DNV suggestions for changes to the US safety regime

29 September 2010

An Enhanced Safety Regulatory RegimeFPSO Summit 2010, Singapore September 29, 2010

Presented by Carl Arne Carlsen, Director for Mobile Offshore Units in DNV

© Det Norske Veritas AS. All rights reserved.

29 September 2010

2

Contents

� Learning from the history

� Proposal for an enhanced safety regulatory regime


29 September 2010

3

Some offshore accidents with high impact on offshore safety regulations

� Ekofisk Bravo (1977)

� Alexander Kielland (1980)

� Ocean Ranger (1982)

� Piper Alpha (1988)

� P36 (2001)

� Deepwater Horizon (2010) ?

� How to reduce risk in the future?

1985 1990 1995 2000 2005 2010

Ale

xan

der

Kie

llan

d

Oce

an R

ang

er

Pip

er A

lph

a

P36

19801975

Eko

fisk

Bra

vo

Dee

pw

ater

ho

rizo

n


29 September 2010

4

1977 Ekofisk Bravo -> organising the activities (Norway)

The accident

� Blow out 22. April 1977

� Stopped by Red Adair and Boots Hansen after 8 days

� No fire, but 22 500 tonnes oil released,

� Accident happened during removal of valve for maintenanceand well stabilisation by mud - unsatisfactory installation of down hole safety valve during night- mud started leaking out next morning - safety valves on deck were not closed

� Oil recovery equipment mobilised- took several days and found to be inadequate even in calm water. Only 4% of theoil recovered.

� The oil evaporated or was broken down by the sea

New safety regulations

� Investigation focused on lack of safety planning and procedures during maintenance – a general need for betterorganisation of safety by operators

� Contributed to develop and implement specific regulationsfor oil companies own control by the oil directorate ( June 7, 1979)

� Intensified focus by authorities and industry to improveorganisation and equipment for oil recovery after blow outs

� Rescue vessel mobilization requirement established – onthe spot within 25 minutes of an accident>

Oil drift simulation for Bravo accident.

Input to planning the clean –up operations

by DNV


29 September 2010

5

1980 Alexander Kielland – > design principles ,evacuation and internal control

(Norway)The accident (27 March 1980)

� Fatigue crack developed around hydro phone in bracing –column broke off-rig capsized

� 123 people killed , 89 survived

� Inadequate life saving equipment

�3 Lifeboats crashed against platform- one landed up side down

� unable to release life rafts

� Only a few crew members had survival suits. Not enough lifejackets on deck.

� Only 76 persons had been through safety course , whereof 50 only one day course

� First rescue vessel arrived after 1 hour – too late to contribute


� Structural design for platforms inadequate - safety barriers introduced for better structural robustness

� Survival floatability to enable evacuation of people

� Mandatory rescue suit (further developed to survival suits) for all people onboard and for all helicopter passengers.

� Increased focus on meeting mobilisation requirement to rescue vessels ( 25 min)

� Stricter requirements to life boat launching arrangements, un obstructed launching in 25 degrees heel , steering capacity and lifeboats heading away from platform

� Implementation of the ”internal control ” principle principle for operators overall safety responsibility (May 15, 1981) >


29 September 2010

6

1982 Ocean Ranger -> upgrade of international regulations (Canada)

The accident

� Capsized and sunk in 1982 offshore Newfoundland

� One of the largest and most modern drilling units of its time

� 84 lives lost, no one survived. Eye witnesses indicate 1 boat, 56 people in the sea suffered hypothermia and drowned

� 3 standby vessels lacked rescue means to take onboard people

� Water entered into the ballast control room , requiring local valve operation in the pontoons to counter heel

� Crew did not understand how to operate the ballast system manually and in emergency situation

� Pumps only astern , not able to upright rig heeling forward after filling of forward chain lockers .

� Shortcomings for survival gear and training


� Major upgrades of offshore safety regulations in Canada

� Contributed to next major revision of the IMO MODU code (1989)

� Revision of rules with requirements relating to: - Ballast Control- Damage Stability

� Improved offshore training – emergency ballast control training, simulators

� Improved evacuation equipment and planning

� Improved means for taking people out of the water in severe weather from standby and rescue vessels>


29 September 2010

7

1988 Piper Alpha, designed for rough seas, not for explosions- > the “safety case”(UK)

The accident

� Leak of gas condensate ignited and caused a large explosion

� 167 died and 62 rescued

� Lack of communication between shifts - Three parallel gas trains - One closed down

- Safety valve removed

- Next shift, started closed train again

� Consequences escalated- Platform not designed for explosions

( appropriate separation, fire walls):

- Surrounding platforms’ oil transfer to Piper Alpha not closed down, feeding the fire

- Assumed living quarters a safe place but it was sitting above control room which was above risers

- Several did not try to evacuate, waiting in the living quarter for helicopter rescue .


� Turning point for UK Offshore Safety Legislation

� Changed layout- Physical separation principles

- Firewalls

- New principles for process safety

� Risk analyses became mandatory – the safety case- the “safety case” – safety critical elements

- ALARP principle introduced (As Low As Reasonably Practical)

- Formal requirement for QRA for temporary safe refuge

� New requirements on UK shelf- Update design to prevent and mitigate consequences of

accidents

- Safety cases involving all operating staff- Formal hand over communications >


29 September 2010

8

2001 P36-> life long risk focus (Brazil)

The accident

� Structural rupture of the improperly isolated emergency drainage tank , originally not meant for oily water, gas leakage

� Rupture of adjacent sea water cooling pipe

� Emergency firefighting brigade to area of the accident;

� 17 minutes later – explosion

� 11 people killed

� Progressive flooding starting from ruptured sea water pipe when fire water activated and through ventilation pipes

� Procedures not followed- Sea water pumps (feeding cooling water and fire water) for repair

without taking any other alternative preventive action- Opening column compartment for inspection without following

procedures- Unexpected flow from ruptured seawater pipe – HVAC remained

open- Delay in activation of the drainage pump – more than 1000

alarms,(fire and gas and shut down), blackout after 20 minutes - Deficient procedures and training to deal with emergency situations

� 5 days later the platform sank


� Establishment of safety strategies.

� Risk assessment for non-standard design. Rig designed for drilling, modified to production rig

� Risk analyses for non standard operation, maintenance, HAZOPs


29 September 2010

9

2010 Deepwater Horizon -> (USA)The accident

� Macondo well was drilled initially in 2009 and again in 2010

� A commercial field was confirmed

� 19-20 April – cement job to seal bottom of well

� 20 April: sequence of close-out activities including removal of mud and pressure tests

� 20 April: well blowout event, gas vents through Mud Room and into the diesel generators, ignition occurs

� 20 April: BOP fails to seal well

� 20 April: 117 staff rescued including 17 injured, 11 fatalities

� 21 April – 5 May: 20 further attempts to close BOP all fail

� April-May-June-July uncontrolled blowout continues

� BP and USCG deploy multiple strategies to stop blowout or to mitigate the oil spill

� Fleet of response vessels secured, deployed safely with objective to capture all Oil and Gas, with gas to be flared and Oil exported

� 15 July: Well capped, 4.9m bbls oil spilled in total

� 9 Sept: relief wells pump cement into bottom and US Govt declares well killed

New safety regulations ?

� 6 month moratorium implemented pending findings and new regulations

� MMS reorganized into BOEMRE (Bureau of Ocean Energy Management Regulation and Enforcement)

� API, IADC develop suggestions

� BOEMRE public meetings – DNV offers its views on future regulations


29 September 2010

10

Key areas for safety improvements identified by accidents

TrainingClean upmanagement

Emergencyrescue

Maintenanceand inspection

Safetydesign/ construction

Safetyorganisation/management

Risk assessment

DeepwaterHorizon ?

XXXP36

XXXXXXPiper Alpha

XXXXOceanRanger

XXXXXAlexander Kielland

XXXXEkofisk Bravo

Recommended improvements, key areas

Accident


29 September 2010

11

Are we able to learn?

� Yes, industry and regulators act

� Use experience from the past to prevent accidents in the future

� Changes in national and international regulations

� Focus on technical issues

� More focus on human factors needed

� More focus on organizational factors needed

The future – minimizing human errors, they are the main contributor to accidents� The right skills

- At all levels- Designers, constructors, engineers, operators

� Ensure human behaviours- Training- Life long learning- Safety culture

� The right management system- Living the system


29 September 2010

12

The way forward: balancing prescriptive rules and risk management

Accident learning

Industry practice

R & D

Prescriptive rulesand regulationstaking learningfrom the past

Changingconditions

Newtechnology

Sensitiveenvironment

Risk basedassessments

to foreseefuture threats


29 September 2010

13

The future: An enhanced safety regulatory regime ?

� The Vision – Step Change improvement for Safety and Environment

� Regulations – blend Prescription and Performance

� Decision making – risk based

� Clear roles – regulator and Industry

� Effective and efficient for all parties involved

� More focus to mitigate high risk elements, less to unimportant issues, i.e. more optimum use of resources


29 September 2010

14

What the O&G & Process Industry both has and has not achieved

Over the last 20 years the industry has attained a step change (factor of ten) improvement in occupational safety

- Graph shows factor of 3 in last 10 years

USA and EU Process Industry- Neither EU nor USA has demonstrated significant

improvements for onshore major accidents (OSHA PSM, EU Seveso Directive)

- Chemical Safety Board and Baker Panel highlighted after Texas City that Process Safety (major accidents) and Occupational Safety (personal accidents) are NOT the same

North Sea major accident safety has improved- No major disaster since introduction of Safety

Case / risk based legislation in UK / Norway (leaks have occurred, but none escalated)

- Reducing trend in major hydrocarbon leaks - Factor of 10 in last 13 years – UK HSE Database- “What doesn’t leak can’t explode…”

Different oil and chemicaloperating companies

Trendline

10x improvementIn past 13 years

�

�

�


29 September 2010

15

Vision – Step Change Improvement for Major Accidents

The Industry HAS already attained about 10x improvement in occupational safety- Starting point in 1980’s was already very good performance

- Many doubted such a big improvement was possible

DNV believes major accidents can also be reduced 10x – but with different tools

1. Revised regulatory regime: Blend of Prescriptive and Performance-based regulations2. Address technical, human and organizational factors: Key lessons from past accidents3. Enhanced and enforced risk management approach: Addressing Risks, Controls and

Conditions4. Clear roles and responsibilities: Clear to all5. Shared performance monitoring: All information is readily available where needed

DNV believes:

- This is practically and economically feasible

- Methods described are in use with O&G companies somewhere – but not fully integrated anywhere

- Skills and experience available in the regulator, industry, contractors, and 3rd parties


29 September 2010

16

1. Revised Regulatory Regime

� Regulators have specialist manpower – but normally limited in number- Regulations should maximize its skills deployment to focus on the most important issues

- No point in growing large specialist regulatory workforce that is very hard to keep current

- Blend updated Prescription with newer Performance style regulation

� Industry has deeper knowledge of hazards and risk management- New wells or development approaches can introduce novel hazards

- Industry can carry out risk assessments, define necessary controls and monitor conditions- The Operator carries the responsibility for proper Safety and Environmental protection

� Lessons should be learned from Offshore and Nuclear experience- Clearly define needed safety barriers and assign required performance and ownership- Regulator should ensure the competence of those doing inspections – not attempt all itself

- Role for independent 3rd party (e.g. Class Societies)

� Capture this in a Safety Case-style Regulatory Regime- Operator demonstrates the high level of safety that will be achieved and maintained

- All key safety barriers are functioning at their required performance level


29 September 2010

17

2. Address Technical, Human and Organizational Factors

� This lesson has been clearly learned from many past disasters - Esso Longford Fire / Texas City Explosion / Three Mile Island / NASA Challenger

� Purely technical solutions do not address all important failure modes- Process safety culture (i.e. major accidents) – not just occupational safety culture is important

- Organizational structures encouraging continuous “mindfulness” of risks

� A step change will require all three aspects: Technical, Human and Organizational

- Future regulations should mandate these aspects to be addressed- UK Safety case regulations require Human factors to be addressed explicitly


29 September 2010

18

3. Fully Integrated Risk Model

� A fully integrated tool for - Designing for exemplary safety and environmental

performance - Operating for exemplary safety and environmental

performance

� Allowing for full communication between Operator, Contractor and Regulator- Equivalent focus on the Risk – the Controls – and

the Condition - Transparent demonstration that safety is

substantially enhanced

ConditionControls

Risk

Performance

Industry Regulator


29 September 2010

19

Risk Models demonstrate enhanced Safety & Enviromentalperformance

� Risk Modeling is needed at both Design and Operations Stages- Risk modeling provides insights as to threats and how well the facility can respond

- These show that Step-Change risk targets will actually be achieved – the Safety Case Demonstration aspect- Quantitative analysis at design time (like Nuclear PRA)- Qualitative at operations stage (for more effective communications)

- Match blended regulations of Prescription and Performance

� All risks known, all barriers defined (technical, people, organizational), responsibilities assigned- Demonstrate attainment of high safety targets

Design Stage – predictionse.g. blowout spill fate

Operations Stage barrier models e.g. showing barriers and owners


29 September 2010

20

4. Clear Roles and Responsibilities

� Offshore operations involve many parties- Owner, operator, contractors, independent 3rd parties

� The Operator owns the overall risk and the Safety case- The regulator may “accept” a safety case, but does not usually “approve” it

� Bow Tie risk model clearly identifies responsibilities for maintaining barriers at specified performance level

- Threats on left-side, Outcomes on right-side


29 September 2010

21

5. Shared Performance Monitoring and Decision Making

� The best risk model is still only theory if it isn’t implemented- Technical, human and organizational means are needed to keep it REAL

- The status of all barriers must be continuously monitored and known to operators

- These must be shared with all who need to know (e.g. with modern IT tools)- Operator, Contractors, 3rd parties, regulator, and Offshore and Onshore locations

� Teamwork should be employed for key decisions- Decision rooms to address unusual situations or combinations of functional and degraded barriers

(onshore and offshore personnel working together and with full knowledge)


29 September 2010

22

Next Steps: The Regulator and The Industry

The Regulator

� Develop suitable regulations for a risk-based approach- Blend of Prescription and Performance regulations- Require a safety case approach – for both Design Stage and Operations Stage

The Industry

� Support updates to Prescriptive Regulations

� Support the development of suitable Performance Regulations- Risk models to demonstrate improvement in the Safety Case- Include Human and Organizational factors into technical risk models- Implement means to monitor barriers through lifetime and assure functionality


29 September 2010

23

Prescriptive vs performance based regulations

� The safety case approaches in western countries were designed to bridge the differencebetween prescriptive codes and performance based codes

� Prescriptive codes are often reactive, e.g. based on accidents but also to some extent on newunderstanding through R&D, e.g. for new applications and innovations

� The results of risk assessments tend to be the interface between technical issues and human interaction rather than the technical issues alone. They normally result in design criteria *, management procedures and maintenance routines

� Industry codes, e.g. API and class rules are seen as good technical standards to build on to meet the design criteria.

� Various shelf states that apply performance based regulations accept technical issues basedon such industry standards and certified or verified by Classification Societies, e.g. UK, Canada, Australia, Norway

� Such use of industry standards may be a prerequisit for cost effectiveness of the constructionindustry to avoid eccessive engineering and unclear scope for newbuilding contracts

* e.g. quantify safety requirements - blast wall loadings, fire wall resistance, ventilation requirements, escape vulnerability, etc


29 September 2010

24

Conclusion

� The Vision – Step Change improvement for Safety and Environment

� Regulation to be blend of Prescription and Performance

� Risk informed decision basis – supported by Safety Case

� Safety and environment protection, demonstration by the industry- Regulators role is oversight and compliance enforcement


29 September 2010

25

Safeguarding life, property and the environment

www.dnv.com

DNV suggestions for changes to the US safety regime

Business

Transcript of DNV suggestions for changes to the US safety regime