DNV suggestions for changes to the US safety regime

An Enhanced Safety Regulatory Regime
FPSO Summit 2010, Singapore September 29, 2010
Presented by Carl Arne Carlsen, Director for Mobile Offshore Units in DNV

29 September 2010

Contents

Learning from the history
Proposal for an enhanced safety regulatory regime

29 September 2010
© Det Norske Veritas AS. All rights reserved. 2

Some offshore accidents with high impact on offshore safety regulations

Ekofisk Bravo (1977)
Alexander Kielland (1980)
Ocean Ranger (1982)
Piper Alpha (1988)
P36 (2001)
Deepwater Horizon (2010) ?

How to reduce risk in the future?
Alexander Kielland

Deepwater horizon
Ocean Ranger
Ekofisk Bravo

Piper Alpha

P36
1975 1980 1985 1990 1995 2000 2005 2010

29 September 2010

1977 Ekofisk Bravo -> organising the activities (Norway)

Oil drift simulation for Bravo accident.
The accident
Input to planning the clean –up operations
Blow out 22. April 1977
by DNV
Stopped by Red Adair and Boots Hansen after 8 days
No fire, but 22 500 tonnes oil released,
Accident happened during removal of valve for maintenance
and well stabilisation by mud
- unsatisfactory installation of down hole safety valve during night
- mud started leaking out next morning
- safety valves on deck were not closed
Oil recovery equipment mobilised- took several days and
found to be inadequate even in calm water. Only 4% of the
oil recovered.
The oil evaporated or was broken down by the sea
New safety regulations
Investigation focused on lack of safety planning and
procedures during maintenance – a general need for better
organisation of safety by operators
Contributed to develop and implement specific regulations
for oil companies own control by the oil directorate ( June 7,
1979)
Intensified focus by authorities and industry to improve
organisation and equipment for oil recovery after blow outs
Rescue vessel mobilization requirement established – on
the spot within 25 minutes of an accident>

29 September 2010

1980 Alexander Kielland – > design principles ,evacuation and internal control
(Norway)
The accident (27 March 1980)
Fatigue crack developed around hydro phone in bracing –
column broke off-rig capsized
123 people killed , 89 survived
Inadequate life saving equipment
3 Lifeboats crashed against platform- one landed up side down
unable to release life rafts

Only a few crew members had survival suits. Not enough life
jackets on deck.
Only 76 persons had been through safety course , whereof 50
only one day course
First rescue vessel arrived after 1 hour – too late to contribute
Structural design for platforms inadequate - safety barriers introduced for better structural robustness
Survival floatability to enable evacuation of people
Mandatory rescue suit (further developed to survival suits) for all people onboard and for all helicopter passengers.
Increased focus on meeting mobilisation requirement to rescue vessels ( 25 min)
Stricter requirements to life boat launching arrangements, un obstructed launching in 25 degrees heel , steering capacity and
lifeboats heading away from platform

Implementation of the ”internal control ” principle principle for operators overall safety responsibility (May 15, 1981) >

29 September 2010

1982 Ocean Ranger -> upgrade of international regulations (Canada)

The accident
Capsized and sunk in 1982 offshore Newfoundland
One of the largest and most modern drilling units of its time
84 lives lost, no one survived. Eye witnesses indicate 1 boat, 56 people
in the sea suffered hypothermia and drowned
3 standby vessels lacked rescue means to take onboard people
Water entered into the ballast control room , requiring local valve
operation in the pontoons to counter heel
Crew did not understand how to operate the ballast system manually
and in emergency situation
Pumps only astern , not able to upright rig heeling forward after filling of
forward chain lockers .
Shortcomings for survival gear and training

Major upgrades of offshore safety regulations in Canada
Contributed to next major revision of the IMO MODU code (1989)
Revision of rules with requirements relating to:
- Ballast Control
- Damage Stability

Improved offshore training – emergency ballast control training, simulators
Improved evacuation equipment and planning
Improved means for taking people out of the water in severe weather from standby and rescue vessels>

29 September 2010

1988 Piper Alpha, designed for rough seas, not for explosions- > the “safety case”
(UK)
The accident New safety regulations
Turning point for UK Offshore Safety Legislation
Leak of gas condensate ignited and
caused a large explosion Changed layout
- Physical separation principles
167 died and 62 rescued
- Firewalls
Lack of communication between shifts - New principles for process safety
- Three parallel gas trains
- One closed down Risk analyses became mandatory – the safety case
- Safety valve removed - the “safety case” – safety critical elements
- Next shift, started closed train again - ALARP principle introduced (As Low As Reasonably
Practical)
Consequences escalated - Formal requirement for QRA for temporary safe refuge
- Platform not designed for explosions
( appropriate separation, fire walls): New requirements on UK shelf
- Surrounding platforms’ oil transfer to Piper - Update design to prevent and mitigate consequences of
Alpha not closed down, feeding the fire accidents
- Assumed living quarters a safe place but it - Safety cases involving all operating staff
was sitting above control room which was - Formal hand over communications >
above risers
- Several did not try to evacuate, waiting in
the living quarter for helicopter rescue .

29 September 2010

2001 P36-> life long risk focus (Brazil)

The accident
Structural rupture of the improperly isolated emergency
drainage tank , originally not meant for oily water, gas
leakage
Rupture of adjacent sea water cooling pipe
Emergency firefighting brigade to area of the accident;
17 minutes later – explosion
11 people killed
Progressive flooding starting from ruptured sea water pipe
when fire water activated and through ventilation pipes
Procedures not followed
- Sea water pumps (feeding cooling water and fire water) for repair
without taking any other alternative preventive action
- Opening column compartment for inspection without following
procedures
- Unexpected flow from ruptured seawater pipe – HVAC remained
open
- Delay in activation of the drainage pump – more than 1000
alarms,(fire and gas and shut down), blackout after 20 minutes New safety regulations
- Deficient procedures and training to deal with emergency situations
5 days later the platform sank Establishment of safety strategies.
Risk assessment for non-standard design. Rig designed for
drilling, modified to production rig
Risk analyses for non standard operation, maintenance,
HAZOPs

29 September 2010

2010 Deepwater Horizon -> (USA)
The accident
Macondo well was drilled initially in 2009 and again in 2010
A commercial field was confirmed
19-20 April – cement job to seal bottom of well
20 April: sequence of close-out activities including removal of mud and pressure tests
20 April: well blowout event, gas vents through Mud Room and into the diesel generators,
ignition occurs
20 April: BOP fails to seal well
20 April: 117 staff rescued including 17 injured, 11 fatalities
21 April – 5 May: 20 further attempts to close BOP all fail
April-May-June-July uncontrolled blowout continues
BP and USCG deploy multiple strategies to stop blowout or to mitigate the oil spill
Fleet of response vessels secured, deployed safely with objective to capture all Oil and Gas,
with gas to be flared and Oil exported
15 July: Well capped, 4.9m bbls oil spilled in total
9 Sept: relief wells pump cement into bottom and US Govt declares well killed
New safety regulations ?
6 month moratorium implemented pending findings and new regulations
MMS reorganized into BOEMRE (Bureau of Ocean Energy Management Regulation and
Enforcement)
API, IADC develop suggestions
BOEMRE public meetings – DNV offers its views on future regulations

29 September 2010

Key areas for safety improvements identified by accidents

Recommended improvements, key areas
Accident
Risk Safety Safety Maintenance Emergency Clean up Training
assessment organisation/ design/ and rescue management
management construction inspection

Ekofisk X X X X
Bravo

Alexander X X X X X
Kielland

Ocean X X X X
Ranger

Piper X X X X X X
Alpha

P36 X X X

Deepwater
Horizon ?

29 September 2010

Are we able to learn?
Yes, industry and regulators act
Use experience from the past to prevent accidents in the
future
Changes in national and international regulations
Focus on technical issues
More focus on human factors needed
More focus on organizational factors needed

The future – minimizing human errors, they are the main contributor to accidents
The right skills
- At all levels
- Designers, constructors, engineers, operators
Ensure human behaviours
- Training
- Life long learning
- Safety culture
The right management system
- Living the system

29 September 2010

The way forward: balancing prescriptive rules and risk management

Prescriptive rules Risk based
and regulations assessments
taking learning to foresee
from the past future threats
Industry New
practice technology

Accident Changing Sensitive
R&D
learning conditions environment

29 September 2010

The future: An enhanced safety regulatory regime ?

The Vision – Step Change improvement for Safety and Environment
Regulations – blend Prescription and Performance
Decision making – risk based
Clear roles – regulator and Industry
Effective and efficient for all parties involved
More focus to mitigate high risk elements, less to unimportant issues, i.e. more optimum use of resources

29 September 2010

What the O&G & Process Industry both has and has not achieved
Over the last 20 years the industry has
attained a step change (factor of ten)
improvement in occupational safety
- Graph shows factor of 3 in last 10 years
Different oil
USA and EU Process Industry and chemical
operating
companies
- Neither EU nor USA has demonstrated significant
improvements for onshore major accidents (OSHA
PSM, EU Seveso Directive) Trendline
- Chemical Safety Board and Baker Panel
highlighted after Texas City that Process Safety
(major accidents) and Occupational Safety
(personal accidents) are NOT the same

North Sea major accident safety has improved
- No major disaster since introduction of Safety
Case / risk based legislation in UK / Norway (leaks
have occurred, but none escalated)
- Reducing trend in major hydrocarbon leaks
- Factor of 10 in last 13 years – UK HSE Database
- “What doesn’t leak can’t explode…”
10x improvement
In past 13 years

29 September 2010

Vision – Step Change Improvement for Major Accidents
The Industry HAS already attained about 10x improvement in occupational safety
- Starting point in 1980’s was already very good performance
- Many doubted such a big improvement was possible
DNV believes major accidents can also be reduced 10x – but with different tools
1. Revised regulatory regime: Blend of Prescriptive and Performance-based regulations
2. Address technical, human and organizational factors: Key lessons from past accidents
3. Enhanced and enforced risk management approach: Addressing Risks, Controls and
Conditions
4. Clear roles and responsibilities: Clear to all
5. Shared performance monitoring: All information is readily available where needed
DNV believes:
- This is practically and economically feasible
- Methods described are in use with O&G companies somewhere – but not fully integrated
anywhere
- Skills and experience available in the regulator, industry, contractors, and 3rd parties

29 September 2010

1. Revised Regulatory Regime

Regulators have specialist manpower – but normally limited in number
- Regulations should maximize its skills deployment to focus on the most important issues
- No point in growing large specialist regulatory workforce that is very hard to keep current
- Blend updated Prescription with newer Performance style regulation

Industry has deeper knowledge of hazards and risk management
- New wells or development approaches can introduce novel hazards
- Industry can carry out risk assessments, define necessary controls and monitor conditions
- The Operator carries the responsibility for proper Safety and Environmental protection

Lessons should be learned from Offshore and Nuclear experience
- Clearly define needed safety barriers and assign required performance and ownership
- Regulator should ensure the competence of those doing inspections – not attempt all itself
- Role for independent 3rd party (e.g. Class Societies)

Capture this in a Safety Case-style Regulatory Regime
- Operator demonstrates the high level of safety that will be achieved and maintained
- All key safety barriers are functioning at their required performance level

29 September 2010

2. Address Technical, Human and Organizational Factors
This lesson has been clearly learned from many past disasters
- Esso Longford Fire / Texas City Explosion / Three Mile Island / NASA Challenger

Purely technical solutions do not address all important failure modes
- Process safety culture (i.e. major accidents) – not just occupational safety culture is important
- Organizational structures encouraging continuous “mindfulness” of risks

A step change will require all three aspects:
Technical, Human and Organizational
- Future regulations should mandate these aspects to be addressed
- UK Safety case regulations require Human factors to be addressed explicitly

29 September 2010

3. Fully Integrated Risk Model
A fully integrated tool for
- Designing for exemplary safety and environmental
performance
- Operating for exemplary safety and environmental Risk
performance

Allowing for full communication between
Operator, Contractor and Regulator
- Equivalent focus on the Risk – the Controls – and
the Condition
Controls Condition
- Transparent demonstration that safety is
substantially enhanced

Performance

Industry Regulator

29 September 2010

Risk Models demonstrate enhanced Safety & Enviromental performance
Risk Modeling is needed at both Design and Operations Stages
- Risk modeling provides insights as to threats and how well the facility can respond
- These show that Step-Change risk targets will actually be achieved – the Safety Case Demonstration aspect
- Quantitative analysis at design time (like Nuclear PRA)
- Qualitative at operations stage (for more effective communications)
- Match blended regulations of Prescription and Performance

Design Stage – predictions Operations Stage barrier models
e.g. blowout spill fate e.g. showing barriers and owners

All risks known, all barriers defined (technical, people, organizational), responsibilities assigned
- Demonstrate attainment of high safety targets

29 September 2010

4. Clear Roles and Responsibilities

Offshore operations involve many parties
- Owner, operator, contractors, independent 3rd parties

The Operator owns the overall risk and the Safety case
- The regulator may “accept” a safety case, but does not usually “approve” it

Bow Tie risk model clearly identifies responsibilities for maintaining barriers at specified
performance level
- Threats on left-side, Outcomes on right-side

29 September 2010

5. Shared Performance Monitoring and Decision Making
The best risk model is still only theory if it isn’t implemented
- Technical, human and organizational means are needed to keep it REAL
- The status of all barriers must be continuously monitored and known to operators
- These must be shared with all who need to know (e.g. with modern IT tools)
- Operator, Contractors, 3rd parties, regulator, and Offshore and Onshore locations

Teamwork should be employed for key decisions
- Decision rooms to address unusual situations or combinations of functional and degraded barriers
(onshore and offshore personnel working together and with full knowledge)

29 September 2010

Next Steps: The Regulator and The Industry
The Regulator
Develop suitable regulations for a risk-based approach
- Blend of Prescription and Performance regulations
- Require a safety case approach – for both Design Stage and Operations Stage

The Industry
Support updates to Prescriptive Regulations
Support the development of suitable Performance Regulations
- Risk models to demonstrate improvement in the Safety Case
- Include Human and Organizational factors into technical risk models
- Implement means to monitor barriers through lifetime and assure functionality

29 September 2010

Prescriptive vs performance based regulations

The safety case approaches in western countries were designed to bridge the difference
between prescriptive codes and performance based codes
Prescriptive codes are often reactive, e.g. based on accidents but also to some extent on new
understanding through R&D, e.g. for new applications and innovations
The results of risk assessments tend to be the interface between technical issues and human
interaction rather than the technical issues alone. They normally result in design criteria *,
management procedures and maintenance routines
Industry codes, e.g. API and class rules are seen as good technical standards to build on to
meet the design criteria.
Various shelf states that apply performance based regulations accept technical issues based
on such industry standards and certified or verified by Classification Societies, e.g. UK,
Canada, Australia, Norway
Such use of industry standards may be a prerequisit for cost effectiveness of the construction
industry to avoid eccessive engineering and unclear scope for newbuilding contracts

* e.g. quantify safety requirements - blast wall loadings, fire wall resistance, ventilation requirements, escape vulnerability, etc

29 September 2010

Conclusion

The Vision – Step Change improvement for Safety and Environment
Regulation to be blend of Prescription and Performance
Risk informed decision basis – supported by Safety Case
Safety and environment protection, demonstration by the industry
- Regulators role is oversight and compliance enforcement

29 September 2010

Safeguarding life, property
and the environment

www.dnv.com

29 September 2010

DNV suggestions for changes to the US safety regime

Recomendados

Recomendados

Mais conteúdo relacionado

Semelhante a DNV suggestions for changes to the US safety regime

Semelhante a DNV suggestions for changes to the US safety regime (20)

Mais de IQPC

Mais de IQPC (10)

Último

Último (20)

DNV suggestions for changes to the US safety regime