PRACTICAL SAFETY CASE DEVELOPMENT

In a number of offshore environments a safety case is required, either by the flag state or by the operator, so rig owners will hire some suitably experienced and expert organisation to produce the required document, and the result will be submitted for admiration and in some cases, approval. In many cases the whole activity will pass the workforce by, who will only be aware of the existence of the document if they have access to the OIM’s office. Of course the rig manager will have one as well, visible on his shelf of important documents. He will regard it as his licence to drill.

The compilation is invariably extremely expensive so it should be more than a heavy weight which can be used to keep doors open. A big stone would do the same thing. Surely we can do better?

As a result of the enquiry into the loss of the UK production platform Piper Alpha, offshore installations working in the British sector of the North Sea were required to be provided with safety cases. Lord Cullen who headed the enquiry suggested that they would encapsulate, in one document, the information which would be required to prove that an installation was operating as safely as possible in the offshore environment. This recommendation was only one of more than 130. Another was that offshore safety was to be administered by the UK Health and Safety Executive, who even then were becoming notorious for, among other things, apparently requiring school children to wear safety glasses when playing conkers.

There were few consultants developing mobile unit safety cases at the time, and much of the expertise both in the HSE and the drilling industry was recruited from the nuclear consultancies most of whom were based in Warrington. While they were expert at developing and assessing QRA (Quantitative Risk Assessment) few had much knowledge of the marine world. Another failing in the earliest safety cases was a realistic means of assessing hazards, and as a result a number of qualitative assessment techniques were developed, one of which was the “bow-tie”, which was pioneered in UK by EQE (Earthquake Engineering).

Over the years a variety of safety case templates have been developed with the intention of assisting rig owners with the task, which remains onerous. As a result the templates have become extremely complex, tending to ensure that the document will continue to be compiled by consultancies, and that they will remain opaque, and of little use to anyone except the producers of the document and in the end, the assessors who determine whether it is actually a case for safety. The latest templates contain more words, more matrices, more evaluation processes and more acronyms, but seem to have mislaid the original objective.

Of course the templates are approved by committees, and it is natural that they should not wish to commit the industry to anything too onerous, so these documents are gradually reduced to processes with limited value. Will today’s IADC template actually contribute to the safety of those offshore? What-ever its intentions does it just look like a paper exercise? There are pertinent questions like “How can you carry out a risk assessment without having any recommendations?” and “How can you have a risk matrix for major accidents which included a level of “several times a year at the location” when the most frequent major accident should not occur more than once in 1000 years on any installation?

In the UK there has been a second iteration of the safety case regulations which have resulted, among other things, in a closer relationship between the regulations themselves and the supporting legal requirements, PFEER (The Prevention of Fire and Explosion and Emergency Response) regulations, DCR (The Design and Construction Regulations) and MAR (The Management and Administration Regulations). The new regulations also specifically require consultation with the workforce, and that at suitable intervals the case should be reviewed by some-one who had not been involved in the production of the original case.

But so much for the history and the possible failings in what has been put in place so far. What is to be done? We probably need to go back to what Lord Cullen intended in order to find a way forward, and to make the safety case a valuable document, not just for the rig manager who gets his licence to drill, or the HSE or other regulatory body who get to feel that they are doing the right thing, or for the consultancies who make money out of the whole business. He intended that the compilation of the document would assist in the maintenance of a suitable safety management system, and that the system would be visible to the workforce, and that the details of the installation should be included, because they would be unlikely to exist anywhere else, and that the risks in the operation of the unit should be assessed in order to ensure that they would be reduced to an acceptable level. And importantly as part of the process of assessment, improvements in the existing systems, structure and procedures would be identified and put in place.

We have more or less accepted that the case should be divided into six sections, since all templates have followed this layout for some years, but what is important is the content. Everyone accepts that section one should contain the road map for the rest of the document, so we can put it to one side. Section Two has traditionally contained the summary of the safety management system and there are a number of guidance documents which can be used to ensure that this contains the appropriate information. So at this point the safety case compilation will assist the owners of the unit to ensure that their safety management system contains what is required to keep people safe. Identified deficiencies, if any, can be addressed during the development of the case. However, it may be best to summarise the various components of the system, rather than writing a few words followed by a reference. References were recommended by the original guidance to the 1993 safety case regulations but it may be time to limit their use. References obviously required the reader to look at other documents, or in some cases at other sections of the safety case, with the result that the section itself is often almost impossible to read.

Section three has become the repository for the “technical details” of the installation. It would seem to be the simplest thing in the world just to write out the specification of the equipment on the rig. Surely everybody knows, or some people know what there is in the way of equipment. Sadly this is not so, and often compilers researching the details of an installation will find conflicting information written in different places. Often such problems are resolved by writing stuff that is so vague that it is no good to anyone. At the very least the compilers should carry out in depth research on one rig of a class, possibly including the extreme measure of reading the specification of the equipment off the attached brass plates, and tracing the ventilation ducts from individual compartments to the vents on the exterior of the unit. Those who consider such detail as excessive should have a look at the transcripts of the witness statements from the Deepwater Horizon investigation. Members of the rig crew have had differing views as to how some essential equipment operated. Once a single rig of a class has been thoroughly researched, the details can be checked by the engineering department of other rigs. This ensures that the details are correct, and therefore have a value for the existing and future crew members.

Section four is the dreaded risk assessment section. There is more than one way of dealing with this, and as a basis what-ever processes are used it could be best to develop a separate risk assessment document and to summarise it in the safety case. The case should therefore contain a description of the processes used, and what the results are, and as far as possible both the description and the results should be presented in a way that the workforce can understand. Lord Cullen was very keen on the inclusion of QRA (Quantitative Risk Assessment) in the risk assessment, and the HSE in UK set a standards that the IRPA (Individual Risk Per Annum) for each offshore worker should be less than 1 x 10-3. Attempts at an explanation will only increase the level of boredom, and this is the problem with QRA. It has a use, but no-one except for statisticians understand it, and it is easy to manipulate. We are better off concentrating on qualitative risk assessments, all of which can involve the workforce. One of the most effective is the bow-tie method which if properly used, is conducted by a facilitator assisting members of the rig’s team to assess the barriers in place which would prevent major accidents and the mitigation measures which would reduce their consequences. The technique allows failings to be identified and therefore for recommendations to be made.

Mitigation is the means by which the effects of major accidents are limited. In the event that the accident happens, it is essential that the management system and the emergency equipment with which the rig is provided, offers the best opportunity for saving everyone’s life. This is usually described in section five of the safety case. In the UK it is usually the summary of the PFEER Assessment, but it should describe the emergency equipment and systems to be used on the rig. Remember that a major accident is one where there are likely to be more than five fatalities, and that occupational accidents have a place elsewhere. When it comes to emergency equipment we live in a prescriptive world with standards set by the flag state of the unit, usually for oil rigs, in accordance with the MODU Code. It is common for the qualitative risk assessment process to determine the adequacy of the emergency arrangements, and of course nothing prevents the owners of the unit from doing better than would be required by the regulations. Once more the section should summarise the emergency provisions, and the safety case process gives the workforce the opportunity of looking at them, and making improvements to the basic requirements. The UK regulations require that all the emergency arrangements be interlocked in a workable way, including the station bill, the offshore emergency manual and the onshore procedures and organisation. When discussing the arrangements during the risk assessment it is up to the facilitator to make sure that the emergencies are realistically considered. It is a common approach to provide emergency response documentation which does nothing more than lay out a basis for a weekly exercise. We have to do better.

And finally the safety case of old contained a section which was called “Justification for Continued Operations”, which was more or less the section containing the recommendations from the risk assessments and the programme for their implementation, or indeed why they were not to be implemented. If one is to approach the safety case process as a means of keeping the workforce safe while they are offshore it is essential to detail such a programme. No installation is perfect. No safety management system is without fault. The safety case process provides a means of using the collective knowledge and expertise of the workforce to tease out these failings and improve systems and procedures, and as participants they will then be likely to know what it is, where it can be found and how best to use it.

Victor Gibson. September 2012