Rigzone | 28 August 2015

Helicopter Operation Safety Review: Problems and Effectiveness

In February 2014, the UK Civil Aviation Authority (CAA) published a safety review of offshore helicopter operations, which examined the risks of supporting the oil and gas industry in the North Sea. The review, undertaken in conjunction with the Norwegian CAA and the European Aviation Safety Agency (EASA), listed 32 actions and 29 recommendations that aimed to increase the safety of offshore helicopter flights.

Earlier this year, the CAA published a report highlighting the progress of the proposed safety measures and examining the impact these measures have had on the offshore oil and gas sector. Although the report states that progress has been made on all actions and most recommendations, not all of the proposed measures have made smooth transitions into the offshore oil and gas industry.

One of the actions that received the most publicity at the time the review was published centered around the body size of helicopter passengers. The CAA’s safety review stated that, starting 1 April, helicopter operators would not be allowed to carry passengers who could not fit through push-out window exits. The thinking behind this measure was that passengers who cannot fit through push-out windows not only face greater risks themselves, they also increase the risks faced by their fellow passengers. As the progress report identifies however, this particular measure posed some problems.


SHP | 28 August 2015

Column: What Size Should Your Safety Department Be?

Safety practitioners have played a pivotal role in ensuring people do not get hurt at work places since the 19th century. Although the aim of a safety practitioner has always been to save lives, the roles they play in an organization has differed from time to time.

The question that intrigues me is: When it comes to safety, what size should your safety team be?

This article is not about how to use empirical formula to find out how big a safety organization needs to be, it’s about understanding the concept of safety and what could be the right line of thinking for the management on staffing the safety department.

The question is a valid one across various organizations, but we will examine the question in a manufacturing/construction organization.

Rigzone | 24 August 2015

Five Hot Oil, Gas Safety Technologies

With safety playing an increasingly important role in the oil and gas sector, the industry is constantly looking to find innovative and efficient tools and systems that can help protect their installations, equipment, and workers away from unnecessary risks. Here, Rigzone takes a look at five of the latest safety technologies developed for use in the upstream industry.

  • EyeCGas FX
  • W22Xd Super Premium Efficiency Flameproof Motors
  • Drilling and Well Control Simulation Facility
  • Virtual-Reality Oil Rig Training
  • Unmanned FLNG Concept

Bloomberg | 24 August 2015

Drones Are Taking Off in the Oil Industry, Especially in Dangerous Offshore Work

Oil rig inspection is a dangerous business. Traditionally roughnecks dangled from a wire, in gale-force winds if needed, to manually log wear and tear on the girders. Assessments include giant chimneys—called flare stacks—that belch fire during million-dollar-a-day shutdowns.

Increasingly, the industry has found that swapping abseiling humans for small drones equipped with high-definition and thermal cameras can save time, cut costs, and improve safety.

“These are large metal structures in a big pond of seawater. They will rust a lot, particularly in the North Sea where rigs designed to last 20 years are lasting more than 40. They are continually getting cracks and physical damage from the waves and need to be refurbished and fixed,” said Chris Blackford, Sky Futures’ chief operations officer.

Sky Futures, headquartered in London, is a drone inspection company specializing in the oil and gas industry and counts BP, Shell, Apache, BG Group, and Statoil among its clients. It’s one of a handful of companies, including Cyberhawk, PrecisionHawk and SenseFly, finding commercial applications for drones.

Occupational Health & Safety | 24 August 2015

Column: What Makes a Leader Transformational?

All leaders desire to get more effort from their people, effort resulting more from intrinsic desire and less from extrinsic prompting. Leaders who truly excel are those who transform results, performance, and culture. What qualities make a leader “transformational?” In numerous “Leadership Coaching” and “Transformational Leadership” workshops, the following attributes have been identified as belonging to a transformational leader.

“Always a better way” thinking. Regardless of what industry you are in, there are countless examples of actions that were once viewed as acceptable that today are viewed as unacceptable. Many leaders who know this realize the limitations of best-practice thinking and maintain more of a positive discontent or better-practice mindset. Rather than simply adopting a best practice and stopping there, they celebrate successes and realize there will always be a better way if, and only if, we keep looking.

Keeps the most important thing the most important thing. It is easy to get caught up in firefighting mode and to lose the efficiency goggles required to be proactively effective. Management guru Peter Drucker admonished, “There is nothing so useless as doing efficiently that which should not be done at all.” Great leaders bring focus to the most important things and keep them front and center, rarely wavering until a better way is discovered, which is then always encouraged and appreciated.

Safety Case in the Gulf of Mexico: Method and Benefits for Old and New Facilities

The purpose of the Bureau of Safety and Environmental Enforcement (BSEE) Safety and Environmental Management Systems (SEMS) is to enhance safety of operations in the Gulf of Mexico (GOM). One of the principal SEMS objectives is to encourage the use of performance-based operating practices. However, the current US regulatory framework for GOM operations does not provide adequate tools to focus on specific risks associated with a facility. The adoption of the safety-case regime would steer operations toward this goal.

This paper discusses the application of the safety-case concept and how the operator can demonstrate that the major safety and environmental hazards have been identified, and associated risks estimated, and show how these risks are managed by achieving a target level of safety. Throughout the safety-case road map, the identification of safety critical elements (SCEs) and associated performance standards represents one of the cornerstones of asset-integrity-management (AIM) strategy.

The paper discusses how application of the safety-case regime for existing facilities would highlight particular risks that may have been misjudged, taking into account the current state of installations and the actual operational procedures in place. For new facilities, the introduction of the safety case at the early stages of design would ease the integration of the overall risk-management (RM) plan at each level of organization.

General Safety-Case Approach
The safety-case approach is referred to generally as part of an objective-based (or goal-setting) regime. Such regimes are based on the principle that legislation sets the broad safety goals to be attained and the operator of the facility develops the most appropriate methods of achieving those goals. A basic tenet is the premise that the ongoing management of safety is the responsibility of the operator and not the regulator. The term “safety case” arises from the Health and Safety Executive in the UK, where the safety-case regime was implemented after the Piper Alpha accident in 1988. Most of the performance-based regulations have adopted elements of the safety-case approach. Moreover, many operators have included safety-case components as part of their companies’ requirements and have integrated them in their general management system.

Fig. 1

The safety-case regime is a documented demonstration that the operator has identified all major safety and environmental hazards, estimated the associated risks, and shown how all of these risks are managed to achieve a stringent target level of safety, including a demonstration of how the safety-management system in place ensures that the controls are applied effectively (Fig. 1). The safety case is a standalone document, based on a set of several subsidiary documents, undertaken to present a coherent argument demonstrating that the risks are managed to be as low as reasonably practicable (ALARP). Fig. 1 presents the general principle of the safety-case development process.

Current RM Regime in GOM
All leasing and operations in the GOM part of the outer continental shelf are governed by laws and regulations to ensure safe operations and preservation of the environment, while balancing the US’s need for energy development. Since October 2011, the BSEE enforces these regulations and periodically updates the rules as the responsible party for the comprehensive oversight, safety, and environmental protection of all offshore activities.

The original SEMS rule, under the Workplace Safety Rule, made mandatory the application of the following 13 ­elements of the American Petroleum Institute (API) Recommended Practice (RP) 75:

  • General provisions: for implementation, planning, and management review and approval of the SEMS program
  • Safety and environmental information: safety and environmental information needed for any facility (e.g., design data, facility process such as flow diagrams, mechanical components such as piping, and instrument diagrams)
  • Hazards analysis: a facility-level risk assessment
  • Management of change: program for addressing any facility or operational changes including management changes, shift changes, and contractor changes
  • Operating procedures: evaluation of operations and written procedures
  • Safe work practices: e.g., manuals, standards, rules of conduct
  • Training: safe work practices and technical training (includes contractors)
  • Assurance of quality and mechanical integrity of critical equipment: preventive-maintenance programs and quality control
  • Prestartup review: review of all systems
  • Emergency response and control: emergency-evacuation plans, oil-spill contingency plans, and others in place and validated by drill
  • Investigation of incidents: procedures for investigating incidents, implementing corrective action, and following up
  • Audit of safety- and environmental-management-program elements: strengthening API RP 75 provisions by requiring an initial audit within the first 2 years of implementation and additional audits in 3-year intervals
  • Records and documentation: documentation required that describes all elements of the SEMS program

Introduction of Safety Case for Operations in the GOM
Analogies Between Strengths and Weaknesses of SEMS Rule and Safety-Case Development. As part of BSEE communication, the four principal SEMS objectives are the following:

  • Focus attention on the influences that human error and poor organization have on accidents.
  • Continuous improvement in the offshore industry’s safety and environmental records.
  • Encourage the use of performance-based operating practices.
  • Collaborate with industry in efforts that promote the public interests of offshore worker safety and environmental protection.
  • SEMS is promoted as a nontraditional, performance-focused tool for integrating and managing offshore operations. However, the current US regulatory framework for offshore operations in the GOM does not provide adequate tools to focus on the specific risks associated with a facility. The development of the SEMS program is generally focused on the provision of the 13 elements required in API RP 75 rather than a consistent narrative where the operator demonstrates how effective the controls and management system in place are against the identified risks.

Fig. 2

Nevertheless, the 13 elements of API RP 75 could be seen as a skeleton for the development of the safety-case regime. The links between them are naturally identifiable, but significant efforts would be necessary to meet the safety-case philosophy and the ALARP concept in particular. Fig. 2 presents a correlation between the 13 elements of API RP 75 and the main steps of safety-case development.

As shown in Fig. 2, the elements of API RP 75 are truly part of the components of safety-case development. However, as is also obvious in Fig. 2, critical shortcomings are present, such as the ALARP process as part of the risk-reduction effort, an unambiguous strategy for the identification of SCEs, and the development of the associated performance standards. Moreover, the safety-case regime advocates a clear demonstration of how the decision process is based on the output of each development stage. Such a continuous link among API RP 75 elements is missing.

The SEMS vulnerabilities are primarily related to the lack of targets (or how to define targets) as part of a performance-based approach.

Use of Safety Case for the Development of RM/AIM Plans
Asset integrity is largely considered as a key for managing major accidents. It is an outcome of good design, construction, and operating practices. It is commonly accepted that the AIM process follows a standard continual improvement cycle (the Deming cycle)—plan, do, check, act.

As part of the first step, it is crucial to establish the objectives and processes necessary to deliver the expected results (plan). These different aspects cover factors outside the organization, such as the applicable legislation, codes, and standards, as well as key stakeholders, and internal factors, such as the company RM standards, processes, and targets or roles and responsibilities.

Once the plan is defined and the objectives are clearly stated, it is important to implement the plan—execute the process to deliver the results (do). This stage is based on a risk-assessment process from hazard identification to risk analysis, to provide a risk evaluation of the facility.

The actual results are studied (measured and collected in “do” stage) and compared against the expected results (targets or goals from the “plan” stage). This phase of risk treatment involves considering all the feasible options and deciding on the optimal combination to minimize the residual risk as far as reasonably practicable.

Once the decisions are made, on the basis of an ALARP process, the solutions are implemented (act). It is also crucial to monitor and periodically review the approach taken.

The safety-case process involves a similar development cycle; therefore, it is natural to promote the development of RM/AIM plans and the safety case in parallel.

For existing facilities, existing RM/AIM plans would be challenged and revised toward a continuous improvement of their effectiveness. Application of the safety-case regime for existing installations would highlight particular risks that may have been misjudged, taking into account the current state of the installations and the actual operational procedures in place. Output from verification activities would lead to the identification of corrective actions for existing assets. This type of revision could be seen as a significant effort, but it would actually help the operator to optimize its AIM strategy and spend its resources more effectively. This approach would also give the regulator a quantified picture of current operations in the GOM. Because all facilities would be evaluated against the same performance targets, it would be easier for the operator to prioritize the critical aspects of each facility.

For new facilities, the introduction of the safety-case regime early in the project would naturally lead to an optimized AIM philosophy, strategy, and plan. The operator would be able to anticipate the efforts to be deployed for the entire facility life cycle. The introduction of the safety-case regime at the early stages of design would ease the integration of the overall RM plan at each level of organization.

This article, written by Special Publications Editor Adam Wilson, contains highlights of paper OTC 25957, “Safety Case in Gulf of Mexico: Method and Benefits for Old and New Facilities,” by Julia Carval, SPE, and Bibek Das, SPE, Bureau Veritas North America, prepared for the 2015 Offshore Technology Conference, Houston, 4–7 May. The paper has not been peer reviewed. Copyright 2015 Offshore Technology Conference. Reproduced by permission.

Managing Marine Geohazard Risks Throughout the Business Cycle

Today, the industry is faced with entry into frontier areas with little prior published understanding and potentially complex slope and deepwater settings. In such settings, early effort in the exploration-and-production cycle is required to allow appropriate data to be gathered and assessed. In order to address these issues, BP has adopted a methodology to manage geohazard risks over the life of the license.

In 1964, the rig C.P. Baker was lost in the Gulf of Mexico in a shallow-gas blowout with the loss of 22 lives. That accident, and similar events in the industry around the same time, triggered the development of geophysical site investigation or geohazard methodologies to support safety in tophole drilling and field development through detailed assessment of seabed and near-surface geology. To this end, the Hazards Survey in North America and the Site Survey in Europe became the staple means for evaluating predrill or predevelopment conditions over the following 30 years.

The technologies used in these surveys have continued to be developed. These approaches have generally served the industry well for 50 years. How­ever, as the industry has progressed from operations generally on the continental shelf out onto the continental slope and into ultradeep water, the geohazard issues that need to be addressed by the industry have grown in variety and complexity.

While the scope of possible ­sources of geohazards has expanded, so has the potential size of license areas to be studied.

If conditions across such blocks on the continental shelf or in ultradeep water were homogeneous, it may be acceptable to continue with the traditional approach of the site survey. However, the conditions in many large blocks are far from homogeneous, and, therefore, a site survey would deliver little understanding of the variability in geohazard conditions and processes that may have implications for the immediate safety of drilling.

The longevity of production operations now faced in a license or field has also been gradually extended through the implementation of improved-recovery techniques. BP’s Magnus field was discovered in the far north of the UK continental shelf in 1974. At the time of first oil in 1983, the projected field life was seen as being out to the mid-1990s. However, another phase of production drilling will be starting from the platform in 2015, and current projected field life is now seen out to the 2020s. However, the last high-resolution seismic data to have been acquired below the platform were acquired in 1984. Before restarting drilling, a prudent operator would ask the question, “What is the possibility that geohazard conditions may have changed over the last 30 years?” The prudent operator, therefore, needs to revisit geohazard risks and the validity of site-investigation data across the full life of the license, from entry to field abandonment, and to update geohazard understanding consistently across the whole time period.

Fig. 1

This paper, therefore, sets out an integrated approach to address management of geohazard risks across the life of a license (Fig. 1), an approach that seeks to consistently update understanding of what geohazards might be present, and, thus, where possible, seeks to avoid them directly or mitigate their presence.

License Entry
Upon entry to a new license area, existing seismic or published geoscience information upon which to build understanding of geohazard complexity may be sparse.

A consistent approach for the rapid evaluation of the potential degree of geohazards complexity before, or upon, entry to a new license area uses an evaluation of four fundamental geoscience attributes: evidence for presence of shallow hydrocarbons, recent-deposition rate (over the last 1 million years), structural complexity, and underlying seismicity. A final attribute is the quality of the database available to review the area: The sparser or poorer the data available, the greater the interpretive uncertainty. Each of these five factors is scored by use of a consistent scoring mechanism, and they can be plotted on a pentagon where the greater the area finally shaded, the greater the fundamental level of underlying geohazard risk.

Geohazard Baseline Review
After initial fundamental evaluation of risk before or upon entry, it is normal to expect that licensewide exploration 3D data acquisition will be a first step to support the exploration effort—if this is not already in place.

Delivery of a geohazards or short-offset volume at this stage is a simple and effective byproduct. Indeed, in the case of wide-azimuth data acquisition, delivery of such a product may be a key intermediate quality-control output to delivery of the final product and may be of significantly greater value to the geohazards interpreter than the final volume used by the explorer.

Once processed, 3D data are available to produce a complete geohazards baseline review (GBR) of the delivered volume. Such baseline reviews need to be performed and communicated efficiently to the exploration team in a way that supports eventual prospect ranking and delivered early enough in the exploration cycle to affect choice of drilling location.

Production of a GBR provides the underlying framework for all later geohazard studies to be built and data requirements to be defined. The GBR, therefore, should be revisited and updated regularly.

Geohazard-Risk-Source Spreadsheet (GRSS)
A GRSS captures individual ­sources of geohazards, the threat that each may pose to operations, and their effect on those operations. These then form a threefold semiquantitative evaluation of the interpretive confidence that a hazard is present, the likelihood of that geohazard event occurring, and the effect of that event to establish an initial definition of operational risk from the individual source of the hazard.

Exploratory Drilling
On the basis that a prospect is identified within the licence that is considered of sufficient value to commit to exploratory drilling, a location will need to be assessed for its safety for drilling.

Local regulatory requirements may establish specific constraints. Other­wise, the level of visible overburden complication may suggest, even in deep water, that site-specific high-resolution 3D-data acquisition is required to support either selection of a location clear of geohazards or accurate definition of the geohazards present to allow their mitigation in well design.

The key is that, outside of regulatory requirements, the operator, rather than applying a rote process to evaluation of a drilling location, should be designing a site-investigation program that specifically addresses the potential hazards faced at that location.

Appraisal: Toward Field Development
At this stage of the life cycle, direct operational experience of initial drilling activities should have been gathered and can be fed back directly into improving predictions of tophole appraisal drilling. Beyond this, however, the addition of potential location-specific site-investigation-survey data, combined with direct operational experiences from initial drilling, will allow a full revision of the GRSS contents. This review should focus on whether the GRSS contents either were too conservative or overlooked possible hazards sources.

Major-Project Delivery
At the onset of a field-development project, it is expected that all site-investigation-data needs have been met and plans have been put in place for data acquisition or that the data are already in hand. Ultimately, the different study strands defined in the project GRSS should be brought together into an integrated geological model.

Outputs from a completed integrated study allow proper risk avoidance in concept screening through choice of development layout, for example, or risk mitigation by engineering design.

Development-Project Execution Into Early Production
As a development project moves into the execute phase and the instigation of production drilling or facility installation, the refinement of geohazard understanding needs to continue.

Drilling requires the same screening as used for the exploratory-drilling phase. Experiences from drilling of the first wells from a location need to be captured either directly by presence of tophole witnesses on-site or indirectly by use of remote monitoring facilities. These experiences should be fed back into updated predictions of drilling conditions for ensuing project or production wells to allow appropriate and safe adjustment of drilling practices in accordance with actual conditions encountered. This process needs to be carried through the production phase after the initial development is complete. Variances should always be investigated and reconciled against pre-existing knowledge.

Drilling Renewal and Field Redevelopment
Before the restart of drilling or redevelopment operations, an operator should pause to capture previous operational lessons learned. Reviews of the ongoing integrity of the overburden should be held regularly throughout the life of the field, especially ahead of any engineering operations, and, as a result, the validity of overburden imagery should be considered regularly and carefully for renewal.

Ahead of the instigation of abandonment operations, a review of the potential for change in overburden, or geohazard, conditions should be undertaken. For a single suspended or partially abandoned subsea well, the period since the well was last worked over may have been considerable. The prudent operator will undertake a review of the original operation to understand the condition of the well. It is also prudent to undertake a simple survey of the seabed around the well to look for anomalies that may suggest a change in the integrity of conditions since temporary abandonment.

This article, written by Special Publications Editor Adam Wilson, contains highlights of paper SPE 173139, “Managing Marine Geohazard Risks Over the Full Business Cycle,” by Andrew W. Hill and Gareth A. Wood, BP America, prepared for the 2015 SPE/IADC Drilling Conference and Exhibition, London, 17–19 March. The paper has not been peer reviewed.

LULA Exercise Blends Surface and Subsea Responses to Simulated Deepwater Blowout

To test the improved blowout-response capabilities implemented following the Deepwater Horizon accident, Total organized and ran a large exercise to check the ability to efficiently define, implement, and manage the response to a major oil spill resulting from a subsea blowout, including the mobilization of a new subsea-dispersant-injection (SSDI) device. After a year and a half of preparation, the exercise took place 13–15 November 2013.

The oil-spill-response exercise, code-named LULA, considered a scenario in which a blowout at a water depth of 1,000 ft resulted in an uncontrolled release at 50,000 BOPD. The main objectives of the LULA exercise were

  • To mobilize all the emergency and crisis units in Luanda, Angola; offshore; and in Paris
  • To use all the techniques and technologies available to track an oil slick
  • To mobilize the SSDI kit from Norway to Angola and to deploy it close to the well
  • To deploy all the available oil-spill-response equipment of Total E&P Angola
  • To test the procurement of dispersant and the associated logistics
  • To test the onshore response, including coastal protection, onshore cleanup, oiled-wildlife management, and waste management

Subsea Response
During the Deepwater Horizon disaster, the injection of dispersant directly at the source of the oil leakage at seafloor level proved to be an effective technique. The technique required the deployment of an SSDI system.

After the Deepwater Horizon accident, Total was involved with a group of nine major oil and gas companies in the Subsea Well Response Project. As a result of the work of this group, two SSDI kits were manufactured and positioned in Stavanger. Total wanted to test the ability to mobilize and deploy in a timely manner the newly developed equipment, and Total E&P Angola was designated as responsible for the organization of the LULA exercise in collaboration with the Ministry of Petroleum of Angola. The SSDI kit, positioned in Norway, would be transported by air to Angola, sent offshore, and deployed.

The objective of dispersant spraying, at the surface or subsea directly at the wellhead, is to break down the oil slick or plume into microdroplets that can be degraded much more ­easily by micro­organisms occurring ­naturally in the marine environment. Marine environments with a long history of natural oil seepage, such as Angolan waters, ­already host ­micro-organisms well-­suited to bio­degradation of hydrocarbons.

Fig. 1

The SSDI kit was loaded on a field support vessel (FSV) on 9–10 November 2013. The SSDI kit (Fig. 1) is composed of a coiled-tubing termination head (CTTH), a subsea dispersant manifold (SDM), dispersant-injection wands, and four hydraulic flying leads on racks (only three were mobilized).

The first step of the offshore operation was conducted by the FSV and consisted of the installation of the SSDI kit on the seabed and proceeded with the subsea connections of the various parts of the system by use of the vessel’s crane and a remotely operated vehicle (ROV).

The second step involved deploying the CTTH from the light-well-intervention vessel in open water by use of a coiled-tubing string.

The final step before starting to inject the dispersant was to connect the last hydraulic flying leads to the SSDI by use of two ROVs. Once the subsea layout of the SSDI kit was completed, the dispersant injection started at a low flow rate, set at 1/100 of the blowout rate.

Surface Operations
For the LULA exercise, one of the main objectives was to test the mobilization and deployment of Total E&P Angola’s offshore oil-spill-response resources (e.g., dispersant spraying, containment, recovery) and the coordination of deployment of additional resources.

While the response to an instantaneous oil spill (e.g., a spill from a tanker following a collision) will involve deploying resources on a moving target (following drifting oil slicks), the strategy for the response to a blowout incident will focus primarily on the oil reaching the surface from the wellhead.

Fig. 2

The advantages of doing so include the fact that fresh oil can be dispersed more efficiently, whether by aircraft or ships. If resources for containment and recovery are positioned adequately, the spreading of the oil will be limited, thus increasing the efficiency of such operations. The response invariably will involve the deployment of numerous response resources, all fighting for space. Therefore, it is critical to organize the operations by identifying areas dedicated to each component of the response (Fig. 2).

Although not fully implemented on-site during the exercise, the planning section of the emergency unit set the zoning of the response operations in cones and defined the following zones, starting from the well:

  • An exclusion zone: A no-go zone in the area of the surfacing oil, if needed, when volatile-organic-compound concentrations or other risks are too high to allow working safely
  • An area dedicated to the subsea response above and very close to the well (SSDI, capping of well, relief-well drilling)
  • Various areas for oil-spill response at the surface of the sea
    • Close to the area of the surfacing of the oil—dispersant spraying from ships and containment-and-recovery vessels
    • A second area dedicated to aerial application of dispersants
    • A third area for containment recovery of weathered scattered patches of oil
    • Coastal-area response (mainly recovery of patches of weathered oil coming close to the coast)

Shoreline Protection and Cleanup
Another major objective of the exercise was to mobilize and use simultaneously a variety of tools available to Total E&P Angola for monitoring and modeling oil slicks and to evaluate their scope of application and effectiveness. From an operational standpoint, the response efforts need to focus on the areas where the film of oil is the thickest within the slicks that rapidly spread. The effectiveness of the response relies extensively on the ability to guide and maintain the response resources on these thick oil patches.

The tools tested during the LULA exercise were used for tracking the oil slick and predicting its movement.

Soon after the release of crude oil into the sea, two drifting buoys were launched at the front edge of the oil slick. Their positions were tracked continuously by satellite and were visible online within 1 to 3 hours.

Helicopter surveys provide the greatest flexibility and the most-­detailed information about the spread and be­havior of oil slicks. Two helicopter flights took place during the LULA ­exercise. The survey reports were sent to the emergency units.

Fixed-wing aircraft were used to rapidly obtain an overall view of the oil slick. An airplane mobilized from Accra, Ghana, flew over the site on the second day of the exercise. It provided information about the oil slick in a report submitted to the emergency units.

On the basis of experience from a past incident, an observation balloon was developed. It was launched from a ship and used for the first 48 hours of the exercise. The balloon was tied to the boat approximately 150 m above sea level, and the camera fitted on it fed images (visible and infrared) to a station on the boat. The boat can then follow the oil slicks day and night, and position the response vessels on the thickest parts of the slick and start operations at sunrise.

The LULA exercise was conceived by the management of Total to test the capability of the company to initiate the response to a major deepsea blowout. The exercise went far beyond the scope of classic large-scale exercises, including

  • 5 years of preparation
  • More than 500 people involved during the exercise and international experts mobilized in Angola
  • Mobilization from Norway and deployment of a newly designed SSDI system
  • Deployment of monitoring tools used on a controlled release of crude oil (e.g., observation balloon, observation aircraft mobilized from Ghana, satellite radar imagery)
  • Deployment of surface oil-spill-response resources from Total E&P Angola and from other oil operators in Angola
  • Mobilization of the emergency management organization of Total and Total E&P Angola and of the Angolan National Incident

Command Center
The exercise highlighted the following main challenges and areas for improvement:

  • Responders and experts must be mobilized in-country to provide assistance for offshore operations but also for the emergency management.
  • Sourcing, contracting, and mobilizing personnel, equipment, consumables, and logistical support must ensure sustainable and coordinated responses for a blowout situation, including subsea, surface, and onshore operations.
  • The emergency management organization of Total E&P Angola must interface with national authorities at strategic and tactical levels to facilitate the operations (e.g., involving customs, immigration, flights authorization, and links with local and provincial authorities).
  • Damage-assessment and -compensation mechanisms for affected communities and activities must be reinforced in case the oil comes ashore.
  • A comprehensive health, safety, and environment monitoring program must be set up during an incident to ensure safe response operating conditions (e.g., explosivity and volatile-organic-compound measurement of fresh surfacing oil), to assess the effectiveness of the response (e.g., efficiency of subsea and surface dispersant spraying), and to monitor the potential effects on the environment and its restoration.

LULA was a success. All the planned actions were carried out safely and effectively during the 3 days of exercise. Many lessons learned were identified and included in a set of recommendations that will help to improve Total’s capability to respond to a blowout situation. The findings of the exercise will also benefit the whole oil and gas industry, particularly companies operating in deep­water environments.

This article, written by Special Publications Editor Adam Wilson, contains highlights of paper IPTC 18215, “LULA Exercise: Testing the Oil-Spill Response to a Deep-Sea Blowout, With a Unique Combination of Surface and Subsea Response Techniques,” by C. Michel, L. Cazes, and C. Eygun, Total E&P Angola, and L. Page-Jones and J.-Y. Huet, OTRA, prepared for the 2014 International Petroleum Technology Conference, Kuala Lumpur, 10–12 December. The paper has not been peer reviewed. Copyright 2014 International Petroleum Technology Conference. Reproduced by permission.

Hydrogen Sulfide Measurement With Wireless Technology

Hydrogen sulfide represents a major hazard in oil and gas production, and the efficient and reliable detection of gas leaks is a critical safety aspect. Wireless-detection systems offer an opportunity to expand the measurement area. This paper reviews a specific application of wireless technology in gas detection and details the steps taken to assess the integrity of the wireless system and the considerations necessary to ensure the reliability and availability of the signal transmission.

Wireless-Sensor Networks (WSNs)
WSNs are an alternative to hard-wired systems where the cabling is replaced by radio-frequency (RF) transmission of the measured data into a host system. The network may be point-to-point or meshed transmission. Meshed transmission allows for multiple alternative routes and, therefore, offers potential improvements in the ability of the system to ensure that the data are delivered to the host system.

WSNs have been developed since 2003 on the basis of Institute of Electrical and Electronics Engineers (IEEE) Standard 802.15.4, which defines the operating frequency of 2.4 GHz and other aspects of the basic physical layer of communication. This is currently adopted by the process industry as the essential foundation for most wireless-­measurement systems.

Subsequent to the definition of the physical layer for communication, the HART Foundation, which was originally established to define protocols for serial data communication between cabled field devices, was extended to cover WSN technology. This wireless HART technology was subsequently approved by the International Electrotechnical Commission (IEC) in 2006 as IEC Standard 62591. A parallel development was undertaken by the International Society of Automation (ISA) in the US under the ISA 100.11a standard in 2009. Each of these standards seeks to establish interoperability of the different equipment manufacturers, and it is important that this convergence be achieved to prevent development and adoption delays.

The development of battery technology is also an important aspect of WSNs. Significant advances in battery design, solar-cell charging, and energy harvesting are expected to play an active role in the future. In present systems, sophisticated software is used to turn on and wake up components to minimize power consumption. It is also imperative that monitoring of battery status be managed actively by the host system.

Reliability Considerations
Reliability may be defined as the ability of a system or component to perform its required function under stated conditions.

Fig. 1

The quantitative analysis of reliability is a well-established practice for point-to-point systems. One methodology useful for visualization is a decision tree. A simple example for a system with a top event, which is loss of any of two signals, is provided in Fig. 1. For purposes of demonstration, the reliability of both receivers is 0.9 and of two transmitter/sensor combinations is 0.85 and 0.8. The reliability of the wireless transmission is assumed to be 1.0 (direct line of sight over a short distance). The result of the decision-tree analysis is an overall reliability of 0.55.

Fig. 2

Wireless systems using multicasting provide an alternative communication route by enabling the failed receiver to be bypassed (Fig. 2). It is clear from the ­decision-tree analysis that multicasting in this case provides a significant improvement in reliability, with the probability of the successful measurement of both inputs improving for this example from 0.55 to 0.67. It is also clear from these examples that the complexity of the decision tree increases significantly as the number of alternative routes increases.

Extrapolating the decision-tree approach to include the wireless transmission in larger mesh systems (e.g., 2,000 points) introduces the problem of estimating reliability influenced by many factors, some of which are interdependent. These include the effect in mesh systems of the signal consolidation from many reflections at the receiver in addition to line of sight, the natural tendency of an RF signal to spread over a radial distance, and the limitations of statistical assumptions in the probability of reflection.

Accordingly, for large wireless mesh systems, decision trees and other conventional point-to-point methods are difficult to apply; they simply become too large. As a result, the mathematical development of modeling techniques for these types of multiple information flows has received significant attention in recent years, driven not only by reliability considerations but also by the need to identify the smallest routes to limit investment costs on large-scale communication systems and to identify limitations on capacity of isolated sections of the network. Graph theory represents a suitable method for analysis of networks with multiple routes, but, again, solutions require complex extended algorithms and are difficult to visualize.

Many of these approaches to analysis concentrate on component reliability for the equipment (e.g., transmitters, receivers, batteries, sensors) and on generalized assumptions regarding the performance of the mesh design.

The sensitivity of reliability for a wireless network, however, is dominated by the RF environment, rather than component reliability. The assumption that the system will comply with standardized probability functions in particular may be ambitious, and specific planning of the network, testing of the network, and maintenance of the RF environment are imperative to ensure that the system will continue to work properly.

The Test Installation
The application reviewed in this paper was located at a fire training ground at Asab in the United Arab Emirates. A number of fire scenarios can be simulated, including gas leaks at flanges and tank fires.

Fig. 3

Safety at the training ground is focused on leak prevention; however, secondary risk mitigation is provided by gas detection. Gas detection is normally hardwired, and systems are available for detection of hydrogen sulfide and hydrocarbons. In addition to this hard-wired gas detection, a supplementary wireless gas-detection installation was put in place and investigations were conducted related to wireless aspects of the installation. The system consists of four gas detectors (hydrogen sulfide and hydrocarbon) transmitting to a receiver that converts the signals to the plant operator interface (Fig. 3). The system also has local alarm stations capable of receiving alarms from the various detectors.

The wireless system tested transmits at 2.4 GHz on the basis of the IEEE 802.15.4 standard and used direct-­sequence-spread-spectrum (DSSS) technology, which combines the transmitted signal with a broader spectrum of frequencies.

The transmitter power is limited to 100 mW to enable compliance with European and local statutory requirements for avoidance of interference with existing wireless facilities. The transmission of the signal is limited by reflections and spreading (i.e., the effect of radiating in a circular pattern). For the tests, a gas detector and transmitter were placed in a vehicle and driven away from the receiver over an area of 2-km radius and signal-transmission status was monitored to determine the extent of coverage. At various points within this area, gas detectors were tested with gas samples to ensure that full functionality was maintained.

Test Results
The detectors normally operate at a distance of 150 m from the monitoring-­system receiving antenna. For these tests, a gas detector with a battery power source and a wireless transmitter were transported around the area of the plant in various directions, and the distance from the receiving antenna was increased until communication with the host system was lost. As can be expected, the transmission is influenced significantly by the topography of the land and by building and process-­equipment obstructions. The successful transmission distance varied over a range of 0.4–1.6 km. The analysis also shows that, whereas direct line of sight is optimal for transmission, it was possible to maintain coverage with transmission through structures or using reflection.

For the installation reviewed here, further field tests were conducted to determine the practical robustness of the system in resisting other sources of RF interference from various potential sources.


  • The technology applied in wireless systems in this application appears to be very effective in preventing typical sources of interference with process plants from affecting measurement reliability.
  • The use of hopping with mesh networks effectively extends the possible coverage, within the typical national statutory limits of 100 mW for transmission power.
  • The reliability of equipment may be considered to incorporate hardware and software, which includes the battery, sensor, transmitter, and receiver. This equipment reliability is, to an extent, deterministic and can be managed effectively. The transmission quality of the RF signal, however, is heavily dependent on the application (e.g., location, obstructions, topography) and less easily modeled in reliability assessment.
  • The reliability of the system transmission quality cannot be modeled easily with conventional point-to-point approaches, and the systems may not, in practice, be represented accurately by statistical models. As a result, it is necessary to manage the RF environment actively to support wireless-network systems.
  • Mesh designs that enable local alarm activation without depending on the remote monitoring facility offer particular advantages for gas detection by reducing the difficulty in managing a widespread RF environment while achieving the primary objective of announcing the hazard directly to personnel who may be at risk near the leak source.

This article, written by Special Publications Editor Adam Wilson, contains highlights of paper SPE 171720, “Hydrogen Sulfide Measurement Using Wireless Technology,” by P. Phelan, A.-R. Shames Khouri, and H.A. Wahed, Abu Dhabi Gas Industries, prepared for the 2014 Abu Dhabi International Petroleum Exhibition and Conference, Abu Dhabi, 10–13 November. The paper has not been peer reviewed.

Building the Foundations of Process Safety in Design

The maximum level of process-safety performance an operational asset can attain is set indelibly in the early stages of a project. This is why it is crucial to lay a solid foundation for process safety during design. Before embarking on front-end engineering design (FEED) of the Al Karaana petrochemical project, a behavior-based process-safety program was created with the aim of entrenching process safety in the hearts and minds of design engineers and positively influencing behaviors. The nine foundations of projects process safety form the cornerstone of the program.

Dangers Concealed in Design
Over the past several decades, industry attentiveness to asset integrity and process safety has progressed. The advancement of industry codes and standards and governmental regulations improving the prescriptive minimum requirements in facility design has served to elevate the general level of asset process-safety performance.

On an industrywide basis, during the 20th century, process-safety improvement was influenced initially by fundamental regulations and subsequently by technology, management-system implementation, and more-­refined codes and regulations, which have served to improve the performance of process safety.

However, little comfort can be taken from this general improvement; the continued occurrence of catastrophic incidents is a stark reminder that further strides need to be made.

What should give engineers and designers pause for thought is that many of these catastrophic incidents in the operational phase have root causes in design and could have been avoided with proper attention.

The contribution of errors in design is significant. Of accidents reported to the EU Major Accident Reporting System, statistical analysis shows that design inadequacies are present in approximately 70% of them.

Fig. 1

The company has compiled data from recent capital projects on items or issues that could have adverse effects on safety, production, quality, or costs and could subsequently affect successful commissioning, startup, and first-­cycle operation of new facilities.  Of these flaws experienced in projects, it has been suggested that nearly half have their origins in design stages (Fig. 1). These have resulted in, among other consequences, process-safety incidents that could have been avoided with effective consideration in design.

A minor error or oversight in a design document can often be the source of a future process-safety incident. If the root cause of most incidents can be traced back to design, it is evident that a focus on the activities that take place in an engineering design office is imperative for delivery of a safe performing asset.

Project Method—Process-Safety-Behavior Program in Design
Building a strong process-safety culture in the project demands full cooperation from both the company and the contractors. This staunch commitment drives effectiveness of all subsequent activities in FEED. The program requires leadership commitment and visibility; senior managers and team leads not only drive key messages through various workshops and activities but also are supportive and listen to feedback that comes from the work floor. The Al Karaana FEED process-safety-­behavior program began with embedding this culture among project leadership and disseminating it within the entire project team.

The overall program for FEED contained elements of impactful culture building (the heart) as well as practical tools and techniques (the mind). To bolster the systematic key messages, nine foundations of projects process safety were rolled out and interwoven into the fabric of all behavioral process-safety elements and activities.

In order to establish the tone of the program and introduce the nine foundations early in design, core activity workshops were carefully planned and initiated in combined contractor/company sessions at the onset of FEED. Supporting these discrete workshop events were various other program components, which built upon the common theme of the nine foundations of projects process safety and continued throughout the duration of FEED.

These components were built off the structure applied at worksite behavioral-safety programs but were tailored to meet the needs of work performed in an engineering office and received by a design audience.

Nine Foundations of Projects Process Safety
Before FEED commenced, several health, safety, security, and environment managers investigated project-process-­safety-audit findings and assessed incidents by linking root causes to inadequate design. The findings revealed common weaknesses and identified focus areas for process safety in design. A conceptual campaign was ­initiated that began as rules to stop leaks but evolved into the wider nine foundations of projects process safety.

To communicate effectively on process safety in the Al Karaana process-safety-behavior program, the project sought to simplify key messages, make it easier for project team members to relate to process safety, and help them to better understand how it relates to their work. The numerous concepts and detailed mantras that often constitute asset-­integrity and process-safety-­management packages were distilled into a set of simple, translatable tenets that address common weaknesses.

The result of this effort is called the nine foundations of projects process safety. They are

  • Process-safety leadership
  • Identify and assess risks
  • Identify and specify barriers
  • Standards and procedures
  • Quality
  • Right people in place
  • Manage change
  • Reviews
  • Action closeout

The nine foundations are meant for project leaders as well as front-line engineers and for company and contractor staff alike. They are applicable during FEED but also during all project phases, with varying emphasis.

The nine foundations are not new concepts. They purely achieve simplified and effective key messages on process safety. These simple messages enable focus on changing behaviors in key areas of weakness that are typically experienced in projects, initially with design engineers during FEED but also at subsequent phases of projects. In an easily digestible format, the nine foundations of projects process safety create a consistent message and focus points so that the value of process safety in design is sustained throughout the team.

Each element within the nine foundations is important; missing the mark on any of them during design will compromise facility integrity.

The effective implementation of workshops and supporting activities of the FEED process-safety-behavior program hinged on building the nine foundations into everyday, individual credence. They were a readily accepted rallying point to which engineers could easily relate and also willingly hold themselves and each other accountable to fulfill.

Early in FEED, members of all levels from both company and contractor fully adopted each of the nine foundations, enabling engineers to champion process-safety causes with freedom and confidence.

Reflections on the Success of the Program
The ultimate assessment of the effectiveness of the process-safety-behavior program in design can be made only at the end of asset life looking back at its safety performance. However, it is possible now to reflect on the degree to which the program translated into positive behavioral shifts around two central aspects:

  • Did the resulting design confidently demonstrate mitigation of perceived threats to robust process safety in design?
  • Was the way of working during FEED noticeably different with respect to process safety in design?

The following evidence helps draw conclusions on questions related to these aspects:

  • Despite the fixed schedule with penalties for delay, key process safety reviews were halted from commencing (with full management support) until the full preparatory activities were undertaken in accordance with the terms of reference, even if it may have been possible to progress in parallel with final data gathering. Robust reviews constitute one of the nine foundations.
  • The preliminary design of a filter press in one of the derivative units met all required standards and current operational practices. However, one of the engineers in a remote design office was not comfortable with the level of residual exposure to toxic materials and spoke up, saying, “We can do better.” He proposed an alternative solution that was evaluated and adopted. Feedback from management was that this intervention was “not from the usual location and not from the usual level of the organization,” indicating a new sense of empowerment within all team members. The intervention demonstrated a real care for the future operator.
  • The fuel/flare-system design and the initial utility-steam-system design both met project requirements and standards. However, both were challenged proactively by engineers in the spirit of “What more can we do?” The two systems were re-engineered, significantly reducing complexity. Engineers were able to remove several higher grades of steam, thereby reducing operating temperatures in many parts of the plant and also the likelihood of trips. The fuel/flare integration improvement proposal was adopted, resulting in a more-straightforward process design that will yield benefits in safer operability.
  • The status quo was challenged. An engineer identified unclear language in a design standard that could potentially lead to process-safety consequences if interpreted incorrectly. Another engineer reviewing standard data sheets used on previous projects had concerns that, if additional service specifications were not included, a potential opportunity for oversights in equipment procurements may be introduced. These interventions were in the spirit of the nine foundations, and the revisions in both will serve to reduce the likelihood of incorrect equipment ending up at site.

This article, written by Special Publications Editor Adam Wilson, contains highlights of paper SPE 170442, “Building the Foundations of Process Safety in Design,” by James Jessup, SPE, Julian Barlow, Damian Peake, and Manoj Pillai, Shell Global Solutions, prepared for the 2014 SPE Middle East Health, Safety, Environment, and Sustainable Development Conference and Exhibition, Doha, Qatar, 22–24 September. The paper has not been peer reviewed.

The Philadelphia Inquirer | 19 August 2015

Report Offers 27 Ways To Reduce Risk of Oil-Train Derailments in Pennsylvania

A rail-safety expert recommended on 17 August that Pennsylvania step up track inspections and press railroads to increase the number of electronic trackside monitors to reduce the risk of oil-train derailments.

Allan M. Zarembski, a University of Delaware expert commissioned by Pennsylvania Gov. Wolf to explore responses to a massive increase in oil-train traffic, made 27 recommendations on ways the state and railroads can reduce the risk of a catastrophic derailment.

Zarembski acknowledged that the state has limited leverage over federally regulated railroads, and that the US Department of Transportation and the industry have already moved to upgrade safety standards, including new railcar rules.

“Yes, the railroads are doing many of the things that we say, but the question is, can we get the railroads to do it at the level where we think we can reduce the risk further?” Zarembski said during a media briefing.

BSEE | 29 July 2015

BSEE Conducts Unannounced Exercise in Gulf of Mexico

Deserié Soliz and Alton Bates of the Bureau of Safety and Environmental Enforcement’s (BSEE) Oil Spill Preparedness Division conducted a Government Initiated Unannounced Exercise (GIUE) on LLOG Exploration Company in Covington, Louisiana, last week. As the Exercise Designer and Controller, Soliz delivered a scenario that required LLOG to respond to a simulated oil spill from a drilling facility located in Mississippi Canyon in the Gulf of Mexico.

BSEE planned and executed the exercise in close coordination with oil spill response professionals from BSEE District Operations Support, US Fish and Wildlife Service, National Oceanic and Atmospheric Administration, and the Louisiana Oil Spill Coordinator’s Office. This exercise provided an opportunity for joint cooperation, partnership, and governmental efficiency between federal and state organizations that have mutual responsibilities for regulating the offshore industry.