Copyright 2005, Society of Petroleum Engineers This paper was prepared for presentation at the SPE Asia Pacific Health, Safety and Environment Conference and Exhibition held in Kuala Lumpur, Malaysia, 19–20 September 2005. This paper was selected for presentation by an SPE Program Committee following review of information contained in a proposal submitted by the author(s). Contents of the paper, as presented, have not been reviewed by the Society of Petroleum Engineers and are subject to correction by the author(s). The material, as presented, does not necessarily reflect any position of the Society of Petroleum Engineers, its officers, or members. Papers presented at SPE meetings are subject to publication review by Editorial Committees of the Society of Petroleum Engineers. Electronic reproduction, distribution, or storage of any part of this paper for commercial purposes without the written consent of the Society of Petroleum Engineers is prohibited. Permission to reproduce in print is restricted to a proposal of not more than 300 words; illustrations may not be copied. The proposal must contain conspicuous acknowledgment of where and by whom the paper was presented. Write Librarian, SPE, P.O. Box 833836, Richardson, TX 75083-3836, U.S.A., fax 01-972-952-9435. Abstract Alexander Keilland (1980), Ocean Ranger (1982), Piper Alpha (1988), P36 in Brazil (2001) and a recent major blowout (H2S release) in China (2003) are all well-known examples of incidents that have resulted in major loss of life.

The Safety Management Systems the industry utilises should be equally applicable to the management of all types of risk: from the high frequency, low consequence ‘slips, trips and falls’ to the rare, high consequence incidents. However, the review of past major incidents has shown that the complexity of the failure path is such that questions arise as to how adequate a traditional SMS based approach is to managing these types of incident.

This paper presents some of the major challenges associated with managing major incident risks. It draws upon the findings of a recent workshop organised by the International Association of Oil and Gas Producers (OGP) that specifically addressed key challenges in this area, and identified issues that warrant further review and development. Introduction Alexander Keilland (1980), Ocean Ranger (1982), Piper Alpha (1988), P36 in Brazil (2001) and a recent major blowout (H2S release) in China (2003) are all well-known examples of upstream related incidents that have resulted in major loss of life. They form a class of incidents that are often referred to as low frequency, high consequence; as opposed to the high frequency, (relatively) low consequence incidents that dominate in the E&P industry’s safety statistics [1].

The Safety Management Systems (SMS) the industry utilize, and the risk assessment and management process within them, should be equally applicable to all forms of risk: from ‘slips, trips and falls’ to the rare, high consequence events. However, the frequency with which major incidents and near misses occur suggests that more can be done to

improve the assessment and management of such events. Investigations into major incidents show complex events paths, typically incorporating the failure of many safety barriers. The question that arises is: how adequate are the traditional SMS based approaches at identifying, assessing and managing these complex scenarios?

Clearly what differentiates a minor incident from a major incident may be as simple as the failure of a single, additional safety barrier.

Further, within the Exploration and Production (E&P) industry the risk profile is continually changing. Increasingly deepwater and hostile environments, more challenging wells, ageing facilities and general advances in drilling and production technology and systems, all have associated risks that organisations need to be able to assess and manage.

Managing any process is simplified if performance (output) can be measured. In the safety arena, the number of recordable injuries, lost time injuries and certain classes of fatalities (eg vehicle related) is such that the need for, and to a lesser extent the influence of any change can be measured. Not surprisingly, organisations will often focus effort in areas where improvement can be demonstrated. The nature of major incidents risk is such that performance data are difficult to measure, and as such the precursors to these types of incidents may not be identified in advance of an incident occurring.

This paper reviews a range of issues associated with understanding and managing major incident risks. Initially, major incidents are separated into two classes in order to help recognise the different processes needed to manage different types of major incident hazards. The paper then considers some of the challenges associated with identifying key performance indicators relevant to managing major incident risks. Finally, the paper reviews the outcomes of an industry workshop aimed at identifying the key challenges faced by the industry in improving its approach to managing major incident risks. Major incident definition Within this paper a major incident is defined as an event that results, or has a significant potential to result in large numbers of fatalities (to company or contractor personnel, or third parties). Within the upstream industry the most obvious examples of major incidents include hydrocarbon related fires and explosions, structural failures and H2S emissions.

Incidents that result in few fatalities with little or no escalation potential, are not the focus of this paper; albeit that

SPE 96250

Managing Major Incident Risks Don Smith, SPE, International Association of Oil and Gas Producers (OGP), Volkert Zijlker, Shell International Exploration and Production, BV. (Chairman of the OGP Safety Committee)

2 96250

many of the issues and tools needed to manage risks associated with such incidents are similar to those used to manage major incident risks. Equally, while both aviation and vehicle related incidents may result in multiple fatalities, they are not considered here; the industry has dedicated efforts relating to both these areas of risk [2], [3].

In order to better understand major incident risks and how they can be managed, it is of value to further classify major incidents. Within this paper two classes of major incident are defined:

Class 1 Major Incidents. These are incidents in which (typically) a series of safety

barriers have failed. They may include:

• Failures in the permit to work system • Failures in the control of change procedures • Failures in the system of supervision • Human factors related failures • Hardware failures

Investigation into such incidents will often highlight

failures in the organisations SMS (and/or that of its contractor) lack of visible leadership commitment, a poor safety culture within the worksite, and human factor failures. In fact, many of these issues define the conditions necessary for this class of incident to occur.

Incidents such as Piper Alpha, Alexandra Keilland and the P36 incident fall within this class.

Class 1 incidents generally occur during operational or maintenance activities, where there is likely to be a strong human factor element present.

Class 2 Major Incidents. These relate to failures that are, in effect, designed into the

system or are related to external influences. Examples of such failures include the failure of an offshore installation exposed to extreme weather conditions or seismic activities outside of its original design envelope, the failure of a pressure vessel (and subsequent hydrocarbon release) due to material imperfections (of certain types) or a passing vessel collision.

There are many examples of these types of failure. Recently within the Gulf of Mexico a number of offshore structures failed as a result of the passage of Hurricane Ivan [4]. However, a policy of evacuating platforms prior to the arrival of a hurricane reduced the direct impact of these particular incidents to financial losses.

It is important to recognise that for this class of failures, the primary risk control measures are built into the system at the concept selection, design, fabrication and installation phases. Typically, the safety factors associated with, for example, the design of a particular piece of equipment, structure or mitigation measure (eg the deluge system) is incorporated into design codes and industry guidelines.

This class of major incidents is not driven by operational considerations (ie they do not necessarily require operational failures to be realised, and may occur even if a system is operated in accordance with the design requirements). Further, the ‘real time’ human factor element is unlikely to

play a major element in such failures; although due account needs to be taken of human factor issues that arise from the concept selection to installation phase.

The risks associated with Class 2 hazards can never be reduced to zero; the variability in the strength of the components (eg due to material imperfections) and the uncertainty in the load to which the component is subjected, results in a residual risk of failure (Ref: Figure 1). For example, for a typical modern fixed jacket structure, the risk of structural failure due to environmental overload is expected to be around 1e-5 to 1e-6 per annum.

0

0.02

0.04

0.06

0.08

0.1

0.12

0.14

0.16

0 50 100 150Load/StrengthPr

obab

ility Strength

Distribution Load Distribution

Failure Zone, where load exceeds strength

Figure 1: Load and Strength Distributions and Residual Risk

Hence, while the risk of a major incident occurring can be reduced to an extremely low level, it can never be eliminated. Further, while it is clear that the probability of any individual installation failing is extremely low, the risk of any one in a population of structures failing increases as a function of the number of installations.

This concept is readily (and relevantly) extended to individual hardware components within a system, and as such to certain aspects of the Class 1 incidents. However, while it is difficult to mitigate the failure of a large structural component (such as an offshore installation) the failure of sub-components (eg a valve) can usually be effectively managed such that a major incident does not arise.

A further extension of the concept is to human factors issues; when exposed to a range of stimuli, different individuals will respond differently, and on occasion in a manner that will initiate a failure.

Combined failures Clearly, on occasion an incident will fall within both

classes. For example a problem introduced at the design phase may be the initiating event or a major contributor to a major incident.

96250 3

Managing Major Incident Hazards The key stages in managing risks associated with E&P activities are shown in Figure 2.

Hazard Identification

Risk Assessment

Identify Risk Reduction Options

Set Functional Requirements

Figure 4: Key Stages in Risk Management A range of tools is available for addressing each of these stages [5]. It is of value to consider how the two different classes of major incident risks make use of the above process, and the challenges that arise.

Managing Class 1 Major Incident Risks While identifying the hazards is relatively straight forward,

identifying and assessing all the scenarios with the potential to result in a Class 1 major incident is, in practice, impossible. In a complex workplace, if sufficient safety barriers are allowed to fail, there are too many scenarios to consider. As such, the primary focus of Managing Class 1 risks needs to be on managing the individual safety barriers that, if they fail, contribute to the likelihood of an incident occurring.

The individual safety barriers fail relatively frequently; an estimate of this frequency of failure being the number of ‘minor’ incidents an operation is recording. Most of the incidents indicate some form of failure within the Safety Management System; whether it relates to, for example, poor supervision or inadequacies in the permit to work requirements.

For a Class 1 major incident to occur, not only do a number of safety barriers need to fail, they need to fail in a manner that will lead to an escalation in the severity of the incident. While individual safety barriers fail relatively regularly (as manifest by the number of minor incidents reported) the combination of failures necessary to result in a major incident occur extremely rarely. In fact, the SMS should be capable of recognising and addressing the failure of individual safety barriers.

A large human factor influence complicates the assessment of the Class 1 risks. Not only do individuals need to be considered as an influencing factor at any stage of the development of an incident (ie contributing to the escalation of an incident) they play a key role in preventing the escalation and mitigating the impact of an incident. Incorporating human factor issues into risk assessments, where the focus is on

reducing the risk to a level that can be demonstrated to be acceptable, is extremely challenging and warrants further consideration.

The functional requirements related to managing Class 1 risks in practice have to focus on high-level aspects of the SMS: for example, having in place adequate operational and maintenance procedures, supervision of activities, ensuring the permit-to-work system is correctly operated, etc..

Managing Class 2 Major Incident Risk The Class 2 risks are managed primarily by ensuring that

the reliability of the component or structure is such that in all but the most onerous of loading conditions, or the least favourable strength conditions, the structure will survive. For many Class 2 risks, the hazard cannot be controlled or substituted (eg a fixed offshore installation will need to survive whatever environment it is exposed to). Some Class 2 risks are controlled by a combination of design and operational requirements; an offshore structure will be designed to survive a certain level of ship impact, however operational controls will be used to attempt to ward off approaching vessels.

The Class 2 risks will be controlled initially at the concept selection and design phase. The concept chosen to exploit the reservoir will drive many of the subsequent Class 2 risks. At one extreme, the choice of an unmanned facility has potential to reduce greatly the risk to personnel, at the other extreme, a complex, manned, offshore facility will require a comprehensive range of tools to be used to manage the arising risks.

During the design phase various tools will be used to deliver a safe solution, with codes and standards forming the basis of many aspects of system design. Through their use the designer attempts to ensure that acceptable levels of reliability (and safety) are achieved. However, in applying these codes and standards, and undertaking the detailed design, the potential for errors to be introduced needs to be managed.

For more complicated systems detailed modelling may be undertaken to arrive at a design that satisfies both safety and operational requirements. Usually a direct approach will be taken to managing each hazard; for example the structure will be specifically designed to withstand an extreme environment and a passing vessel of a given speed and mass.

Other risks need to be managed during the design phase. Limitations in the underlying data or knowledge of the environment, human error, software/modelling issues, all have the potential to result in a design that does not satisfy the original requirements. In this respect, the Class 2 risks differ from Class 1 risks insofar as there is time to address these issues before the facility, system or component becomes operational. A primary risk control measure is to use independent competent organisations (eg Certifying Authorities) to the verify the design details.

Once the facility is operational, many of the Class 2 risks are managed through procedures such as planned maintenance, inspection (eg of fatigue) and change control. Lifetime extension and ageing facility issues are areas that require most of the same risk management tools as applied to other Class 2 risks.

4 96250

Key Performance Indicators The E&P industry has long recognised that in order to effectively manage safety, different types of key performance indicators (KPIs) need to be measured, and corrective actions taken based on these indicators. Traditionally the industry has relied on lagging indicators such as fatal accident rate (FAR) lost time injury frequency (LTIF) and total recordable incident rate (TRIR). These indicators are extremely valuable in managing the types of incidents to which they relate. Hence, a measure of the number of medical treatment cases an organisation has experienced in the previous years should assist the organisation to identify whether more needs to be done to avoid these types of injuries. Where the value of lagging indicators becomes less clear is where one type of indicator is used to infer safety performance in an unrelated area.

Lagging indicators work well in an environment where ‘large’ volumes of incident data are produced that can be attributed to specific causes. Within any single organisation it is unlikely that significant number of incidents (particularly LTIs or fatalities) will occur such that problem areas and trends are identified and addressed quickly. However by the sharing of incident data through initiatives such as the OGP safety report, organisations can improve the volume of relevant data on which to plan their safety initiatives.

Low frequency, high consequence incidents are, by definition, unlikely to provide much lagging indicator data that can be used to focus management effort. This lack of data forces alternative approaches to be used to provide the relevant KPIs.

Use of FAR, LTIF, TRIR as a Major Incident Indicator The Class 1 incidents are typically associated with the

failure of a number of safety barriers, associated with which there is a strong human factors element. The same safety barriers, when they fail in isolation, may result in a minor injuries or individual fatalities. For example, a safety barrier defined as ‘a good safety culture’ if failing, may be expected to increase the likelihood of ‘minor’ injuries, and contribute to the possibility of a major incident occurring. Hence, theoretically at least, there should be a relationship between KPIs such as FAR, LTIF and TRIR and the potential for a major incident. However, when detailed incident data are available, it appears that the relationship between different levels of incident, specifically LTIs and fatalities, is difficult to quantify.

Figure 3, taken from a report by the US Bureau of Labour Statistics shows the number of lost time incidents per fatality, in the US, in 2001. The incidents are separated into ten categories ranging from assault and violent attacks, to a category including repetitive strain injuries and over exertion. On the right of the figure are the low consequence incidents that form the bulk of the data. The likelihood of a fatality occurring associated with these types of incident is remote (typically greater than 1: 1000). On the left of the figure are incidents that have a higher potential to result in a fatality (around 1:20). These include violent attacks, fires and explosions and vehicle related incident.

If all the LTIs shown in the figure were combined to give a single (leading) KPI related to the potential for a fatality, it

The Incident P yramid - Number of LTIs per Fatality - varies per Business Activ ity ref: US - B ureau of Labour Statistics - year 2001 data (exclusive Sept 11 events)

19 20 27 137 138 173

261

496777

2773 13046

1

10

100

1000

10000

100000

Assault and violent acts Fires and

explosions Transportation incidents Exposure to

harm ful substances(elec, tem p,

chem icals, O2def)

Fall to lowerlevel

Caught inequipm ent,

object orcollapsingm aterial

Total Struck byfalling or flying

object

Other contact w ith objects

and equipm ent Slips, Tripsand Fall onsam e level

Othersoverexercion,rep m otion etc

LTIs/Fat

Figure 3: Incident Ratios

96250 5

would represent a poor indicator. The large number of high frequency, low consequence incidents, would dominate its value1. Figure 3 suggests that by factoring LTIs based on their categories, a more accurate indicator of the potential for a fatality could be produced. An obvious factoring is based on the ratio of fatalities to LTIs. This concept could be extended to a KPI relevant to major incident risk; albeit that further work would be required to establish the appropriate factors to apply.

Each year OGP collects, analyses and reports safety data on behalf of its members. The 2004 report [1] was based on approximately 2.3 billion workhours of data, submitted by 37 companies, from their operations in 78 countries. Included in the data were 2371 lost time injuries. If the distribution of LTIs in the OGP data is similar to that in Figure 3, it is clear that few, if any of the OGP data are likely to be related to events that have any significant potential to result in a major incident. Hence, while it is important to manage the hazards that lead to LTIs, the number and rate of LTIs in themselves represents a poor indicator of the likelihood of a fatality, let alone a major incident.

Class 2 Lagging Indicators Implicitly, lagging indicator data represent an important

input to the management of the Class 2 risks. Design codes and standards are, on the whole, based on operational experience. A good example is the API series of fixed structure Recommended Practices (currently in its 21st Edition) [6]. The failure of Gulf of Mexico structures (designed on the basis of early editions of the Recommended Practice) has driven the inclusion of more stringent provisions with the updated editions, and on occasion the need to revisit earlier designs.

Similarly, the failure of systems and components has driven changes in related design practices, inspection and maintenance regimes.

However, while this type of approach works well in an environment where the consequence of failure is considered acceptable (eg limited to financial loss) where fatalities or environmental damage may occur a more proactive risk indicator is desirable.

Leading Indicators Ideally, what is required is a leading indicator of the

potential for a major incident to occur. While combining lagging incident data as outlined above may provide a general indication, of more value would be an indicator that more closely measured the adequacy of the safety barriers that, if they fail, could cause or contribute to a major incident occurring.

For the Class 1 incidents, the performance of individual barriers can be measured (either proactively or reactively) and a model developed to provide a leading KPI for the worksite. This type of approach has been promoted within Norway [7].

Indicators considered include: • Non-ignited hydrocarbon leaks • Ignited hydrocarbon leaks

1 While the figure shows only ratios of fatalities to LTI, the categories to the right of the figure traditionally form the majority of incident datasets.

• Well kicks/loss of well control • Fire/explosion in other areas, flammable liquids • Ships on a collision course • Drifting objects • Collision with field-related vessel/installation/shuttle

tanker • Damage to platform

structure/stability/mooring/positioning errors • Leaks from subsea production facilities/

pipelines/risers/flowlines/loading buoys and hoses • Damage caused by fishing gear to subsea production

equipment/pipeline systems/diving equipment • Evacuation (precautionary/emergency) • Helicopter crashes/emergency landings on/near an

installation • Man overboard • Personal injuries • Occupational illness • Total power failure • Control room out of operation • Diver accident • Hydrogen sulphide leak • Loss of control with radioactive source • Dropped objects

The applicability of this type of approach to other regions

and operations is currently being considered within OGP.

Class 2 Leading Indicators The nature of the Class 2 hazards is such that risk

assessment can be consistently applied at any time to provide an up-to-date leading indicator of the potential for a major incident to occur. For example, at the design stage structural reliability analysis can be used to estimate the probability of failure of the structure due to environmental overload. Then, using up-to-date structural and environmental data, the analysis can be repeated and an updated risk indicator estimated.

The limitation of this approach is that it assumes a certain level of knowledge of both the loading environment, and the ability of the structure or component to withstand the loading. If a loading scenario is not adequately recognised or considered (eg a seismic event occurring in a region not considered to be active, or limited knowledge of the metocean environment is available) then the resulting risk indicator will be of limited value.

Near-miss (significant incident) data Of course, potentially the greatest source of information

that will assist E&P organisations to manage their major incident risks is relevant near miss data. Through initiatives such as the OGP Safety Zone (incident alerts) and a dedicated OGP Task Force addressing safety data issues, it is expected that improvements in the quality and quantity of significant incident data will be realised.

6 96250

In conclusion, it appears clear that further work is required to identify KPIs that give a reliable indication of the potential of a major incident occurring. Preventing the Next Major Incident. Review of OGP Safety Workshop, Helsingor, Nov, 2004 In order to focus the industry’s attention on managing major incidents, in November 2004, OGP organised a workshop to review the issue and identify the actions required to improve the industry’s abilities to manage these types of hazard [8].

Over 80 individuals representing around 50 different E&P organisations, regulators and service providers from around the world, attended the workshop. Organisations shared their experiences in managing major incidents, with the overall intent of identifying how the industry could improve its ability to address this important issue.

Presented below are the key issues arising out of the workshop.

Senior Management Commitment In order to influence both the culture within the workforce,

and to make available the resources necessary to address major incident issues, it is important to ensure that senior management understand the specific challenges associated with managing major incident risks.

Technical Integrity Increased complexity in the installations and systems used

to exploit hydrocarbon reserves (particularly in the offshore environment) and ageing and life extension issues associated with existing facilities, lead to the need to improve our ability to assess the adequacy of the facilities we use.

Human Factors The role of individuals in the initiation and prevention of a

major incident was discussed at length. It was recognised that managing human factors was a key element in managing major incident risks. In particular, good supervision was viewed as an important means of reducing the likelihood of an individual carrying out an incorrect operation. However, it was also recognised that on occasions, the administrative burden placed on supervisors was such that it severely impacted the time they had available to spend directly supervising activities. While it is clear that some level of administration is inevitable, further work is necessary to ensure that an appropriate balance is achieved.

The culture of the workforce is strongly influenced by the direction given by senior management with respects to safety. A need existed to provide tools to assist senior managers to communicate their safety requirements to the workforce.

Finally, improving the means by which human factors are addressed within risk assessments was recognised as an area requiring further work.

Risk Management It was agreed that the risk management tools currently

employed to identify and manage major incident risks should be reviewed. The ability of such tools to identify and manage the complex paths associated with of many (Class 1) major incidents should be considered.

It was felt that the development and availability of hazard registers and incident descriptions could aid organisations in ensuring that all the key major incident risks have been identified and assessed.

Key Performance Indicators In recognising the limited ability of the existing safety

KPIs to indicate the likelihood of a major incident occurring, the workshop called for work to be undertaken in identifying relevant leading indicators. A particular focus area should be ageing assets and dealing with increasingly complicated facilities and systems.

Other Issues: A range of other issues were identified by the workshop

attendees: • Sharing and learning from ‘high potential’

incidents • Development of auditing guidelines specific to

major incident management • Revisiting the roles and responsibilities between

E&P companies and their contractors • Use of complex technology in remote areas • Managing the balance between risk of non-fatal,

potentially costly incidents and the need to maintain production

• Competence issues (ageing workforce, loss of staff, training issues, etc)

OGP 2006 Safety Theme In order to bring global focus to this important area of risk

management, Managing Major Incident Risks will be the OGP safety theme for 2006. During the remainder of 2005, and throughout 2006, effort will be given to addressing the issues identified through the workshop, in particular in the areas of Human Factors, Risk Management and Key Performance Indicators.

Through the production of a range of products, which may include recommended practices, guidelines, international standards, workshops and conferences, the industry will provide the information that should allow E&P companies and their contractors to further improve their management of major incident risks. Conclusions This paper has reviewed a range of issues related to managing major incident risks. Through the identification of two classes of major incident, the different risk management challenges have been presented.

It is recognised that throughout the global E&P industry major incidents and near misses continue to occur. Whether the rate at which they occur is greater of less than in the past is difficult to estimate. Clearly there is value in attempting to establish an indicator that will allow the industry to measure its performance in this area.

The predictive value of much of the data used by industry to measure its safety performance is recognised to be of limited value in measuring the potential for a major incident to

96250 7

occur. New indicators (lagging or leading) are required that specifically target those elements that are relevant to managing the major accident risks.

Through OGP and other forums, the industry will continue to improve its understanding of major incident risk and develop the tools necessary to manage them. References

1. OGP Safety Performance Indicators 2004. OGP Report No. 367, May 2005, available via http://www.ogp.org.uk

2. Land Transportation Safety Recommended Practice. OGP Report No. 365, April 2005, available via http://www.ogp.org.uk.

3. Aircraft Management Guidelines. OGP Report No. 239, Feb 1998, available via http://www.ogp.org.uk.

4. Ivan the Terrible. Technical Session, Offshore Technology Conference, 2-5th May 2005, Houston, USA.

5. OGP Risk Management Website. http://www.ogp.org.uk/ 6. Recommended Practice for Planning, Designing and

Constructing Fixed Offshore Platforms—Working Stress Design.” Recommended Practice 2A (API RP 2A-WSD), API WSD 21st Edition, API publications, 2003.

7. Risk. Petroleum Safety Authority Publication, 2005, available via http://www.ptil.no

8. Preventing the next major incident. OGP Safety Workshop 4th November 2004, Helsingor, Denmark. Workshop presentations, available via OGP Safety Zone, http://www.ogp.org.uk