Integrated Operations to Reduce Operational Risk - IO … · Integrated Operations to Reduce...

Dr Robin PitbladoDNV SHE Service DirectorSept 12 2011

Integrated Operations to Reduce Operational RiskPost Macondo Considerations7th International Conference on Integrated Operations, Trondheim

© Det Norske Veritas AS. All rights reserved.

Integrated Operations to Reduce Operational Risk

Sept 12 2011

2

DNV and Speaker Background

Dr Robin Pitblado− DNV Director for SHE Risk Management Services− Chemical Engineer involved in process safety since 1978− Work experience – globally− Management system, risk assessment, accident investigation− Lead role in 6 major accident investigations, including P-36− Active involvement in Macondo event and follow-up activities− Reviewer for National Academy of Engineering Investigation− Many publications including – LNG: Risk Based Safety

DNV − An independent foundation since 1864− Objective “safeguarding life property and the environment”− Established in 100 countries with 300 offices− Class, Verification, Advisory to Shipping, O&G and Cleaner Energy Industries



Sept 12 2011

3

Can we manage the cold risks?Macondo Event



Sept 12 2011

4

The Macondo Event: April 20 – July 15, 2010

Outcomes:

- Safety: 11 fatalities / 115 rescued / Rig sinks

- Environment: Largest oil spill in US history

- Multiple inquiries

- Regulatory agency reorganizations

- Many new technical and permitting requirements

Response was tremendous:- US Government & BP and local communities- Houston – 20,000+ people were involved

- Engineering design and review- Fabrication and construction

- Gulf of Mexico − 20,000 fishermen and local people- Vessel booming, burn-off and beach clean-up

- Multiple solutions were worked on simultaneously



Sept 12 2011

Sequence of Macondo Interventions

Between April 20 and July 15 2010:

1. Closing the BOP blind / shear rams and variable pipe rams with ROV (failed)

2. Closing off the end of the drill pipe on the sea floor (succeeded)

3. Capturing oil from broken riser with containment device connected to a vessel above (failed)

4. Capturing oil from the riser end with an insertion tube (partially successful)

5. Capturing oil from the BOP top installing a “Top Hat” and LMRP (partially successful)

6. Killing the well by injecting heavy mud into the BOP (failed)

7. Removing the remnant riser at the BOP top and installing sealing cap (successful mainly)

8. Pumping heavy kill mud into the well to reduce pressure at the well head (succeeded).

9. Pumping cement following the kill mud to permanently seal off the flow paths (succeeded)

10.Two relief wells drilled, 1st well intercepted and permanently sealed the well (succeeded)

5



Sept 12 2011

DNV Active throughout Macondo Event

� Safety Studies- HAZID of intervention procedures (full rigorous process and

close-out of actions)- DNV carried out 50+ HAZID’s

- Flare thermal radiation and dispersion calculations- Multiple vessel flare assessments – all beyond design basis- Water sprays essential for safe operations

- Explosion studies

� Classification studies - Update Class approvals for changed service, increased

hydrocarbon flows

� CVA (Certified Verification Agent) - Riser System design: sea floor to buoyancy can - Flexible from buoyancy can onto vessel- Reviewed as if permanent installation – not just a temporary task

6



Sept 12 2011

7

Can we manage the cold risks?Macondo Investigation Findings



Sept 12 2011

Multiple Macondo Investigations

Already Published1) BP Accident Investigation (Bly Sept ‘10)

2) Adm Thad Allen National Incident Commander’s Report (Oct ‘10)

3) Presidential Panel Investigation (Jan ‘11)

4) DWH Study Group UC Berkeley (3 Interim reports, Final Mar ‘11)

5) DNV BOP Forensic Examination Report (March ‘11)

6) USCG Deepwater Horizon Report (April ‘11)

7) Transocean Macondo Well Incident report (June ‘11)

8) Marshall Islands Casualty Investigation report (Aug ‘11)

Yet to be published1) BOEMRE Investigation (part of Joint Investigation Team – Sept ‘11? )

2) National Academy of Engineering DWH Report ( Sept ‘11)

3) US Chemical Safety Board Investigation (late 2011?)

8



Sept 12 2011

Some Key Findings – Wider Ranging Investigations

� Presidential Panel• “Accident was preventable”• Mistakes by BP, Halliburton, Transocean• Deepwater: Industry + Govt not prepared and fundamental reform needed• Better scientific understanding of environmental impacts needed• Sequence of decisions taken locally / onshore – all of which increased risk without a proper basis

� US Coast Guard• “Accident was preventable”• At time of accident all regulatory requirements were fulfilled• Safety culture in Transocean was too casual• Marshall Islands flag state was deficient• IMO MODU Code needs enhancement - long list of enhancements

� DWH Study Group UC Berkeley• 1st: “Event was preventable”• 2nd: “Deep-rooted organizational malfunction” too much focus on profit• 3rd: Failed to detect HP/HT fluids quickly enough and overcame barriers, risk-taking + cost-cutting• Final – Step-change improvement required

9



Sept 12 2011

Presidential Panel – Decisions Increasing Risk

10



Sept 12 2011

Some Key Findings – More Technical Investigations

BP- 8 barriers failed, mixture hardware and

procedures, blame shared

Transocean- succession of interrelated well design,

construction, and temporary abandonment decisions that compromised the integrity of the well

- BP responsible

DNV- Forensic examination of the BOP

showed why the BOP was unable to stop the flow

Marshall Islands (Flag State)- All regulatory requirements of flag were

met, some limited areas identified for improvement

11



Sept 12 2011

12

Can we manage the cold risks?Role of IO to Reduce Risk



Sept 12 2011

13

What the O&G & Process Industry both has and has not achieved

O&G industry has attained a step changeimprovement in occupational safety

- But: Process Safety is not the same as Occupational Safety

USA and EU Process Industry- Neither EU nor USA has demonstrated significant

improvements for onshore major accidents- (EU = MARS database, USA = RMP* database)

North Sea major accident safety has improved- No major disaster since introduction of Safety

Case legislation in UK / risk based in Norway - (leaks have occurred, but none escalated)

- However, recent performance may suggest a floor has been reached

Different oil and chemicaloperating companies

Trendline

10x improvementIn past 13 years

�

�

�

Graph shows factor of 3 better in last 10 years

Reducing trend in major hydrocarbon leaks



Sept 12 2011

14

Vision – Step Change Improvement for Major AccidentsThe Industry HAS already attained 10x improvement in Occupational Health

DNV believes major accidents can also be reduced 10x – but with different tools1. Revised regulatory regime:

Blend of Prescriptive and Performance-based regulations

2. Address technical, human and organizational factors: Key lessons from past accidents

3. Enhanced risk management approach: Addressing Risks, Controls and Conditions

4. Clear roles and responsibilities: Defined and clear to all

5. Shared performance monitoring: Information is readily available and shared to all

This is practically and economically feasible- Methods described are in use with O&G companies somewhere – but

not fully integrated- North Sea further down the path, but not there yet either, maybe x3

improvement



Sept 12 2011

15

Generic frequencies

Fault Trees

Human / OrganizationalPerformance

Design Risk – “What Safeguards are Required”

Fire / Explosion / Toxic

Environment+

Frequency Consequences Risk

Better S&E results• better barriers• current barrier status • operational discipline• team working

=x

∑

= Integrated Risk

All events



Sept 12 2011

16

Operational Risk – “Barrier Management and Communication”

� Clear demonstration of a sufficient range and diversity of barriers - Bow Ties show number and quality of barriers: prevention and mitigation- Use for regular training and special operations- Adaptive – barrier status changes dynamically – need to know current status

- Safety Plan improvement actions closed – barriers stronger- Incidents / near misses – some barriers failed in use- Maintenance / Inspection – some barriers are degraded or out of service

Clear Visual Model Updated, Live, Communicated



Sept 12 2011

Accidents Occur when Barriers become Degraded

17

Texas City event explained in barrier failure format

Macondo event explained in barrier failure format

The causes of barrier degradation can be complex:

• Technical• Human• Organizational



Sept 12 2011

Monitoring Barriers

Knowledge of the status of Barriers is key:

� Formal focused in-depth reviews – excellent, but infrequent- TTS (e.g. Statoil) − 5 yearly - Audits − 3 yearly- Planned Inspections − 1 year

� Lessons learned from Incident investigations − excellent AND high frequency- BSCAT approach − every incident / near miss

means some barriers failed / degraded- For many facilities this is 100+ events / year- Collect statistics and root causes

18

Barrier Status – a to f

Barrier FailureRoot Causes

Cause Barriers



Sept 12 2011

19

How to address Degraded Controls or Conditions

Anticipated combinations- MOPO: Manual of Permitted Operations

- Actually “forbidden” operations

- Convert regulations and risk models into:- Explicit instructions – Go or No go

Unanticipated combinations- Operationalize the QRA (like EOOS models)- Convert unanticipated combinations into:

- Explicit remediation's – Fix or No go

QRAModel

Normal status

Degraded controls

Risk Target

Actions to remediate

Risk Levels

Base

Degraded

Repaired

Verifiable: Company / Regulator

Target

E.g. Shell Approach E.g. Nuclear Approach



Sept 12 2011

IO Solution – Decision Room

� Decision room- Review decision required

1. Has it been “pre-assessed” − MOPO degraded control – permitted operations chart2. If not – run QRA tool in deviation mode (like Nuclear EOOS “Equipment Out of Service” model)

20

Objective: Involve “detached” internal / external experts and utilize formal risk processes Avoid: Local ad-hoc decisions with staff with too great financial incentives



Sept 12 2011

21

Use ‘Risk Portal’ for sharing of Barrier status to all IO participants� Use modern IT to collect and share barrier status (e.g. SharePoint 2010)

- Large, scalable tool for team-working: offshore and onshore staff, contractors, regulators - Transparent operations with all MS Office tools, standard reports can update controls status, - KPI’s customized for individuals – their tasks, their barriers status, automatic emails of impending issues- Access to Hazard and Risk Registers, Gantt charts for improvement tasks, all safety processes



Sept 12 2011

IO Role – Enhanced Decision Making

� Involve local team AND shore-based specialists (not directly on the project team)- Drilling staff with less financial incentive to take a potentially higher risk decision- Process safety staff to challenge barrier status- Regulators – as per new BOEMRE GoM requirement for sign-off before removing mud

� Address potential over-confidence by local team - Macondo – the job was a success, mindset already onto the next job- Shore-based specialist should not have this mindset – challenge all barriers status

� Address fatigue- Towards end of drilling project, local team can be fatigued- Shore-based staff should not be fatigued and can input from global time-zones

� Address unusual combinations of conditions- Local team may not have as full an experience bank as shore-based specialists

� Address organizational issues- Ensure that safety has top priority and that contractor specialists are not over-ruled- Ensure corporate standards for risk are not weakened by local financial pressures

22



Sept 12 2011

Organizational Involvement in IO

Basic assumption- Even where top management has a commitment to and sets high standards - It is impractical for top management to participate in day-to-day decisions

Top Management communicates its intentions in several ways, e.g.1. Create a culture where safety considerations are not exceeded by profit

- See new CCPS Book Conduct of Operations / Operational Discipline- High Reliability Organization / resilience concepts

2. Establish suitable risk targets which must not be exceeded3. Sign-off on safety case or equivalent demonstrating attainment of target with defined

barriers – at design and in operations4. Define how decision making shall be made where disagreement exists

- e.g. using principles of HRO to overcome multi-party disagreements (Company, contractors)

IO comes into play during operations to Verify:- Are procedures being followed fully and correctly- Is the activity within the operationally permitted envelope – if not shutdown and rethink- Are barriers functional as per their performance standard

23



Sept 12 2011

Conclusions

� Major Accident Safety has not improved as well as Occupational safety- DNV believe this is possible and that a step change improvement can be achieved

� Three key factors need to be addressed:1. Risk assessments need to be improved

- Design stage – to address (Safety and Environment) for (Topsides, Subsea and Downhole)- Operations Stage – to focus strongly on barriers – with performance standards, ownership, status

2. Controls- In compliance with Regulatory and modern management system controls - Ensure all barriers are installed and have performance standards suitable to deliver the risk target

3. Conditions- React safely to degraded barriers and changed operational conditions

� Integrated Operations as a key means to enhance decision making- All 3 aspects can be addressed- Influences such as organizational and safety culture can be addressed

24



Sept 12 2011

25

Safeguarding life, property and the environment

www.dnv.com

Integrated Operations to Reduce Operational Risk - IO … · Integrated Operations to Reduce...

Documents

Transcript of Integrated Operations to Reduce Operational Risk - IO … · Integrated Operations to Reduce...