when they had first been proposed, industry had objected to Orders 8 & 9. That is why they
were not promulgated in August, 1969 with the revised orders 1 to 5 and the new Orders 6 and 7. At
the time sensors and control logic were primarily pneumatic. The reliability of the available sensors and
three-way valves required to carry out the shut-down functions was questionable. Industry feared
repetitive false signals and increased hazards from installing the devices in systems which had not been
designed for them. In addition the increased hazards associated with frequent starting and stopping
8
wells and process equipment was feared to be a greater threat to safety than any increase in safety
brought about by all these new devices.
The Chevron fire and Shell blowout the very next year after Santa Barbara and the publicity of the
pollution caused by all three shocked the industry into recognizing that we seemed to have a problem.
For the first time industry within separate companies and as a unit in the Offshore Operators Committee
(OOC) started to investigate how we could increase safety. The OOC established a Technical Sub-
Committee specifically focused on improving the safety of our designs.
The experiences of all three disasters clearly showed that storm chokes were not reliable (or
dependable) enough and a better solution was needed. Various companies and service companies
started experimenting with surface controlled subsurface safety valves (SCSSVs) in lieu of storm chokes.
Schlumberger’s Oilfield Glossary defines a SCSSV as “a downhole safety valve that is operated from
surface facilities through a control line strapped to the external surface of the production tubing…The
control system operates in a fail-safe mode, with hydraulic control pressure used to hold open a ball or
flapper assembly that will close if the control pressure is lost.”
In June 1972, Order 5 was revised to require the installation of SCSSVs on all new wells and any old wells
when the tubing had to be pulled. Eventually storm chokes were phased out. Once again many in
industry felt that existing designs were not reliable and the frequency of testing and maintenance of
these “downhole ball valves” would cause production disruptions and potential safety problems.
Once we were forced to make them work, industry found a way to make the sensors and safety valves
more reliable. This is a great example of how the regulator, API, ASME and industry can come together
and deliver a great technical safety advancement and a process solution in which functional
requirements and an effective testing program are combined. The reliability of these devices has been
outstanding.
Today, we would find it unthinkable to design an offshore installation without SCSSVs or a process safety
shut-in system. Indeed, when the Iraqi’s retreated from Kuwait in 1990 and set fire to the oil wells many
of us in the offshore industry were amazed that the wells had not been equipped with SCSSVs. I
understand SCSSVs are now routinely installed in Kuwait.
Santa Barbara (1969) to Piper Alpha (1988)
In the period after Santa Barbara the focus of our safety efforts was on equipment and system design,
and on personnel safety.
1. Equipment and System Design
9
In 1972 API formed the Offshore Safety and Anti-Pollution Equipment (OSAPE) Committee to
write specifications and recommended practices for what became the 14 series of API
documents. The initial subjects covered prior to 1975 were SCSSVs (14 A&B), process safety
sensors and controls (14C), piping systems (14E), electrical systems (14F), and firefighting
systems (14G). These were all later adopted into and incorporated by reference in 30 CFR 250,
the section of the Code of Federal Regulations which replaced the OCS Orders.
The story of the development of API RP 14C is interesting. In 1971, a report was prepared by
the National Aeronautics & Space Administration (NASA) for the USGS entitled “Applicability of
NASA Contract Quality Management and Failure Mode & Effect Analysis (FMEA) Procedures to
the US OCS Oil and Lease Management Program.” As a result of this report, USGS contracted
General Electric (GE) and Southwest Research Institute (SWRI) to analyze several example
offshore platform facilities and make recommendations for a technique to assure that
appropriate safety devices are installed to sense and control process upsets. In 1972 the USGS
published in the Federal Register their intent to require an FMEA analysis for each new
installation or major modification.
Industry believed that performing a detailed FMEA on each facility would be a monumental task.
In addition, a review by the OOC Technical Subcommittee of the example FMEAs which had
been performed for the USGS showed that the results were internally inconsistent as well as
being inconsistent from platform to platform. Unfortunately, since the FMEA documentation
was so voluminous it was difficult to spot these inconsistencies without a significant amount of
effort and the USGS technical staff had missed the inconsistencies.
The OOC review pointed out a different direction to arrive at a better, more consistent and
more traceable result. It was apparent all facilities were made up of a small number of
components (wellheads, flowlines, headers, pressure vessels, pumps, compressors, etc.) which
were assembled in systems which were reasonably similar, and a shorthand FMEA system might
be possible.
API formed the 14C committee to work with the OOC Technical Subcommittee in developing
Recommended Practice 14C, “Recommended Practice for Analysis, Design, Installation, and
Testing of Basic Surface Safety Systems for Offshore Production Platforms”. The resulting
document performs an abbreviated FMEA on each of the common components on a standalone
basis to identify protective devices needed to sense and mitigate production upsets. It also
provides a method for taking into account the effects of assembling the component into a
system which might mitigate the need for certain protection devices. Documenting and
presenting the analysis in a proscribed matrix provides a simple way for a regulator or reviewer
to quickly determine if the analysis was performed correctly. API RP 14C was adopted by USGS
and later updated and turned into an ISO standard.
10
All of the API OSAPE committees included at least one USGS technical staff member. This
helped keep the committees work focused on the objectives of USGS and made it easier for the
USGS to accept the work and incorporate it into the CFR standards. The incidents of 1969 and
1970 had placed both the industry and its regulator under tremendous pressure. By working
together in a very short period of time between 1971 and 1975 tremendous improvements
were made in equipment and system design, installation and testing.
In the following fifteen years until about 1990 the focus of both industry and the regulator on
equipment specification and design did not substantially change. Minor changes to the OSAPE
documents were periodically made but no emerging new safety concepts were incorporated in
the regulations. For the most part our collective attitude was if we just followed the regulations
for design and testing of equipment and systems, and paid attention to personnel safety (see
below) we would be safe. The one exception might be the beginning of the use of HAZOPs by a
few large operators.
In 1974 there was an explosion in a chemical plant in the UK (Flixborough) which would
eventually lead to the development of a hazard analysis technique called HAZOP for Hazard and
Operability study. Over time the concept of performing design HAZOPs became popular in the
downstream industry. I first heard of it being used in the offshore industry after DuPont had
purchased Conoco in 1981 and introduced many of its chemical plant safety practices into
Conoco’s upstream operations. By the mid-1980s several large offshore operators had
determined, without any push from the regulator, to perform HAZOPs on their major offshore
designs to check that the designs were actually in accordance with the OSAPE documents and
perhaps uncover and mitigate potential problems which were outside the scope of the OSAPE
documents. Performing HAZOPs was not a requirement of the MMS, who in 1982 became the
regulator, and so they were not yet widely carried out in the Gulf of Mexico.
2. Personnel Safety
“Personnel safety” concepts focus on protecting the safety, health and welfare of individual
workers. The potential workplace risks associated with personnel safety include those relating
to walking and working surfaces, dropped objects, occupational noise exposure, hazardous
materials handling, and lack of use or misuse of tools and personal protective equipment.
If you look at pictures of onshore construction activities from the dark ages prior to 1964 you
will often see workers without a hard hat or other personal protection equipment (PPE). It is
not that we didn’t know about hard hats, etc. It is just that, like seat belts in cars, their use was
not enforced and thus they were often not used. I worked on a summer construction job in
1962. US Steel took a picture of us installing a new type of bell and spigot pipe in a river
crossing. They drew hardhats on us before publishing the picture in their catalogue. None of us
on that job owned a hard hat but US Steel figured we should have been wearing hard hats.
11
In 1971 OSHA came into being which focused the attention of all industries on the need for a
concentrated focus on personnel safety. USCG and not OSHA has jurisdiction for personnel
safety offshore. However, the attention paid by other industries to personnel safety under
OSHA rules was certainly felt in offshore operations.
Throughout this period operators and contractors paid ever increasing attention to personnel
safety. Operators and contractors began to track OSHA reporting statistics and it became a
common belief that safety was defined by Heinrich’s 1931 Theory of Accident Prevention (Figure
4). That is, in a workplace, for every accident that causes a major injury, there are many more
that cause minor injuries and since many accidents share common root causes, addressing more
commonplace accidents that cause no injuries can prevent accidents that cause injuries. Thus,
reducing the frequency of first aid cases will reduce the frequency of doctor cases, which will
reduce the frequency of lost time incidents which will reduce the frequency of deaths.
According to the International Association of Drilling Contractors the worldwide lost time
incident rate fell by over 70% from 1969 to 1988.
From a safety standpoint this period can be considered to be approximately 15 years where the focus
was on compliance with equipment specification, design and testing regulations as well as a focus on
personnel safety. Although the regulations went through minor modifications and updates the only real
change in safety awareness was a greater attention on what safety specialists call “slips, trips and falls”.
That is reducing personnel safety incidents. Overall personnel safety incidents fell dramatically during
this period. When the companies paid visible attention to these indices, the staff noticed and they
learned to act differently.
On the other hand, the incidence of major accidents like fatalities, loss of well control, fires/explosions,
and spills>50 Barrels fell off initially as the industry learned how to be compliant with the regulations,
but did not decline after that initial period even as personnel safety indices continued to drop.
The publication of OCS Order 8 in 1970 also provided the first environmental limit on oil and grease in
produced water discharge. An average of four samples within a 24 hour period during a month could
not exceed 50 ppm and no discharge during the month could exceed 100 ppm. It is an unexplainable
bureaucratic mystery why this requirement was in Order 8,”Platforms and Structures”, and not in Order
7, “Pollution and Waste Disposal”. But such are the ways of Government.
OOC had funded a data collection project to determine the effluent quality of well-designed and
operated water treating systems and based on statistical analysis USGS and OOC had agreed on these
numbers. EPA had just been established and given jurisdiction over discharges on the OCS that year and
had not yet done its own analysis of the data.
In 1974 OOC did a study of the 38 platforms in the Gulf which had gas flotation units for produced water
treating (this was assumed to be best available technology). After eliminating the highest 10% all data
points and all platforms which then averaged over 100mg/l, the survey only included 19 platforms and
12
1,218 data points. From this they recommended the maximum discharge limit be maintained at 100
mg/l which represented the 98th percentile of the data. Even at this level 21.5% of the 19 platforms
which presumably had the best available technology would fail one month out of the year.
The first EPA effluent guidelines for produced water were issued in 1975. Due to their re-analysis of the
OOC generated data plus some additional data, they mandated an average for a month to not exceed 48
mg/l (roughly the same as 48 ppm) with a maximum during the month not to exceed 72 mg/l in any one
day during the month. The industry argued that the EPA had misinterpreted the data to come up with
the 72 mg/l maximum and the new limit would cause disruption of production. The new regulation was
promulgated and counter to industry predictions did not force shut-down of any production. I suspect
this was mostly because the rules allowed us to sample the produced water with a different technique
than that required by EPA to make sure the equipment was working properly prior to taking the
“official” EPA samples.
The EPA had to balance on a tight rope between environmental groups who would sue if the limits were
set higher than they thought they should be and the industry who would sue if the limits were set too
low without adequate justification. Over the years there have been enough law suits on this one
regulation to send many lawyers’ children to college.
In 1993 EPA further reduced the requirements for new sources to an average of less than 29 mg/l for
the month and less than 42 mg/l for any one day. This was a substantial change and was the result of a
long drawn out legal process where the industry argued the EPA statistical analysis to establish Best
Available Technology Economically Achievable (BAT) upon which this standard was based was flawed.
The EPA was challenging industry to meet criteria which, based on several OOC studies of existing
facilities, showed that even platforms with BAT installed would fail to meet about 5% of the time.
Once again, we fought the new regulation and predicted doom. On behalf of the OOC I coauthored a
paper with a statistician professor from the University of Houston to show the devastating effect his
new regulation would have on production. After the regulation was passed we adjusted our operations
and were able to meet it without a serious effect on production.
Today several of the major oil companies in the industry that in the past fought hard to maintain the 48
mg/l average; 72 mg/l maximum limits are on their own designing produced water treating facilities to
meet 15 mg/l under the self-motivated banner of “sustainability”.
Our change in produced water treating certainly shows a change in “environmental awareness”.
However, perhaps as an old curmudgeon and someone who knows the 15 mg/l specification means
adding another stage of equipment to operate and maintain, I am not sure this is a good thing. We lived
with the29/42 limit for 20 years and no one has shown any harm to the environment. There are natural
oil seeps in the Gulf of Mexico (and most places where oil and gas are found) which discharge about 1
million barrels per year into the Gulf. Assuming 29 mg/l of oil and grease in produced water discharges,
this represents about 15,000 barrels of oil per year or 0.04% of the oil and grease discharged into the
Gulf by the Mississippi River and a tiny fraction of that discharged into the Gulf through natural seeps.
13
Yes, we have come a long way from accepting discharges direct from Free Water Knockouts without any
further treatment, but are we crazy?
OXY Piper Alpha (1988- Figure 5)
On July 6, 1988 at 10 PM an explosion occurred on Oxy’s Platform Alpha in the UK North Sea. By 11 PM
167 people died.
During the day shift, a relief valve on the discharge of condensate pump “A” had been removed for its
annual safety inspection. The pump was vibrating and taken out of service for maintenance. No work
had been performed on the pump. During the night shift, condensate pump “B” tripped off line and
could not be restarted. Due to failures in the permit to work and lockout-tagout procedures, the night
crew was unaware the relief valve had been removed. It was located in the compressor module which
was in a separate module above the pump. When they opened the suction valve on pump “A” 700 psi
condensate was routed directly to the compressor module. There was an explosion which blew out the
walls separating modules and started a fire in the oil process module. Twenty minutes later falling
debris caused a gas pipeline which crossed Piper from Tartan to part and a fire ball to engulf the entire
platform.
This tragedy shocked the whole industry. We had not conceived it possible that we could lose so many
people due to a process accident. In the UK Piper Alpha led to a major overhaul of the regulatory
process and the implementation of the Safety Case regime. In the US the MMS asked the Marine Board
of the National Research Council to look at alternatives to inspecting safety and MMS began to
contemplate the implementation of Process Safety Management (PSM) requirements to offshore
operations.
1. Marine Board Report (1990)
In 1990 the Marine Board issued its report “Inspection Alternatives for Outer Continental Shelf
Operations”. This report pointed out that both industry and the MMS had been concentrating
their efforts on compliance to the regulations which focused on equipment and safety systems.
Industry was developing an “attitude of compliance”. As long as they were in compliance with
the regulations and passed an MMS inspection they were by definition safe. Yet the accident
history showed that the causes of deaths, fires and explosions, and spills had nothing to do with
failure of safety systems to operate as designed or failure to have the proper equipment in
place. The “majority of accident events occurring on the OCS in a representative year (1982)
were related to operational and maintenance procedures or human error that are not
addressed directly by the hardware-oriented PINC list”. The PINC list is a list of Potential
Incident of Non-Compliance which was used by MMS inspectors (and still used by BSEE
inspectors) to test compliance to a specific regulation.
14
The report concluded the MMS should “place its primary emphasis on detection of potential
accident-producing situations—particularly those involving human factors, operational
procedures, and modifications of equipment and facilities.”
2. Process Safety Management
OSHA published in 1990 an intent to establish a proposed standard, “Process Safety
Management of Highly Hazardous Chemicals” (PSM), as a result of accidents in chemical process
plants and refineries including the 1984 Bhopal, India, incident resulting in more than 2,000
deaths and the 1989 Phillips Petroleum Company, Pasadena, TX, incident resulting in 23 deaths
and 132 injuries, A final rule was published in 1992. OSHA has no jurisdiction offshore in OCS
waters, but the MMS indicated in the Federal Register a desire to adopt PSM for offshore.
After OSHA adopted PSM, API then Published Recommended Practice 750 which defined the
elements required for refineries to meet the intent of PSM. In 1993 API RP 75 “Safety and
Environmental Management Programs on the Outer Continental Shelf (OCS) Operations and
Facilities” (SEMP) was published in the hope that we could convince MMS to adopt it rather
than a version of OSHA’s PSM with no offshore input. MMS had participated with two of their
technical experts on the API committee and there was every indication they would incorporate
the RP in the regulations.
SEMP was really a step change in the way we looked at safety. It basically said safety had to be
managed in much the same way that we manage any other part of our business by applying the
management principles of Planning (Leadership Commitment, Employee Participation, Process
Safety Information, Process Hazards Analysis, Pre-Startup Safety Review, and Emergency
Planning and Response), Organizing (Operating Procedures, Safe Work Practices, and Training),
Implementing (Contractor Safety, Mechanical Integrity, and Management of Change), and
Evaluating (Incident Investigation, Compliance Audits, and Records and Documentation).
A Companion document to SEMP was also created by API in 1993; “RP 14J Recommended
Practice for Design and Hazards Analysis for Offshore Production Facilities”. This was referenced
in SEMP as a guideline for addressing the specifics of the Hazards Analysis element and the
proper use of HAZOPs.
To its credit, OOC and API embraced SEMP and encouraged its members to implement it even
before a final rule was promulgated. OOC and API working with MMS put on workshops to train
operators as to the meaning of the various elements of SEMP and help in sharing experiences in
implementation.
It is an interesting side note about the state of safety awareness in the industry in 1993 that the title
specifically mentioned “OCS Operations and Facilities”. The implication is that SEMP only applies to US
operations where the term “OCS” applies. As a committee member I specifically remember when my
15
motion to change “Outer Continental Slope (OCS) Operations and Facilities” in the title to “Offshore
Operations and Facilities” was voted down as “we don’t want to be forced to live with this in other
locations.” That is, in 1993 the state of our safety awareness as an industry was, “We will adopt SEMP if
we have to, but we are not sure it is worthwhile”. In later revisions, as the industry’s increased
attention to safety issues and knowledge of safety theory deepened, the title of RP 75 was changed to
“Safety and Environmental Programs for Offshore Operations and Facilities”.
Another interesting note: The Piper Alpha accident occurred because a relief valve had been removed
for a safety test and the permit to work and lockout-tagout systems did not work as written. In the Gulf
of Mexico it is normally the practice to test relief valves in-place using either a pilot operated valve and
testing just the pilot or by installing a lock open valve underneath the relief valve and a test port so the
relief valve setting can be tested by applying an artificially high pressure. If the relief valve passes the
test, it is left in place and not removed. In the North Sea the same oil companies which test relief valves
in-place in the Gulf of Mexico still remove relief valves for an annual bench test as was done on Piper
Alpha.
There is no doubt that from the standpoint of the relief valve alone a bench test is more accurate and
allows the valve to be cleaned and maintained. It is also no doubt that the act of removing a relief valve
for a bench test introduces the possibility of a Piper Alpha incident and increases the risks of dropped
object and personal injury from handling heavy objects.
It has always puzzled me that in the 20 years after Piper Alpha, industry has not figured out, balancing all
the risks, which is the best way to test a relief valve and that companies which do it one way in the
North Sea are perfectly comfortable doing it another way in the Gulf of Mexico. Maybe the lack of any
quantified risk analysis study of the two alternatives says something about industry’s faith in quantified
risk analysis in safety matters where the data is sparse. Perhaps after performing hundreds of Safety
Cases in the North Sea which do not address this issue, it also says something about our awareness of
potentially critical safety issues and the usefulness of Safety Cases in uncovering potential problems.
Piper Alpha (1988) to Macondo (2010)
In the twenty years between Piper Alpha and Macondo some oil companies had taken to heart the
recommendations in the Marine Board Report and SEMP, and had improved their understanding of how
best to manage safety and address human factors, operational and work procedures, management of
change, hazards analysis, etc. They had adopted advance incident reporting and root cause analysis
techniques, behavioral safety systems and increased training for operating personnel.
I wish I could say the same for industry in general; but I can’t. Just as industry was getting ready to
embrace SEMP, and MMS was starting to promulgate a rule based on SEMP and RP 14J, a Congressional
election based on the Republican “Contract with America” changed the political environment towards
regulation. At the same time that some smaller operators were lobbying with their Congressmen
against making SEMP a requirement, the MMS Regions were opposing the adoption of SEMP. The
Regions had a prescribe, approve and inspect culture and did not approve of a goal setting,
management system approach which they would find hard to inspect.
16
The MMS Head Office was forced to take the politically correct position that since SEMP was good for
the oil companies and they had shown a willingness to operate by its precepts there was no need to
make it a rule. The MMS encouraged the industry to adopt SEMP on a voluntary basis and for a few
years had the industry self-report their percent complete in its adoption. Most companies reported
they had adopted certain elements, were in the process of adopting others and were considering
adopting the rest.
Over time participation by industry in the MMS self-reports declined, and many companies forgot SEMP
existed or just paid it lip service. They may have had some written procedures but they made no effort
to assure they were followed. We were back to the “compliance mentality” identified by the Marine
Board, and the MMS knew it but could do nothing about it.
Industry continued its concentration on the Heinrich Triangle and personnel safety. As shown in Figure
6 the loss time incident rate and other measures of personnel safety kept improving. Industry
congratulated itself that it was doing the right thing and safety awards and bonuses were distributed to
one and all based on these measures.
This was a good thing but it did not tell the whole story. Figure 7 shows that the Heinrich Triangle did
not necessarily apply to the low frequency, high consequence incidents the industry was experiencing.
Although there are improvements in personnel protection indices throughout the time frame it is
difficult to see a trend in the incidents listed in Figure 7.
In 2006 MMS started the process of promulgating a slightly revised version of SEMP called “Safety and
Environmental Management Systems” (SEMS) as a regulation. The OOC objected on the grounds that it
was not needed. They contended industry understood the need for safety management systems and a
regulation would just duplicate efforts and create a paperwork burden for no increase in safety. This
was perhaps true for the companies represented on the OOC Safety Committee, but perhaps not true
for many of the other operators in the Gulf of Mexico.
In 2009, as a response to industry’s objections and after a thorough review of what was causing
accidents, MMS then proposed that the new rule would only contain four elements of SEMP/SEMS
(Hazard Analysis, Management of Change, Operating Procedures and Mechanical Integrity). The OOC
took the position that a SEMP regulation was still not needed, especially if the MMS’ focus would be on
documentation, but if SEMP were to be implemented it should be implemented as a whole as the
elements support each other.
The MMS than proceeded to document a rule to implement SEMS in its entirety and had prepared a
draft Federal Register announcement which was almost completed and ready for publication. But then
came April 20, 2010.
BP Macondo (April 20, 2010- Figure 8)
At approximately 10 PM on April 20, 2010 a blowout occurred on the Transocean Deepwater Horizon
rig. It was in the process of temporarily abandoning the Macondo well for BP in Mississippi Canyon 252
17
in 5100 ft. of water. The ensuing explosion and fire led to the loss of 11 lives, the sinking of the rig and
the worst oil spill in US history. Approximately 4 million barrels of oil flowed from the well during a
period of 87 days until the well was finally capped on July 15. The flow from the well was estimated to
exceed over 50,000 barrels per day at various times. 115 people who were on the rig at the time of the
blowout were saved.
Production casing had been set and cemented. The negative pressure test clearly showed that the
cement job was not adequate but the results had been misinterpreted by the crew. The first indications
that the well was flowing were available 50 minutes before the blowout but were overlooked or
ignored. The blind shear rams on the BOP were activated after the explosion but did not totally close.
As was the case with Piper Alpha, no one in industry, not the oil companies nor the MMS, anticipated
that an accident of this magnitude could occur. All previous thinking had been around a maximum
worst case discharge of 10,000 barrels a day. Over 50,000 wells had been drilled by industry in the US
OCS of which 4,000 were in over 1,000 feet of water using subsea blowout preventers. The last major
blowout resulting in oil coming ashore was Santa Barbara in 1969. From 1971 through 2009, a total of
1,784 barrels was spilled as a result of loss of well control and there were no incidents where a BOP
failed to stop flow.
Just as with Piper Alpha, this was a very rare event which no one thought could ever happen but which
had very high consequences and which indeed happened. The industry and regulator had focused on
personnel protection (injury) metrics and believed in the Heinrich Triangle. We had convinced ourselves
we were doing what needed to be done. But clearly there was more that could be done.
There were mistakes made in the planning and implementation of the abandonment operation in the
days prior to the accident and there were mistakes made on the rig the day of the accident. The
question remains, “How could people who were trained to do their jobs, told to be safe, and had no
intention of risking their lives, make such mistakes?” The answers reside with understanding human
factors, process safety management concepts and developing an organizational culture of safety.
On April 30, only 10 days after the accident, while the well was still flowing and the causes were under
investigation and not entirely clear, the President charged the Secretary of the Department of Interior to
give him a 30-day interim report of actions that could be taken to improve safety. The Secretary asked
IADC and API to put together a Joint Industry Task Force (JITF) to make recommendations, and asked the
National Academy of Engineering to put together a group of experts to peer review the report. The
report dated May 27 contained many of the recommendations of the JITF. Many of these have
subsequently been adopted as regulations. Unfortunately it also included a 6-month moratorium on
new permits and a stop to drilling for 6-months on the 33 wells currently being drilled. The moratorium
had not been recommended by the JITF nor agreed to by the peer reviewers and this caused some
controversy.
The point I wish to make here is that in a matter of weeks the industry could put together a JITF which
came up with numerous technical and operational recommendations as well as some potential changes
in regulations which can make drilling safer. Perhaps it is our failure of imagination that we need an
18
example of an accident to jolt us into thinking about improvements that can be made and should be
made globally in our operations.
The recommendations address well-control and well abandonment operations; specific requirements
for devices, such as blowout preventers and their testing; industry practices; worker training; inspection
protocols; and subsea containment systems. To its credit the JITF also focused on the need to address
safety management systems by adopting the IADC safety case guidelines for drilling rigs, SEMP systems
for operators and bridging documents to tie the two together.
In October, 2010 the DOI finally promulgated Safety and Environmental Management Systems (SEMS)
as 30 CFR 250 Subpart S. This document, whose issuance was actually delayed by the Macondo
blowout, is based on and refers to API RP 75 (SEMP). To DOI, SEMS was meant to be a performance-
based regulatory approach which aimed to promote a culture of safety by requiring all operators of rigs
and platforms to develop operational, safety, and environmental management plans. It is a departure
from historic MMS prescriptive regulations.
It has become clear to many in the industry that the key to reducing the likelihood of very low frequency
very high consequence incidents is by assuring a culture of safety throughout our operations. Managing
safety through a SEMS system is a necessary but not sufficient condition for ensuring a culture of safety.
For a culture of safety to exist from an organizational perspective there must be: mechanisms
establishing structure and control and actions establishing safety norms. From an individual perspective
there must be mechanisms establishing competency and actions establishing motivation.
SEMS establishes the mechanisms but it requires leadership on the part of every supervisory level of the
organization to supply the necessary actions to firmly establish the norms and motivations.
Many in industry have adopted this new view of moving from a compliance attitude to prescriptive
regulations and a focus on personnel safety, to the more expansive view of maintaining compliance and
personnel safety but also assuring the mechanisms and actions are in place to develop a culture of
safety which will create the appropriate safety norms and behaviors.
The Center of Offshore Safety has been established by industry. It has developed protocols for auditing
SEMS, a process for certifying SEMS auditors, and guidelines for supervisors and executives for
demonstrating appropriate actions in field visits. It is a clearing house for sharing information on
establishing and maintaining a culture of safety amongst its members.
Unfortunately not all operators are members. In the beginning only deepwater operators could join but
as of April, 2014, membership was opened to all operators as well as contractors. Membership means
dues and only a small number of the 70 to 120 operators (depending on how you count) are members.
Perhaps it would be better if BSEE made membership in a modified COS organization compulsory. COS
could be re-organized to split entirely from API, which is perceived to be heavily influenced by a few
majors, have a higher participation by small and medium size companies on the Board, and charge dues
apportioned by production to make it affordable by all.
19
Another effort by industry to help foster an improved safety culture was undertaken by the Society of
Petroleum Engineers. SPE has published a Technical Report giving guidelines for addressing “Human
Factors, Process Safety and Culture” and has established a Human Factors Technical Section to further
understanding in this area. SPE now holds conferences and workshops worldwide to promote new
concepts in safety and environmental management.
BSEE has established the Offshore Energy Safety Institute (OESI) to provide a forum for dialogue, shared
learning and cooperative research among academia, government, industry and other non-government
organizations. The Institute is a partnership of Texas A&M, University of Texas and University of
Houston. Unfortunately, the focus seems to be on providing recommendations and technical assistance
to BSEE related to best available and safest technologies (BAST) in developing and maintaining and
testing equipment. This once again puts the focus on equipment design, maintenance and testing. OESI
does have a mandate to train Federal employees to enable them to remain current in state-of-the-art
technology. I hope this component of OESI’s charge will include safety and regulatory theory, helping
the government evaluate the effectiveness of SEMS and promoting safety culture. I can dream, can’t I?
The Post Macondo World
We have come a long way since the days of missing fingers and being able to see produced water
discharges from commercial planes flying over the Gulf of Mexico. We have progressed to recognizing
the importance of the need for appropriate standards for equipment and system design, the importance
of paying attention to personnel safety, the need to manage safety using the same principles of
planning, organizing, Implementing and evaluating that we use for managing any other activity, and
finally to the current efforts to incorporate the science of human factors and developing a culture of
safety into operations.
From 1991 to 2009 we averaged 6.5 deaths and 4.8 incidents of loss of well control per year in the Gulf
of Mexico. Macondo occurred in 2010. In the years 2011 to 2013 we averaged 3.3 deaths and 5.0
incidents of loss of well control per year. It is still too early to tell if these numbers mean we have
learned lessons and things are better or if they show there has been no significant change in safety.
I think we are safer, but there are things I worry about:
1. Compliance Attitudes
There are 120 separate operator entities in the Gulf of Mexico, although since some are related
companies the true number may be around 70 independent entities. Many of the larger
operators and the leading smaller operators have gotten the message that safety is more than
compliance to regulations and passing a government inspection. But I think I see evidence that
the industry as a whole and BSEE as a regulator are still exhibiting signs of a compliance
mentality.
SEMS should be a performance specification. It outlines the elements that should be addressed
but it is not intended to be read as to how to specifically perform these elements. The specifics
20
should depend on the organization or organizations performing the work, the work being
performed, and the installation. The goal is not in the documentation but in the thought
process that goes into the task at hand.
Unfortunately, the first thing BSEE did was establish a PINC list of specific items that must be
addressed in the documentation of each element. The PINC list looks a lot like a checklist of
forms and paperwork that must be in place. BSEE later withdrew the PINC list but the damage
to SEMS thinking by both BSEE and industry had been done.
You can’t blame BSEE alone. As soon as the requirements were announced in the Federal
Register, BSEE was barraged by questions as to how to interpret each word and exactly what
constitutes acceptance in BSEE’s opinion. That is, both BSEE and most of the industry became
focused on SEMS as a regulation which specifies paperwork to be filled out and filed in order to
pass an inspection, and not items to be considered in planning, organizing, implementing and
evaluating activities to assure safety of operations.
Many operators had outside parties provide them with complete SEMS programs based on a
standard template and set of forms. Forms are filled out quickly with little or no discussion or
input from operating staff. For example, I have seen inadequate P&IDs, hazards analysis filled
out without any real discussion, and operating instructions which were not well thought out and
verified to fit actual conditions. There is nothing wrong with using templates and “go-bys” to
keep from re-inventing things. However, the real goal is to have staff at all levels engaged in
thinking through what is important for a specific installation and to buy-in to the intent of SEMS.
That is a first step in changing behaviors.
Until BSEE changes its compliance mentality at the Regional and District level, I don’t think
industry will be able to change. At MMS’ request the Marine Board of the National Academies
(which had become a branch of the Transportation Safety Board since issuing its 1990 report on
Inspection Alternatives) issued TRB Report 309, “Evaluating the Effectiveness of Offshore Safety
and Environmental Management Systems”. The 2012 report makes recommendations for a
holistic approach that could be utilized by BSEE in inspection and auditing to work cooperatively
with industry to improve the culture of safety. (I was chair of the committee that wrote the
report so perhaps I am biased.)
2. SEMS Audits
A proper audit of any safety management system should find areas that need improvement.
When it comes to safety there is always room for improvement. The goal of the audit is not to
find a perfect system. They never exist. People are human and over time things slip. Indeed a
SEMS audit that doesn’t find something is probably not a good audit. For this reason a SEMS
system never wholly passes or fails.
21
BSEE requires operators to perform third party audits and to submit audit results to BSEE. The
first round has been submitted and I have been told the quality of the audits varies greatly. This
is another indication that some operators view the audits through a compliance mentality
mode. Instead of caring to find out if the intent of their SEMS program is actually working in the
way people perform their work, they see the audit as a document which must be processed and
submitted to BSEE.
This should be a concern to industry. BSEE should be working with industry to help improve
SEMS systems for those operators where improvement is needed. A little regulatory and peer
pressure would go a long way. There must be lessons learned from these audits that could
benefit all. I can see a great benefit in BSEE working cooperatively with a re-structured COS in
this regard, but first we have to stop focusing on punishing the bad guys.
3. Punish the Bad Guys Mentality
In the US we have a mentality that all will be good if we could just locate the bad guys and
punish them with INCs and penalties. Of course punishing those who willfully violate
regulations and best practices is important. But does anyone really think that people who made
mistakes leading up to the Macondo blowout really stopped to think that they were risking their
own lives as well as those of their co-workers? Does punishing someone for a paper work
failure really make him see the importance of managing safety or just the importance of
managing paper? Does punishment alone really change behavior?
Punishment gets people’s attention but so do accidents. No amount of punishment at this point
is necessary for anyone in this industry to better understand the cost of Macondo to BP and its
contractors. No amount of punishment will create a more thoughtful job safety analysis from
someone who doesn’t see the benefit of a thorough job safety analysis.
BSEE and the industry working together need to improve the way safety is managed in actuality
rather than just the way it is documented to avoid punishment. It is a shame that the Offshore
Energy Safety Institute seems to be focused on BAST for equipment rather than the much
harder problem of what can industry and BSEE do, working together, to change behaviors.
4. Safety Culture
Many in industry have come to realize the benefits of developing and maintaining a safety
culture within their organization. This is perhaps not true for industry in general.
I think we are still a long way from having everyone at all levels of every offshore operator and
contractor organization understand that it is their actions, and not just their pronouncements,
HSE organizations and safety programs which determine if their organization will exhibit the
traits of a highly reliable organization. These traits (which include: Leadership communication,
22
Problem identification and resolution, Acceptance of personal accountability, Planning and
control of work processes, Continuous learning, and Freedom to raise concerns) characterize
organizations with good safety cultures.
Leaders at every level of supervision from the CEO to the gang pusher have to buy-in to the
safety management system, take action to enforce the concepts as real, and perform good
audits to see where improvements should be made in how the system is translated into actions
in the work being done.
5. Imagining the Impossible
No one before Piper Alpha thought such an accident was possible in a producing operation. No
one before Macondo thought that such loss of life and pollution was possible in a temporary
abandonment operation. The next unimaginable accident will probably not mirror either Piper
Alpha or Macondo. We are good at battling the last war. In hindsight we always see there were
clues we overlooked which indicated where the problem would arise. If not, we would never
have come up with the recommendations in the 30-Day report after Macondo as quickly as we
did.
I don’t know how to see those clues today. My personal worry is that a deepwater riser will part
prior to the boarding valve on a floating platform. These risers can contain production from one
or more wells which could cause quite an explosion or fire. A subsea valve, miles away where
the riser hits the sea floor, may not help because of the inventory between the valve and the
platform. A heavy valve suspended in a riser causes a stress concentration which can lead to
fatigue failure. Perhaps we should be working on a kind of Surface Controlled Riser Safety Valve
(SCRSV) which would fit inside the riser, be easily tested and repaired, and which will not cause
stress rises due to weight and stiffness in a steel catenary riser.
Maybe this is a stupid idea or impossible to do. I don’t know. I wish we had a forum to look for
these stupid ideas and respond to them before the next disaster occurs and we figure out we
knew how to avoid it all along.
6. Training the Next Generation
In the previous ten years before 1964 when I started my career, the oil industry had hired very
few engineers. This was great for me. I had to learn fast and my employer had to give me
responsibilities perhaps even before I was really qualified for them. The industry survived my
class and the following classes because in those days there were only about a dozen operators in
the Gulf of Mexico and almost all had training programs.
There are two types of knowledge:
23
Explicit Knowledge: Facts which can be codified, written down, and easily shared, and
Tacit Knowledge: Understandings based on experience which are difficult to capture,
codify and share
I was given a one year training program of multiple assignments at several field locations and
amongst various engineering groups, and went through three months of classroom training
before I was allowed to do engineering work under the direct supervision of a mentor.
I am afraid that today we are not doing as good a job at preparing new engineering staff as well
as we did in the past. In the oil companies formal training programs have been cut back as have
been opportunities for field trips and field assignments. The oilfield service companies do
better.
In the past engineering companies in the projects, construction and facilities area of specialty
relied on construction company and oil company trained engineers for their technical backbone
of key staff. Others got to spend lots of time at fabrication yards and offshore during
installations. This is now harder to do as there is less construction of major offshore projects
being done locally, and oil companies are reluctant to allow young engineering company
personnel to spend time offshore.
In the past we relied maybe too heavily on the tacit knowledge of engineering company key
staff. Now we are forced more and more to rely on policies, procedures and stage gates to
assure safety of design. I worry that in the long run this may have a negative impact on both the
safety and the efficiency of our offshore designs.
I need to point out it is not all bad. The level of education and technical knowledge of our
operating staffs has been increasing all through the past 50 years. I had an occasion early in my
career where the foreman in charge of starting up a project I had designed could not read the
startup procedure I had prepared for him. I doubt that would happen today.
Conclusion
The history of safety awareness in the past 50 years is actually a good story. Yes, we have tended to
make step changes in safety only after disasters or threats of regulations. Our record is spotty and at
times as an industry we fought change that we now know we should not have done. But we have made
tremendous changes in safety while at the same time have taken on ever more difficult and risky
operations to provide the world with the energy it needs.
Within the industry there was never a time when we lacked leadership to push safety awareness to
higher levels. We have made mistakes, but we have learned how to be better along the way. We have
had regulators who are dedicated to the task and have helped us achieve results. They have not been
perfect, but neither have we. This is a fraternity I am honored and proud to be among.
24
Figure 1: Unocal Santa Barbara Blowout, 1969
25
Figure 2: Chevron Main Pass 41 Fire, 1970
26
Figure 3: Shell Bay Marchand Blowout, 1970
27
Figure 4: Heinrich Triangle
28
Figure 5: Oxy Piper Alpha, 1988
29
Figure 6: Personnel Safety Indicators for US Offshore Drilling (IADC)
30
Year Loss of Well Control
Fatalities Explosions
1991 6 2 1
1992 1 4 0
1993 2 1 1
1994 0 6 1
1995 1 8 0 1996 4 10 8
1997 5 8 9
1998 7 14 4
1999 5 5 7
2000 9 5 2
2001 9 7 6
2002 6 6 3
2003 5 10 6
2004 4 3 4
2005 4 5 2
2006 2 10 0
2007 7 5 +
2008 8 11 +
2009 6 4 +
Figure 7: GOM Loss of Well Control, Fatalities, Explosions (BSEE)
+ Indicates Explosions no longer reported separately
31
Figure 8: BP Macondo, 2010