The U.K. government is making progress in its campaign to improve the safety of personnel working offshore.
The government's Health and Safety Executive (HSE) plans to assess and pass judgment on at least one safety plan, called a "safety case," from each U.K. North Sea operator as soon as possible. HSE has agreed with the industry on a list of 61 priority safety cases, known as "exemplars."
Feedback from exemplar assessment will help operators review safety management and assist in preparation or revision of future safety cases. It also will give HSE practice in assessing a range of case types.
Current activity follows in the wake of a deadline for operators to provide HSE a detailed safety case document for every installation off the U.K.
The deadline occurred last Nov. 30, when U.K. operators passed a milestone after 5 years of rethinking of the way they build and operate offshore installations. The requirement for a safety program is part of new U.K. offshore legislation designed to prevent another accident similar to the Piper Alpha platform fire and explosion of 1988.
The new legislation is based on the findings of a public inquiry led by Lord into the causes of the Piper Alpha blast.
"We have now received well over 200 safety cases, all of which have to be assessed during a 2 year transitional period ending Nov. 30, 1994," said Tony Barrell, chief executive of HSE's Offshore Safety Division (OSD).
After the transition period it will be against the law to operate an oil and gas installation in British waters without an accepted safety case.
"The transitional period is to allow us time to carry out the assessments," Barrell said. It is not intended to provide a grace period for late submission.
Besides existing installations, safety cases are also required for new installations reaching design stage by May 31, 1993, the date safety case regulations went into force.
All but one of 215 safety cases for existing installations and designs was submitted on time. The late one, sent from Norway, arrived 1 day after the deadline. HSE had been alerted of the delay.
PIPER ALPHA ACCIDENT
On July 6, 1988, fires and explosions on the Piper Alpha platform in the U.K. North Sea killed 167 crewmen and heavily damaged the platform. Operator Occidental Petroleum (Caledonia) Ltd. later sold its interest in the platform.
Lord Cullen's government inquiry into the accident revealed faults in the way U.K. offshore installations were built and operated.
In November 1990 the U.K. Department of Energy published "The Public Inquiry into the Piper Alpha Disaster," the report of the inquiry, which became known as the Cullen report.
Since the Piper Alpha disaster, the main concern of the U.K. offshore sector has been preparing for and implementing Cullen's recommendations.
The inquiry identified the trigger for the Piper Alpha blast as a breakdown in communications between maintenance crews at a change of shifts.
A failure in the platform's permit to work system left the incoming crew unaware that the outgoing crew had removed a condensate pump safety valve.
When a similar condensate pump tripped, the new crew tried to restart the pump, which had a safety valve missing. This caused an explosion in the oil separation module and a subsequent fire.
The fire was fed by produced oil and a leak from the main oil line to shore. The fire ruptured the gas riser from the nearby Tartan field platform, causing a second explosion and a massive intensification of the fire.
Main power supplies and the control room were disabled by the first blast. Emergency shutdown systems were activated, but many failed. Firewater systems were rendered useless, and smoke entered the accommodation module.
Some crewmen had gathered in the accommodation block, but there was no concerted attempt to evacuate them. Cullen concluded that the accommodation block was a death trap. Twenty eight of the 61 survivors escaped from the accommodation unit by ropes and hoses or by jumping into the sea.
IMMEDIATE WORK
Between the Piper Alpha blast and publication of the Cullen report, U.K. offshore operators reviewed their operations as understanding of the causes of the blast grew.
They reviewed their permit to work systems and made changes. They looked into the provision and siting of emergency shutdown valves and subsea isolation systems, prevention of smoke entry into quarters, marking and screening of emergency exit routes, and improvements to firefighting systems.
A vast amount of installation of safety equipment on platforms and design work on projects in development took place while the content of Cullen's report were still not revealed.
Operators followed the progress of the inquiry and tried to anticipate the Cullen report's recommendations, altering their installations and designs as awareness of the forthcoming safety regime grew.
"The experience of Piper Alpha showed that the precise location of an emergency shutdown valve can be critical," Bryan Taylor, director of technical affairs at U.K. Offshore Operators Association (Ukooa), reported in November 1991.
Taylor said companies had checked the location of 400 emergency shutdown valves since Piper Alpha and repositioned 150 as a result. Added protection from fire and falling debris was installed where necessary.
In some cases, a second line of defense in the form of subsea isolations was thought necessary, particularly when installations employed large diameter gas pipelines.
Prior to Piper Alpha, only 10 subsea isolation systems had been installed in the North Sea, Taylor said.
After Piper Alpha, operators carried out safety assessments to determine the need for further subsea isolation equipment. As a result, another 57 systems were installed at a cost of more than 250 million ($375 million).
THE CULLEN REPORT
Cullen's report made 106 recommendations on how offshore oil and gas installations should be built and operated. Those recommendations were central to new offshore legislation adopted by the U.K. government.
Of the recommendations, 57 were for HSE to implement, 40 were for operators to deal with, eight were for the whole industry and in practice Ukooa, and the remaining one was for the Standby Vessel Owners Association.
Cullen's central recommendation was that operators should be required to provide a safety case for every offshore installation under their control for approval by HSE.
The safety case was to be a document setting out how the installation met safety requirements and how it would be operated in a safe manner.
A safety case was required to prove that major hazards had been identified and appropriate safety measures taken, a temporary safe refuge was in place with facilities for escape and rescue, and an adequate permit to work system was ill operation.
HSE said the burden is on operators not only to operate installations safely but to be able to show they can do so. If HSE does not approve a safety case, the installation must be shut down.
Besides large oil and gas production and other platforms, the legislation applies to not normally manned platforms and loading buoys, offshore drilling rigs, production vessels, construction vessels, and accommodation vessels.
UKOOA VIEW
Ukooa played a central role in coordinating operators' response to the Cullen report. During preparation of offshore safety legislation flowing from the report, Ukooa was involved in informal consultations with HSE.
Ukooa also prepared guidelines for member companies on submission of safety cases, including drafting of a procedure for preparation of a formal safety assessment document.
"The preparation of a safety case for an offshore production installation is a long and painstaking task," Taylor told the Offshore Europe conference in Aberdeen last September.
"It takes thousands of man hours and costs about Fl million ($1.5 million). This is just the start, however, because the purpose of the safety case is to identify measures that will reduce the risk of accident to as low as reasonably practicable.
"The total cost of implementing the safety improvements identified by the safety cases is uncertain because safety expenditure is an integral part of the business and not normally separately identified.
"The industry expects the total to be in the range 2 5 billion ($3 7.5 billion) in addition to the 1 billion ($1.5 billion) spent immediately following the Piper Alpha disaster."
One of six projects volunteered for safety case trials was Miller field, developed by BP Exploration Operating Co. Ltd. the field went on stream in 1992 after a 1.3 billion ($1.95 billion) development program.
Project director Ken Allison said in 1991 that post Piper safety measures on Miller platform would cost an extra 35 million ($53 million) in materials and equipment, with a further 15 million ($23 million) for project management and overheads.
Blast protection and segregation of modules on the platform were largely responsible for increasing topsides weight to 29,000 metric tons from 27,000 metric tons.
Taylor said there were many things for the industry to do immediately after the Cullen report was published. Ukooa appointed a team of eight managing directors from the largest member companies to oversee a number of working groups.
He said, "Safety and responses to the recommendations have been Item 1 of every Ukooa council agenda since then. Every one of Lord Cullen's recommendations which were for industry action has been acted upon, and most have been implemented."
SHELL'S EXPERIENCE
Shell U.K. Exploration & Production (Shell Expro), the operating company owned 50 50 by Shell U.K. Ltd. and Esso U.K. Ltd. and operated by Shell, had 29 safety cases to complete more than any other operator.
Ken Watson, head of Shell Expro's Cullen implementation team, said each safety case document was 300 400 pages long, unique to an installation, taking months or thousands of man hours to complete, and costing 1 1.5 million ($1.5 2.25 million) to produce.
Each installation also required an average outlay of about 20 million ($30 million) on remedial work identified during development of the safety case.
Shell was one of the six operators to provide "guinea pig" safety cases. Shell decided to volunteer its Cormorant A platform as an example of a first generation fixed platform.
"Cormorant A, being such a complex installation, was the obvious choice," said Bill Campbell, platform manager. "Produce a safety case for a platform like Cormorant A and you have a model for all the rest."
Campbell said Cormorant A was possibly the most complex platform in the U.K. North Sea because of its range of facilities. Besides being a production platform and controlling, a subsea manifold center and individual remote wells, it is the main pump station for the whole Brent pipeline system. It also is Shell Expro s air traffic control and telecommunications center for the East Shetland basin and home for the northern North Sea's search and rescue service.
Shell Expro's improvements to platform safety prior to safety case submission began with providing more breathing apparatus to aid evacuation from the accommodation section in the event of a fire.
Depressurization facilities were improved, and explosion venting in specific modules was upgraded. Emergency response procedures, firefighting teams, and evacuation procedures were reorganized.
Throughout preparation of the safety case, the workforce was briefed and consulted in regular safety meetings.
"They all have to be deeply involved and aware of the implications of the safety case," Campbell said. "It is important for us to build understanding and get the message across that the safety case is a tool to ensure the installation is safe to remain in operation."
CONOCO'S PROGRAM
One of the most complex safety cases to prepare covered the Lincolnshire Offshore Gas Gathering System (Loggs) operated by Conoco (U.K.) Ltd.
Loggs involves a central gathering station of four platforms with a 36 in. export trunk line to Conoco's onshore gas terminal at Theddlethorpe, nine satellite platforms including some operated by other companies, and two subsea developments.
Conoco operated platforms in the Loggs complex are in the "V fields" in Quadrant 49: North Valiant 1 and 2, Vanguard, South Valiant, and Vulcan 1 and 2. Conoco recently expanded Theddlethorpe terminal, which now processes gas from 12 fields (OGJ, Nov. 29, 1993, p. 37).
Ranger Oil (U.K.) Ltd. operates Loggs satellite Anglia platform on Block 48/18b. Phillips Petroleum Co. U.K. Ltd. operates the Block 48/15 Audrey field satellite, made up of two platforms and a subsea well development, and Ann field subsea development on Block 49/6a.
Conoco decided the best way to prepare safety cases for such an intricate development, with its combination of manned and unmanned platforms, was to base the cases on the span of control of particular offshore installation managers (OIMs).
Production, compression, riser and compression platforms that make up the Loggs central gathering station, plus North Valiant 1 platform, are bridge linked and controlled by one OIM.
"Thus, a single safety case for the operation of a fixed installation was applied to this arrangement," Alaister McIntosh, Conoco's manager of safety, environment and quality affairs, told Offshore Europe.
Five Conoco operated V fields satellite platforms are controlled from Loggs when unmanned but maintained by a shore based crew for all manned intervention.
A safety case was prepared for the operation of the satellites in their manned mode, McIntosh said. Because of the similarity in design and layout of the platforms and because the same management system is applied to them all, a single safety case is used.
A third operating mode for satellites occurs during drilling operations. These are carried out by jack up rigs cantilevered over the satellite platform.
McIntosh said this adds two safety cases to the equation one for a mobile installation and one for the combined operation of the two installations working together.
Other arrangements are needed for the third party Audrey and Anglia satellites. Phillips and Ranger respectively, operate the platforms, but Conoco provides day to day operating services and maintenance visits.
McIntosh said, "Phillips and Ranger had to prepare and submit these safety cases, but there is obviously a considerable Conoco input.
"The Conoco safety management system clearly plays a big part and Conoco has to ensure that the risks to its personnel have been reduced as low as reasonably practicable."
An added complication was the fact that Phillips and Ranger manage drilling operations on Audrey and Anglia respectively. Hence, combined operations and mobile installation safety cases were required for each platform.
Conoco got around this problem by preparing an interface document for the two installations to "...describe the various safety management linkages." Conoco prepared the Loggs safety case using Ukooa's guidelines.
"It is important to remember," McIntosh said, "that the safety case is a written demonstration of a safe system of work, supported by the evidence of reference material relevant to the fluency of the demonstration.
"It is primarily a document for the operator's use, to show to itself that it has established and is operating a safe system of work. The secondary purpose is to pass this demonstration on to the regulatory body, the HSE."
AMOCO'S EXPERIENCE
Amoco (U.K.) Exploration Co. is operator of 21 North Sea installations, including Northwest Hutton, Montrose, and Arbroath oil fields, Leman, Indefatigable, Lomond, and North Everest gas fields, and the Central Area Transmission System (CATS) pipeline.
Field installations vary in size, complexity, and age, ranging from large oil and gas production platforms, through multiplatform gas production, compression, processing, and terminal complexes, to single not normally manned gas production platforms.
In 1988, an Amoco task force made up of senior engineers and safety specialists reviewed the production operations and facilities, Norman Wong, Amoco safety manager, told Offshore Europe.
The team identified areas from which a series of safety enhancement studies were carried out. These qualitative studies developed into offshore modifications.
In 1990, Amoco relocated 44 emergency shutdown valves on pipeline risers, installed a pipeline subsea isolation valve, upgraded fire protection systems, and upgraded evacuation, escape, and rescue facilities.
Wong said, "This work subsequently proved a valuable source of information and ideas for the safety case development project."
Upon publication of the Cullen report, Amoco reviewed the effectiveness of its safety systems and prepared a framework for managing and monitoring safety as the basis for safety cases.
Among changes Amoco made were improvement of the permit to work system and adoption of the same system on all installations, establishment of a management system for safety and operational documents, and development of a procedure for plant modifications to incorporate hazard and operability studies before implementation.
The task of completing safety cases was assigned to a team made up of Amoco coordinators, safety consultants, the document publisher, and the engineering contractor.
The team identified its key customer as the offshore workforce and produced an execution plan that included project goals, strategies, and objectives.
Amoco took a top down approach to hazard studies, assessing worst case scenarios first for each installation. Hundreds of possible hazards were scrutinized.
In depth quantitative risk assessments were undertaken in some cases, although not all cases because of the amount of assessment required and the short time available. The aim in all risk assessments was to err on the side of caution.
Wong said, "No hazard identification process can ever be entirely complete, and a certain degree of conservatism is appropriate to allow a safety margin for specific hazards that may have been missed.
"The margin of conservatism is most important where there is most uncertainty that is, for major accidents."
Wong said Amoco's safety cases were written in a clear, consistent format, with a level of detail that everyone could understand.
"Also," he said, "it was important to demonstrate that risk assessment, a new subject to many, was a credible and useful method to support decisive hazard management."
Wong said total risk to offshore personnel involves major hazards, occupational hazards, and hazards of helicopter transport. Other risks differ according to the type of installation. On a not normally manned installation, for example, helicopter transport is likely to be a more significant risk than major hazards.
"Early, in the project it was realized there is no one component of a safety case more important than the other," Wong said. "There are so many linking components that everything tends to be connected to everything else."
The entire safety case process was developed in a short time in very dynamic conditions, Wong said. This included 1990 92 when draft regulations were issued for consultation, and the industry's expectations were unclear.
Only minor revamps were needed to make the company's documents conform to the new regulations.
AMERADA'S EXPERIENCE
Another safety case guinea pig was the Ivanhoe/Rob Roy development in Block 15/21 operated by Amerada Hess Ltd. This is a tandem development of three small oil fields by means of two multiwell subsea manifolds and a single well tied back to a converted semisubmersible production vessel known as AH001.
Ivanhoe/Rob Roy reserves are estimated at 130 million bbl of oil and 70 bcf of gas. Oil is sent to Claymore platform and on to Flotta terminal, Gas is piped via Tartan platform to St. Fergus.
A single well development, the 3 million bbl Hamish field on the same block, was tied back to Ivanhoe/Rob/Roy in 1990. Amerada Hess began preparing a safety case for AH001 in early 1991, submitting the voluntary, safety case in January 1992.
"In general we had a good starting point: the AH001," said John Spittal, facilities engineering supervisor for Amerada Hess. "The AH001 is a conversion of a Sedco 700 series semisubmersible vessel which, for the purpose of certification, is now designated a fixed floating production facility."
Main process, power, and utility plants are on the AH001 main deck. Production and test separators are on a mezzanine platform above these.
The vessel is moored midway between subsea manifolds in Ivanhoe and Rob Roy fields. It is connected by flexible risers to a subsea riser base manifold, which in turn is connected by flow lines to Ivanhoe and Rob Roy production manifolds.
"The design has a number of inherent features which assisted the safety, arguments," Spittal said. "Wells are remote from the production facility, it is not a 'high rise' development, and design changes were incorporated post Piper Alpha, prior to first oil."
Spittal said the safety case for AH001 had two main elements: the safety management system and safety assessment.
The safety management system was based on practices developed with Amerada Hess. It is a goal related policy and sets out an ideal against which safety management performance can be measured.
Safety assessment included identification of potential hazards on AH001. It set out to justify the adequacy of design and operational controls.
Spittal's team honed the list of AH001 hazards to fire, explosion, or release of a dangerous substance, major damage to the installation or loss of stability, helicopter collision, failure of diving life support systems, detachment of a diving bell, or trapping of a diver, and any other event killing or injuring five or more crew members.
Evaluation of the hazards resulted in Spittal focusing on two types: loss of containment and dropped objects.
Thirty six loss of containment scenarios were identified and their consequences studied. These included equipment failures, human errors during filter replacement or pigging, and process faults.
Dropped object studies covered subsea and topsides accidents. AH001's single deck structure meant relatively few lifting operations were required other than those using the vessel's two pedestal cranes.
The safety team concluded that only loads dropped onto flexible risers threatened the AH001. Possible causes included crane load transfers between supply vessels and AH001 and diving activities.
An in house team studied on deck load transfer routes, load types, and weights and movements frequencies. As a result, passive fire protection was installed on production and test separators, and ris levels were lowered by rerouting loads and improving loading procedures.
"All hazards with the potential to cause a major accident have been identified and their risk evaluated," Spittal said. "Engineering and procedural upgrades have been identified and targeted as the dominant contributors to the risk.
"While these improvements have been sanctioned on the basis of a clear and substantial benefit in risk reduction or on the grounds of good safety and loss prevention practice, a formal 'as low as reasonably practicable' assessment has also demonstrated their cost effectiveness."
Spittal said further upgrades to AH001 are unlikely to provide significant reduction in risk in line with costs.
NEW INSTALLATION
BP Exploration was first to submit a design safety case to HSE, The subject was Block 16/27a Andrew field, which BP intends to place on stream in October 1996.
Andrew's estimated reserves are 112 million bbl of oil and 134 bcf of gas. A steel jacket and integrated topsides will make up production facilities. Nearby Cyrus field will be tied back as a subsea satellite.
BP said the aim of the safety case is to demonstrate to HSE that the design is inherently safe and risks to the workforce have been made as low as reasonably practicable.
"We considered all HSE requirements and have in place a management system which will ensure that they will be managed from design through to operation," said BP safety team leader John Allinson.
Preparation of the Andrew safety case involved hazard identification, assessment of human factors and wind tunnel modeling. HSE now has to issue notices covering any items it thinks will affect safety.
These will be incorporated in the safety case before construction to avoid costly modifications.
For projects entering the design stage after the May, 1993 cutoff point, HSE requires safety cases to be submitted for assessment at least 6 months before oil or gas production is anticipated.
HSE JUDGMENT
Barrell said HSE's assessment process will ensure that any issues that could lead to rejection of a safety case are flagged at the earliest possible time. This will be done by means of an issue note that will summarize HSE's concern and raise a specific question to which the operator must reply.
Barrell said, "In no instance will a safety case be rejected without the duty holder having first had the opportunity to resolve matters raised by HSE in issue notes."
In addition, a high level forum for feedback on emerging issues has been established between Ukooa's operations committee and the heads of OSD's operations and technology branches.
Each safety case will be handled by one OSD case manager. After the issue note procedure is complete, the case manager will recommend acceptance or rejection of the safety case based on the operator's response to any issue notes raised.
Barrell said, "Rejection of the case can arise only if issue notes already sent to the operator remain unresolved. The decision will be communicated to the operator and the installation work force in writing."
Operators can request a review of a safety case in the event of a rejection by OSD. The review will be carried out by the HSE director general and two deputies, although the installation's safety representatives will be invited to present their views on the case.
Barrell said the plans cover work schedules that will allow completion of the assessment of safety cases for existing installations by September 1994. This wig allow HSE to deal with any reviews of rejected cases before the end of the transition period."
ASSESSMENT PROGRESS
"Most companies are being extremely cooperative during our assessment," Barrell said. "This is essential. Without this cooperation it would not be possible to carry out a full assessment as effectively and promptly as the safety cases deserve."
Barrell said many of the safety cases were submitted with clerical errors. Some had pages or whole sections missing or in the wrong order, while some were submitted without being approved by a company representative.
"While these errors are easily remedied, the lack of attention to detail may, and I stress may, indicate how the company approaches their business more widely," Barrell said.
However, he was reassured by the way operators and owners were making decisions on risk reduction based on their safety cases: "It is the work put into preparing the case, and the actions taken because of it, that is as important as the case itself."
Barrell said it is too early to speak of technical problems arising from the assessments, apart from those of which the industry was aware. These include smoke and gas ingress, provision of temporary refuges, and "as low as reasonably practicable" definitions in risk analyses.
SAFER NOW?
Ukooa's Taylor asked the Aberdeen conference: Is the offshore industry safer now than it was before Piper Alpha?
"The answer is yes," he said, "because of the many actions that have flowed from the Cullen report and the steps taken throughout the industry to achieve further changes in attitude and a better understanding of and reduction in the risks which are seen as an inherent part of offshore operations."
Without an absolute scale, it is not easy to prove safety has improved. But, Taylor said, the frequency rate of all injuries is an appropriate guide.
"This is a simplistic measure, but many safety professionals share my view that it is only by reducing the all injuries frequency rate that serious injuries and fatalities will be reduced and eventually eliminated."
Taylor said the figures, produced each year by the Health and Safety Commission, showed an encouraging reduction in the frequency of injuries during the past 10 years.
"This is a better record than is achieved by other comparable industries such as coal mining, metal manufacturing, and construction," Taylor said. "There is no room for complacency, however, as there is scope for further improvement."
Copyright 1994 Oil & Gas Journal. All Rights Reserved.
