5

Safety in the Offshore Environment

The third panel of the workshop included three presentations focused on safety in the offshore environment. Discussions highlighted historical lessons, current risk management strategies, and future improvements for offshore safety. Charlie Williams, Center for Offshore Safety, offered an introduction to the session and moderated the discussion following these three presentations.

Williams shared that from 1968 until 2007, the loss time incident rate for offshore oil and gas development decreased 98 percent, with a 10-fold increase in work hours. He acknowledged that the industry has drastically improved its ability to protect people.

Williams explained that personnel safety and protection from major incidents are two different yet equally important issues that necessitate two strategies. The Bureau of Safety and Environmental Enforcement’s (BSEE’s) Safety and Environmental Management Systems (SEMS) is a performance-based (not rule-based) regulatory system that includes process, personnel, and safety programs. While rule- and inspection-based systems are important, they do not fully address the safety management system errors often seen in major incidents, according to Williams. All operators in the Outer Continental Shelf (OCS) are required to have a SEMS, which emphasizes the fact that operators are responsible for making good plans and decisions that will keep people and operations safe. SEMS include the following elements:

• safety and environmental information,
• hazards analysis,
• management of change,
• operating procedures,
• safe work practices,
• training,
• pre-startup review,
• emergency response and control,
• incident investigation,
• third-party audit,
• records and documentation, and
• contractor management.

Williams emphasized that this combination of technical standards, safe work practices, skills and knowledge/competencies, and operating procedures and processes helps to develop a strong safety culture and reduce the number of major incidents during operations. The success of SEMS is contingent on the audit, accreditation, and certification; data collection, analysis, and reporting; good practice development; and the sharing of industry knowledge.

PANEL PRESENTATIONS

Historical Regulatory Perspectives

Bud Danenberger, Independent Consultant

Danenberger asserted that offshore operations and regulatory programs are really just a progression from those onshore, starting in California in the 1890s. By the 1970s and 1980s, there were 52 wells drilled in the Atlantic Ocean, some of which were pioneering at the time in terms of total well depth. According to Danenberger, the prevention of undesirable events stems primarily from having appropriate barriers in place for drilling as well as for the structures, marine systems, workplace safety, fall protection, spill and debris prevention, and handling of hazardous substances.

From 1964 until 2016, fatalities in the U.S. OCS steadily decreased. According to Danenberger, SEMS can help sustain a low level of fatalities and injuries in the offshore. Shallow gas formations that are encountered before well integrity has been established have been a major threat to safety, but drilling wells less often in shallow, gas-prone sediment, using improved survey techniques, and implementing diverter systems has helped avoid related problems.

He described the 1969 blowout in Santa Barbara with its major environmental impacts, owing to poor well integrity, after 80,000 barrels of oil were released into the Santa Barbara Channel and onto the beach. Of approximately 60,000 wells drilled in the OCS, only two major oil blowouts have occurred. The probability of such a blowout during drilling again depends on the barriers that are in place. If barriers are managed effectively, there would be a less than 10^–5 chance of major oil blowout, Danenberger explained. For poorly managed systems, the probability of a major blowout could be more than one in a hundred.

From 1984 until 2010, during which time approximately 25,000 wells were drilled, there were no fire or explosion fatalities during OCS drilling operations. Danenberger attributes this to good well control training, well control research, and appropriate regulations. Yet, on April 20, 2010, a classic example of a management disaster occurred with the Macondo blowout. He noted that, had the blowout preventer system, the well integrity, the fire prevention and detection mechanism, and the human and organizational factors barriers been maintained, the blowout could have been either much less severe or prevented entirely (see Figure 5.1).

He noted that with its attention to risk assessment deepwater production (waters deeper than 1,000 feet) has an excellent record, with only one fatality since 1979 (while 7 billion barrels and 20 trillion cubic feet of gas were produced) from a crane incident and no significant fires or explosions. He highlighted a disconnect in the offshore regulatory program between deepwater production, which is regulated in a more barrier-focused way, and drilling, which is still treated as an extension of shallow water activities.

Industry Risk Management Experience for Performing Stimulation Treatments in Offshore Settings

Paul Hebert, Chevron Corporation

Hebert noted that the oil and gas industry has a 20-year safety track record in offshore hydraulic fracturing and acid pumping operations. He reiterated that offshore hydraulic fracturing operations are different from onshore operations with unconventional shale resources. Offshore hydraulic fracturing is designed with multiple mechanical barriers and procedures in place to protect people and the environment. Comprehensive risk management processes, including management of change processes, are used for planning and pumping operations offshore.

At the onshore well site, pumping operations are run from a remote control cabin, removing people from close proximity to the operations. Hebert remarked that operational procedures, risk assessments, and job site safety analyses are performed routinely, and multiple layers of physical barriers are in place. He emphasized the importance of these processes: no two wells are alike, and all have to be designed and assessed individually for risk. At the offshore well site, because the pumping vessel is in close proximity to the oil rig, a Simultaneous Vessel Operations Plan is in place to maintain appropriate position and safe operations. Such a plan always includes risk assessment and a plan for emergency shut down. This risk assessment model allows for anyone on the job site to have the opportunity and the autonomy to stop work.

Hebert described an integrated approach for safe operations of offshore hydraulic fracturing/acidizing, which includes safety processes and physical barriers for pumping operations. Dynamic positioning as well as redundant power and management systems are utilized. These fracture jobs are monitored in real time by engineers on land, who have the opportu-

nity to modify the design of the job if necessary, and from a remote operations cabin on the vessel located away from at-risk areas. He explained that physical barriers include the use of inspected and mechanically engineered systems, a wellbore kill weight fluid that is automatically built into the design in case operations have to stop, and the use of a subsea stack to isolate pressure.

Hebert commented that the bow tie model and the matrix assessment model are effective models for risk assessment and management (see Figure 5.2) and are consistent with SEMS requirements. In the bow-tie model, the causes and potential outcomes of an event are identified, mitigations are developed, and the outcome impact is reduced. In the matrix assessment model, office and field personnel work together to design out of a potentially at-risk scenario—line-by-line procedural steps are identified, event probability and impacts are identified, and mitigations are developed so as to move from a high-consequence, high-probability area to a low-consequence, low-probability area.

According to Hebert, a study that looked at 80 percent of the jobs pumped over the past decade revealed that the average number of significant safety events was approximately 1.1 per year. The average probability of having a safety event is also low, at 0.52 percent per well operation, as is the average total recordable incident rate (TRIR) at 0.83 per year.¹ Hebert concluded that the industry has an excellent safety track record for offshore hydraulic fracturing and acid pumping operations because the industry utilizes both hydraulic and mechanical barriers to protect people and places. The hydraulic fracturing/acidizing processes used in the offshore allow fewer wells to be drilled, which leads to lower risk and fewer safety issues for both humans and the environment, Hebert explained.

___________________

¹ The TRIR for all industries and government was 1.7 per year in 2015 (BLS, 2016).

Beyond Compliance

Nancy Tippins, CEB

Tippins chaired the National Academies’ Committee on Offshore Oil and Gas Industry Safety Culture, which focused on aiding industry, government, and other stakeholder efforts in strengthening offshore industry safety culture.² The committee was tasked with identifying the characteristics of and barriers to a strong safety culture, developing strategies to measure and assess safety culture effectively, and evaluating the role of regulators in achieving an appropriate safety culture. The study’s report recommended opportunities for industry, regulators, and policy makers to establish and maintain safety culture, as well as areas for further research to close knowledge gaps surrounding safety culture. Tippins emphasized that the committee did not recommend increasing regulations to achieve these goals.

Before the committee could begin its work, it agreed on a definition of safety culture. It adopted BSEE’s definition—“core values and behaviors of all members of an organization that reflect a commitment to conduct business in a manner that protects people and the environment” (DOI, 2013). The committee also generated nine essential elements of a safety culture (NASEM, 2016) for incorporation in both offshore organizations’ safety culture efforts and in the American Petroleum Institute’s Standard RP 75 (Recommended Practice for Development of a Safety and Environmental Management Program for Offshore Operations and Facilities):

1. Leadership commitment to safety values and actions,
2. Respectful work environment,
3. Environment for raising concerns,
4. Effective safety and environmental communication,
5. Personal accountability,
6. Inquiring attitude,
7. Hazard identification and risk management,
8. Work processes, and
9. Continuous improvement.

Tippins highlighted a number of barriers to developing and sustaining a safety culture: (1) Safety culture is an ambiguous concept that is difficult to measure; (2) Levels of leadership commitment vary across organizations; (3) The industry is fragmented and diverse, which makes communication more difficult; (4) A gradual, uneven shift in industry culture is moving it as a whole from risk-taking to a commitment to safety; and (5) Regulators have difficulty building expertise to support this industry transformation.

Tippins explained that the first set of recommendations in the report was aimed toward regulators. The committee recommended that methods for and frequency of inspections be based on results of past audits. They also recommended that regulators collect and help analyze data on all incidents, so as to determine causes of incidents, improve transparency, and promote data sharing. The committee also recommended that regulators share the responsibility of establishing safety culture with one another (through a memorandum of understanding) as well as with industry leaders. The report stated that regulators need to develop competence

___________________

² The report from this committee is available at https://www.nap.edu/catalog/23524.

in safety culture assessment so as to be able to offer guidance, tools, and training to industry, while organizations should also exchange information about safety instead of competing against one another.

The second set of committee recommendations was directed toward industry, Tippins explained. The committee asked that industry adopt the BSEE definition of safety culture and its essential elements; work collectively and collaboratively to affect change; help regulators to define an optimal mix of regulation and voluntary activities; create guidance on safety culture expectations and responsibilities for all parties involved offshore; and develop an independent safety organization modeled after the Institute of Nuclear Power Operations (INPO) in which all those who work offshore would participate. The committee recommended that company leadership make safety a top-down effort. Tippins summarized the report’s findings that leaders have to model safety behavior and empower their employees to institute a safety culture; assess safety culture regularly; use multiple indicators of success; build internal company safety competence; and take advantage of resources from other companies, industry associations, and regulators (NASEM, 2016).

MODERATED DISCUSSION

A participant opened the discussion acknowledging that although the industry is good at understanding personal safety, it is difficult to articulate process safety and wondered how to deliver the message that process safety is extremely important. Williams responded that one should be able to ask the following questions of any person on a job site: What are the major hazards? What are the barriers, and are they effective? What is your personal responsibility for those barriers? If even a single person cannot answer those questions, a safety culture problem exists, Williams explained. He noted that because the industry has spent so much time emphasizing personal safety, it has perhaps overlooked the management of work issue, which can lead to more serious safety issues. He suggested increased participation in job safety analysis meetings as a potential solution. Danenberger added that a lack of understanding of process safety is a leadership/management problem. Tippins cautioned that changing an organization’s safety culture takes a substantial amount of work: an organization has to provide specific evidence about why process safety is important and tailor this argument to diverse audiences. She emphasized that this message has to be repeated and lived every single day as well as reinforced with incentives or consequences, when appropriate.

In response to a question from a participant about managing risk, Hebert responded that the dynamic positioning system employs a 3-meter watch circle for pumping while the two vessels are in close proximity to avoid unsafe conditions during a job. That participant then asked about the industry’s progress in regards to barrier management. Hebert explained that in the operational procedure plan there is an option for an automatic stop job if a condition outside of the safety envelope arises. Danenberger mentioned that although many companies are extremely effective in identifying risks and setting up barriers, issues of well integrity may still need to be addressed.

A participant commented that it is important to acknowledge companies that participate in safety audits. He also voiced support for the Center for Offshore Safety; he noted that be-

cause the nuclear industry is so different from the oil and gas industry, INPO is not a good model of an independent safety organization. Tippins clarified that not all of INPO’s attributes apply to the oil and gas industry. She also applauded the companies who conduct safety audits and encouraged others to follow their lead. Hebert noted that SEMS has a built-in audit feature, while other organizations use self-imposed audits.

Referring to the bow-tie model for risk assessment and management, another participant questioned the seemingly linear depiction of the model given that safety is a non-linear concern. Hebert clarified that each individual procedure is placed in its own bow-tie model, as opposed to having only one bow-tie for an entire fracture job. All of these procedures then have to be integrated, which is why it often takes up to 2 full days to do the analysis. The participant followed-up by asking how unanticipated instances (outside of the bow-tie model) are handled, and Hebert noted that there is always a back-up plan, a barrier in place, and an option to shut down operations. He added that the vast majority of people working in the OCS have authority and will be held accountable for issuing a stop work. Williams reiterated that the stop work authority is a SEMS requirement and that the bow-tie is only a visual representation; in actual operations, problems cascade and barriers are multiple.

Regarding issues of communication, a participant asked how technological, social, and awareness obstacles are addressed. Tippins noted that the National Academies’ study committee focused on the human interface and the clarity of roles as opposed to the technology in establishing a safety culture. Hebert added that there are multiple open communication channels on both the rig and the vessel and that the simultaneous operations plan makes clear who is in charge of stopping work when something goes awry. While Williams acknowledged that there are many ways to improve communications related to safety, he prioritized situational awareness (i.e., the level of risk associated with decisions) as most urgent.

Another participant asked the panel to comment on lessons learned from the Macondo incident, BSEE’s role in such an evaluation, and public assurance that such an event can be prevented in the future. Williams said that the panel chose not to discuss Macondo in detail because it has been so well investigated by so many different groups (including regulators), and such expansive literature already exists. He added there were multiple responses to Macondo, including the emergence of both the Marine Well Containment Company and the Center for Offshore Safety. Hebert noted that more than 500 regulations were implemented and Danenberger commented that the SEMS rule was finalized, both as a result of the Macondo incident.

Recognizing that gaps in safety culture may exist, a participant emphasized that the industry is relentless about continually improving its safety culture. He asked the panel for its perspective on the human performance side of safety culture. Tippins acknowledged that while many companies have strong safety cultures, there are others that still prioritize profit and productivity over safety. She added that even places with the strongest safety cultures will only sustain them if they are reinforced daily, and she agreed that the human factors aspect (i.e., awareness of how human behaviors can cause or prevent accidents) of safety culture is critical. Danenberger agreed with Tippins’s perspective and noted the value of increased data analysis and sharing in strengthening the safety culture.

Another participant asked the panel for ideas about how to make safety training more interesting. Williams suggested incorporating safety simulation exercises that, while engaging, do not have to be expensive or elaborate. He noted that targeted safety data relevant to particular

jobs can also be shared with each job group. Hebert suggested personalizing the experience by focusing on the fact that people are working to support their families and emphasizing the value of integrity: people tend to step up to the task when they consider their roles in keeping themselves and their co-workers safe. Tippins agreed that personalization of safety training is key. She also suggested that trainers read literature on adult learning to gather strategies about delivering complex material to adults in an interesting way.