Safety Case in the Gulf of Mexico: Method and Benefits for Old and New Facilities
The purpose of the Bureau of Safety and Environmental Enforcement (BSEE) Safety and Environmental Management Systems (SEMS) is to enhance safety of operations in the Gulf of Mexico (GOM). One of the principal SEMS objectives is to encourage the use of performance-based operating practices. However, the current US regulatory framework for GOM operations does not provide adequate tools to focus on specific risks associated with a facility. The adoption of the safety-case regime would steer operations toward this goal.
This paper discusses the application of the safety-case concept and how the operator can demonstrate that the major safety and environmental hazards have been identified, and associated risks estimated, and show how these risks are managed by achieving a target level of safety. Throughout the safety-case road map, the identification of safety critical elements (SCEs) and associated performance standards represents one of the cornerstones of asset-integrity-management (AIM) strategy.
The paper discusses how application of the safety-case regime for existing facilities would highlight particular risks that may have been misjudged, taking into account the current state of installations and the actual operational procedures in place. For new facilities, the introduction of the safety case at the early stages of design would ease the integration of the overall risk-management (RM) plan at each level of organization.
General Safety-Case Approach
The safety-case approach is referred to generally as part of an objective-based (or goal-setting) regime. Such regimes are based on the principle that legislation sets the broad safety goals to be attained and the operator of the facility develops the most appropriate methods of achieving those goals. A basic tenet is the premise that the ongoing management of safety is the responsibility of the operator and not the regulator. The term “safety case” arises from the Health and Safety Executive in the UK, where the safety-case regime was implemented after the Piper Alpha accident in 1988. Most of the performance-based regulations have adopted elements of the safety-case approach. Moreover, many operators have included safety-case components as part of their companies’ requirements and have integrated them in their general management system.
The safety-case regime is a documented demonstration that the operator has identified all major safety and environmental hazards, estimated the associated risks, and shown how all of these risks are managed to achieve a stringent target level of safety, including a demonstration of how the safety-management system in place ensures that the controls are applied effectively (Fig. 1). The safety case is a standalone document, based on a set of several subsidiary documents, undertaken to present a coherent argument demonstrating that the risks are managed to be as low as reasonably practicable (ALARP). Fig. 1 presents the general principle of the safety-case development process.
Current RM Regime in GOM
All leasing and operations in the GOM part of the outer continental shelf are governed by laws and regulations to ensure safe operations and preservation of the environment, while balancing the US’s need for energy development. Since October 2011, the BSEE enforces these regulations and periodically updates the rules as the responsible party for the comprehensive oversight, safety, and environmental protection of all offshore activities.
The original SEMS rule, under the Workplace Safety Rule, made mandatory the application of the following 13 elements of the American Petroleum Institute (API) Recommended Practice (RP) 75:
- General provisions: for implementation, planning, and management review and approval of the SEMS program
- Safety and environmental information: safety and environmental information needed for any facility (e.g., design data, facility process such as flow diagrams, mechanical components such as piping, and instrument diagrams)
- Hazards analysis: a facility-level risk assessment
- Management of change: program for addressing any facility or operational changes including management changes, shift changes, and contractor changes
- Operating procedures: evaluation of operations and written procedures
- Safe work practices: e.g., manuals, standards, rules of conduct
- Training: safe work practices and technical training (includes contractors)
- Assurance of quality and mechanical integrity of critical equipment: preventive-maintenance programs and quality control
- Prestartup review: review of all systems
- Emergency response and control: emergency-evacuation plans, oil-spill contingency plans, and others in place and validated by drill
- Investigation of incidents: procedures for investigating incidents, implementing corrective action, and following up
- Audit of safety- and environmental-management-program elements: strengthening API RP 75 provisions by requiring an initial audit within the first 2 years of implementation and additional audits in 3-year intervals
- Records and documentation: documentation required that describes all elements of the SEMS program
Introduction of Safety Case for Operations in the GOM
Analogies Between Strengths and Weaknesses of SEMS Rule and Safety-Case Development. As part of BSEE communication, the four principal SEMS objectives are the following:
- Focus attention on the influences that human error and poor organization have on accidents.
- Continuous improvement in the offshore industry’s safety and environmental records.
- Encourage the use of performance-based operating practices.
- Collaborate with industry in efforts that promote the public interests of offshore worker safety and environmental protection.
- SEMS is promoted as a nontraditional, performance-focused tool for integrating and managing offshore operations. However, the current US regulatory framework for offshore operations in the GOM does not provide adequate tools to focus on the specific risks associated with a facility. The development of the SEMS program is generally focused on the provision of the 13 elements required in API RP 75 rather than a consistent narrative where the operator demonstrates how effective the controls and management system in place are against the identified risks.
Nevertheless, the 13 elements of API RP 75 could be seen as a skeleton for the development of the safety-case regime. The links between them are naturally identifiable, but significant efforts would be necessary to meet the safety-case philosophy and the ALARP concept in particular. Fig. 2 presents a correlation between the 13 elements of API RP 75 and the main steps of safety-case development.
As shown in Fig. 2, the elements of API RP 75 are truly part of the components of safety-case development. However, as is also obvious in Fig. 2, critical shortcomings are present, such as the ALARP process as part of the risk-reduction effort, an unambiguous strategy for the identification of SCEs, and the development of the associated performance standards. Moreover, the safety-case regime advocates a clear demonstration of how the decision process is based on the output of each development stage. Such a continuous link among API RP 75 elements is missing.
The SEMS vulnerabilities are primarily related to the lack of targets (or how to define targets) as part of a performance-based approach.
Use of Safety Case for the Development of RM/AIM Plans
Asset integrity is largely considered as a key for managing major accidents. It is an outcome of good design, construction, and operating practices. It is commonly accepted that the AIM process follows a standard continual improvement cycle (the Deming cycle)—plan, do, check, act.
As part of the first step, it is crucial to establish the objectives and processes necessary to deliver the expected results (plan). These different aspects cover factors outside the organization, such as the applicable legislation, codes, and standards, as well as key stakeholders, and internal factors, such as the company RM standards, processes, and targets or roles and responsibilities.
Once the plan is defined and the objectives are clearly stated, it is important to implement the plan—execute the process to deliver the results (do). This stage is based on a risk-assessment process from hazard identification to risk analysis, to provide a risk evaluation of the facility.
The actual results are studied (measured and collected in “do” stage) and compared against the expected results (targets or goals from the “plan” stage). This phase of risk treatment involves considering all the feasible options and deciding on the optimal combination to minimize the residual risk as far as reasonably practicable.
Once the decisions are made, on the basis of an ALARP process, the solutions are implemented (act). It is also crucial to monitor and periodically review the approach taken.
The safety-case process involves a similar development cycle; therefore, it is natural to promote the development of RM/AIM plans and the safety case in parallel.
For existing facilities, existing RM/AIM plans would be challenged and revised toward a continuous improvement of their effectiveness. Application of the safety-case regime for existing installations would highlight particular risks that may have been misjudged, taking into account the current state of the installations and the actual operational procedures in place. Output from verification activities would lead to the identification of corrective actions for existing assets. This type of revision could be seen as a significant effort, but it would actually help the operator to optimize its AIM strategy and spend its resources more effectively. This approach would also give the regulator a quantified picture of current operations in the GOM. Because all facilities would be evaluated against the same performance targets, it would be easier for the operator to prioritize the critical aspects of each facility.
For new facilities, the introduction of the safety-case regime early in the project would naturally lead to an optimized AIM philosophy, strategy, and plan. The operator would be able to anticipate the efforts to be deployed for the entire facility life cycle. The introduction of the safety-case regime at the early stages of design would ease the integration of the overall RM plan at each level of organization.
This article, written by Special Publications Editor Adam Wilson, contains highlights of paper OTC 25957, “Safety Case in Gulf of Mexico: Method and Benefits for Old and New Facilities,” by Julia Carval, SPE, and Bibek Das, SPE, Bureau Veritas North America, prepared for the 2015 Offshore Technology Conference, Houston, 4–7 May. The paper has not been peer reviewed. Copyright 2015 Offshore Technology Conference. Reproduced by permission.