First-Hand:History of Operational Safety Awareness in the US Gulf of Mexico 1964 to 2014: A personal recollection by Kenneth E. (KEN) Arnold

Introduction

The operational safety of workers and the public during all aspects of offshore activities is of paramount importance. By “operational safety” I mean safety and environmental protection aspects in the design, construction, operation and maintenance of drilling and producing systems. The industry has always been concerned with operational safety. After all no one wants to be killed or be the cause of a fellow worker or employee to lose his life or be seriously injured. However, our awareness of how to act on that concern and what is possible from the standpoint of safety has changed over the years.

It could be quite a complicated undertaking to address every change that has taken place in attitudes and regulations over a half of a century of innovation. In 1964 the industry wondered if it was possible to develop oil fields in 600 feet of water, we had just seen the building of the first semi-submersible drilling rig (Bluewater I) and the first subsea wells producing to shore (Molino offshore in California), and there were no floating production facilities as development options. Rather than attempting to write a detailed book-length accounting of this subject this is merely a personal recollection of the main changes as I experienced them.

The history of operational safety awareness by industry in the US Gulf of Mexico (GOM) is one of periods of slow improvements with dramatic step changes after major accidents. I wish it were otherwise, but in reality the industry has historically only responded with major changes in the way it designs and operates its offshore drilling and production activities in the face of negative publicity from a few highly visible and publicized accidents and the threat of regulations. Thus, the history of safety awareness by industry is generally, with many specific company exceptions, a history of major accidents, the threat of new regulations and industry’s response to these threats to assure the regulations are both practical and efficient.

The Outer Continental Shelf Lands Act of 1953 states:

The Secretary (of the Department of Interior), the Secretary of the Department in which the Coast Guard is operating, and the Secretary of the Army shall enforce safety and environmental regulations promulgated pursuant to this subchapter. Each such Federal department may by agreement utilize, with or without reimbursement, the services, personnel, or facilities of other Federal departments and agencies for the enforcement of their respective regulations.

The industry’s primary safety regulator is the Department of the Interior (DOI). The agency within this department during this period changed its name and sometimes it’s reporting relationship from the Conservation Division of the US Geological Survey (USGS), to in 1982 the Minerals Management Service (MMS), to in 2011 the Bureau of Safety and Environmental Enforcement (BSEE). However, no matter the name or reporting relationship the professionals within the regulator remained essentially the same. Although we enjoy grousing about “government bureaucrats” and “paper pushers”, the industry has been blessed for the most part with a core professional group within the regulator who believe that safety regulations need to reflect the best safety theories of the time but also be practical to implement, to inspect and to enforce. As theories of what constitutes best safety practices have evolved with time, the regulator has forced industry to adopt new ideas in design and operation while also listening to industry’s input. There are other regulators who have a responsibility for oversight of specific offshore industry activities. The main ones with regard to issues of safety are:

1. US Coast Guard (USCG): Over the years there have been several Memorandums of Agreement and Memorandums of Understanding between the DOI and USCG which defines their respective areas of regulation as it pertains to safety and environmental protection. Basically the USCG is responsible for enforcing regulations relating to the safety of life for offshore oil and gas operations. For fixed platforms the focus is on fire fighting, emergency lighting, escape and abandonment. For floating structures it also includes hull integrity, ballast control, marine systems and manning, and the like.

The USCG requires annual inspections to be done by the operator of fixed platforms on the OCS. USCG inspectors perform the initial inspection prior to start-up, but subsequently perform only spot inspections to assure that the other inspections are being performed and documented by the operator. USCG inspects floating facilities for compliance with USCG regulations and has the power to withdraw a facility’s Certificate of Compliance. If violations involve potential civil penalties, USCG refers the case to BSEE.

In 2002, MMS was authorized by USCG to perform annual oversight inspections on behalf of USCG for USCG-regulated items on fixed platforms. BSEE inspectors carry this out using 27 program-specific Potential Incidents of Non-Compliance (PINCs). BSEE District offices provide bi-annual reports based on inspection statistics to the USCG’s Assistant Commandant for Operations to ensure the program of inspections receive appropriate attention at the highest level.

In 2008, an MOA between the two agencies explained how they divided or shared responsibility for floating offshore facilities with a detailed Responsibility Matrix. Unfortunately these shared responsibilities have led to inefficiencies and confusion and have complicated and delayed permit approvals.

2. Environmental Protection Agency (EPA): EPA and DOI entered into a MOU on October 28, 1983 and a MOA on September 12, 1989 assigning inspection responsibilities for NPDES (National Pollutant Discharge Elimination System) compliance to MMS using a mutually developed PINC list. If sampling inspections are carried out, they may only be conducted by EPA. The PINC list allows MMS inspectors to issue warnings, component shut-ins, or facility shut-ins. Further administrative actions are undertaken by EPA.

To avoid confusion, after the Oil Pollution Act of 1990, DOI, DOT, and EPA entered into a MOU “Establishing Jurisdictional Responsibilities for Offshore Facilities.” DOI retained jurisdiction for oil spill prevention and control, contingency planning, and response equipment inspection over offshore facilities located seaward of the coast line with the exception of deepwater ports and their associated pipelines.

3. Pipeline and Hazardous Materials Safety Administration (Department of Transportation): The Department of the Interior has responsibility for offshore pipelines upstream of a point “at which operating responsibility transfers from a producing operator to a transporting operator”, and the Department of Transportation has responsibility downstream of this point. Under an MOU DOI grants right of way permits for DOT pipelines and performs inspections on DOT pipelines as an agent of DOT.

4. Bureau of Offshore Energy Management (BOEM): After the Macondo blowout in 2010 it was decided to split MMS into two organizations. BOEM handles offshore lease sales and manages oil and gas resource evaluations, environmental studies and assessments, leasing activities including the review of Exploration Plans, Development and Production Plans and Development Operations and Coordination Documents, fair market value determinations, and geological and geophysical permitting. Since these plans have an impact on operational safety the division of responsibilities between BSEE and BOEM introduces major inefficiencies and coordination challenges in reviewing and approval of plans. This has a potential impact on safety and delays the issuance of permits. This is a current problem that was created in the effort to separate scientific and resource management (BOEM) from regulatory enforcement (BSEE). Although the split of responsibilities appear wise from the standpoint of outsiders, it is not clear that it has positively impacted safety.

There are other agencies involved in helicopter and marine transportation safety, permitting, data gathering and research. Although this looks complicated to the uninitiated, for the most part it is clear that offshore operational safety is in the hands of the DOI, which today means BSEE. The history of operational safety awareness to a large extent becomes a history of the regulations of BSEE and its predecessor organizations and how the industry responded to these regulations. This is not to denigrate the importance of USCG involvement in hull integrity, mooring and riser safety of floating installations, but I was only peripherally involved in these changes and will have to leave their description to the naval architects and marine engineers.

Pre- Santa Barbara Channel (1964-1969)

Prior to the Unocal blowout and the subsequent beach pollution offshore California in the Santa Barbara Channel in January 1969, offshore safety and potential pollution were not on the public’s radar. Rachael Carson’s seminal book, Silent Spring, was published in 1962 and marked the beginning of public awareness that modern industrial development if unchecked could impact the environment in ways that was harmful to life. The first major environmental group to focus on this issue, the Environmental Defense Fund, was only established in 1967 and the EPA wasn’t established by the Nixon administration until 1970. The Occupational Safety and Health Administration was established in 1971.

Pre-Santa Barbara, offshore operations were regulated by the USGS who between 1958 and 1960 issued OCS Orders 1 through 5, requiring procedures for drilling, plugging and abandoning wells, determining well producibility, and the installation of subsurface safety devices. The orders did not specify design criteria or detailed technical standards, and they did not have any test requirements. Companies had to have certain equipment, but they did not have to test them to see if they worked. Lax enforcement contributed to a lack of attention to safety. The USGS freely granted waivers from complying with orders and did not inspect installations on a regular basis. Federal regulatory bodies were underfunded and understaffed. In 1969, the USGS Gulf Region had only 12 people overseeing more than 1,500 platforms.

If pre- Santa Barbara you had asked anyone in the offshore industry whether we were concerned about safety and the environment we would of replied, “Of course! We work and live offshore; it is our lives at stake. And we are avid fisherman and hunters; we want to protect the environment as much as anyone.” Even though we meant it, we were not yet sensitized by the budding environmental movement or by a true understanding of how safe our operations could become.

We accepted the fact that this was a hazardous business; that accidents will happen. We had a kind of perverse pride in that we were taking risks. We were doing things that had never been done before and we were providing much needed energy to the world. As in our sister industry, construction, we took for granted that people would be hurt and even killed as we went about our business. That is just the nature of this risky business. We had not yet heard the term, but we were proud of our “machismo” in the face of the little bit of residual danger we felt we could not sufficiently control.

In my own experience, the walkway from the derrick barge to the jacket we were installing was always a 20 foot long 2x12. If you met someone coming the other way you grabbed each other’s shoulders and passed around. A broken pad eye I had to inspect 90 feet in the air over McDermott’s yard in Morgan City could only be reached by way of a crane basket and then a walk on a narrow strip of grating. Real men (and we were all men in those days) did not show fear and get down on hands and knees. Who needed walkways, handrails or safety lines? The loss of a finger or two was a mark of a driller who had the necessary field experience “throwing a chain” to make up pipe.

In 1965 I accompanied our Division Safety Man for the annual inspection of the South Pass Block 27 facilities. The inspection consisted of me climbing over pipes to the top of the pressure vessels and reading the tags on relief valves to verify they had been tested to the proper pressure within the past five years. I don’t remember us checking anything else. There were no process safety sensors to check and whatever P&IDs we had were probably out of date. It didn’t matter. We had no rules for determining pressure specification breaks in the piping system and no shutdown sensors or systems.

Before condemning the industry, remember this was a time when cars did not have seat belts, home fans did not have guards, motorcycle helmets were not common, and kid’s toys had swallowable parts and sharp edges.

Downhole safety devices consisted of “storm chokes” in wells which were velocity valves set to close in the event of a higher than normal fluid velocity. The high velocity could be caused by loss of the tree or surface choke due to boat collision, explosion, etc. allowing the well to flow freely. Because they were not controlled from the surface and they had to be set to allow normal surges of the well fluids, storm chokes were not very reliable and exceptions to their installation were readily granted by the USGS.

Since the term “environmental protection” had yet to be invented and there was no permitting system or regulations governing point source discharges, we accepted a certain amount of pollution as being necessary for production. It was not uncommon to dump produced water from free water knockouts directly into the Gulf without further water treating. When flying over the Gulf of Mexico in one of Trans-Texas Airlines propeller driven Electras (after the science of fatigue analysis was far enough along to explain why their wings kept falling off in flight) one could spot the production platforms by following an oil slick back to the dot where it first appeared. The National Pollutant Discharge Elimination System did not come into effect until after the Clean Water Act of 1972.

It was also easy to identify marsh fields. They each had a burn pit where produced water and slop oil were routed for skimming and burning sending a black cloud into the air. Later on in the 1980s the required elimination of these burn pits created a South Louisiana cottage industry installing produced water treating equipment and cleaning up the soil underneath and around the old burn pits. I would like to think that without the efforts of USGS, EPA and OSHA bureaucracies to challenge the industry, we would have eventually figured out on our own how we could evolve better methods to do more for safety and for environmental protection. But, I am not sure the industry would have come as far as we have without the prodding of these bureaucracies.

Towards the end of the 1960s some companies were beginning to adopt new safety practices:

• Some operators were starting to use surface safety sensors like high pressure and high level sensors, shut in valves and emergency shutdown systems; however they were not widely used. Even where the devices were installed they were not very reliable and not tested frequently.
• Some operators were paying attention to recording lost time accidents, doctor cases, etc.
• Some operators were installing produced water treating equipment and experimenting with different designs of flotation cells.

But these were the exceptions and not the rules.

And then came Santa Barbara Channel.

Santa Barbara Channel, et al (1969)

We tend to think about the Unocal blowout in the Santa Barbara Channel as a watershed event. It certainly was, but there was really a combination of events which all occurred at around the same time and which together lead to a step change in regulations and in the way industry thought about the environment and safety. First let’s discuss the events:

1. Unocal Santa Barbara (Figure 1):

On January 28, 1969 there was a blowout on Unocal’s Platform A in the Dos Cuadras Offshore Oil Field six miles off Santa Barbara County, California. Unocal had obtained an exemption from the regulations from the USGS and the well had been drilled with an inadequate casing design. When the well reached its total depth of 3,479 feet only 239 feet of conductor pipe had been installed and the rest was open hole. In pulling the drill pipe out of the well a suction was created (the well was “swabbed in”) and the well began to flow. The crew was able to shut-in the well with blind rams but the pressure at the toe of the conductor pipe was sufficient to breakdown the formation and cause a flow outside of the conductor pipe to the surface. A proper design would have had a 300 ft. conductor and an 800 to 900 ft. surface casing.

In the first ten days before the well itself was shut-in with heavy mud and cement pumped from the surface about 80,000 to 100,000 barrels of oil flowed to the ocean. Seeps which had been opened up in the shallow rock continued to flow intermittently for over 12 additional months fowling the beach and local marinas.

2. Chevron Main Pass 41 (Figure 2):

On February 10, 1970 at 3 AM a fire broke out on Chevron’s Platform C in Main Pass 41 Field. A service representative had left the platform at 2:30 AM. The cause of the fire is unknown but eventually flow from eight of the wells on the platform was uncontrolled and contributing to the fire. On March 10 the second attempt to blow out the fire with explosives was successful and on March 13 the first two wells were capped. Others were capped during the period March 14 to 31 by relief wells, by pumping into them or in one case by shooting off the wing valve or choke and allowing the storm choke to activate. Most of the oil was consumed in the fire but about 30,000 to 65,000 barrels of oil entered the Gulf.

3. Shell Bay Marchand (Figure 3):

In December, 1970 there was a blowout on a well on which workover operations were being conducted. At the same time, a rig was drilling a well on the platform and several wells on the platform which had previously been drilled and completed were producing. Four people were killed and eventually 11 wells on the platform were contributing to the fire as storm chokes did not close. Some wells bridged over and plugged themselves, some were extinguished by relief wells, and in one case a high powered rifle was used to cause failure of a wing valve or choke allowing the flow to increase and activate the storm choke. The last well stopped flowing after 155 days.

The initial investigation after the Santa Barbara blowout showed that the regulations for drilling were not adequate. The USGS had granted Unocal a waiver from existing regulations to use the inadequate casing design without properly analyzing the requests. In August, 1969 USGS issued revised Orders 1 to 5 and a new Order 6 (Completion of Oil and Gas Wells) and 7 (Pollution and Waste Disposal). Order 6 required that wellhead equipment should be rated and pressure tested for shut-in pressures and that casing pressure between the production casing and the next string should be tested and repaired if there is sustained pressure. Order 7 required that spills of a substantial size or spills where the size cannot be determined be reported immediately (Unocal did not do so and USGS found out about the spill from the press), and established that the leasee had the obligation to pay for any cleanup operations. It is interesting that the topics in Orders 6 and 7 had not been covered by the existing Orders 1 to 5.

Initially the industry objected to these revision and the new Orders and claimed they were too restrictive and not necessary. We will see this seems to normally be the first reaction of our industry to any new regulation. This is true even to some regulations we eventually came to adopt as critical to safety in other areas of the world where there are no safety regulations. We forget we ever thought them an unwarranted burden.

On October 30, 1970 USGS issued Order 8 (Platforms and Structures) which specified requirements for wellheads (automatic shut-in valves), flowlines (check valves), pressure vessels (high and low pressure and level sensors, relief valves), gas detectors, firefighting equipment, drip pans, etc. Order 9 (Pipelines), issued the same date, specified requirements for pipeline design, shut-in valves and check valves.

Initially, when they had first been proposed, industry had objected to Orders 8 & 9. That is why they were not promulgated in August, 1969 with the revised orders 1 to 5 and the new Orders 6 and 7. At the time sensors and control logic were primarily pneumatic. The reliability of the available sensors and three-way valves required to carry out the shut-down functions was questionable. Industry feared repetitive false signals and increased hazards from installing the devices in systems which had not been designed for them. In addition the increased hazards associated with frequent starting and stopping wells and process equipment was feared to be a greater threat to safety than any increase in safety brought about by all these new devices.

The Chevron fire and Shell blowout the very next year after Santa Barbara and the publicity of the pollution caused by all three shocked the industry into recognizing that we seemed to have a problem. For the first time industry within separate companies and as a unit in the Offshore Operators Committee (OOC) started to investigate how we could increase safety. The OOC established a Technical Sub-Committee specifically focused on improving the safety of our designs.

The experiences of all three disasters clearly showed that storm chokes were not reliable (or dependable) enough and a better solution was needed. Various companies and service companies started experimenting with surface controlled subsurface safety valves (SCSSVs) in lieu of storm chokes. Schlumberger’s Oilfield Glossary defines a SCSSV as “a downhole safety valve that is operated from surface facilities through a control line strapped to the external surface of the production tubing…The control system operates in a fail-safe mode, with hydraulic control pressure used to hold open a ball or flapper assembly that will close if the control pressure is lost.”

In June 1972, Order 5 was revised to require the installation of SCSSVs on all new wells and any old wells when the tubing had to be pulled. Eventually storm chokes were phased out. Once again many in industry felt that existing designs were not reliable and the frequency of testing and maintenance of these “downhole ball valves” would cause production disruptions and potential safety problems.

Once we were forced to make them work, industry found a way to make the sensors and safety valves more reliable. This is a great example of how the regulator, API, ASME and industry can come together and deliver a great technical safety advancement and a process solution in which functional requirements and an effective testing program are combined. The reliability of these devices has been outstanding.

Today, we would find it unthinkable to design an offshore installation without SCSSVs or a process safety shut-in system. Indeed, when the Iraqi’s retreated from Kuwait in 1990 and set fire to the oil wells many of us in the offshore industry were amazed that the wells had not been equipped with SCSSVs. I understand SCSSVs are now routinely installed in Kuwait.

Santa Barbara (1969) to Piper Alpha (1988)

In the period after Santa Barbara the focus of our safety efforts was on equipment and system design, and on personnel safety.

1. Equipment and System Design

In 1972 API formed the Offshore Safety and Anti-Pollution Equipment (OSAPE) Committee to write specifications and recommended practices for what became the 14 series of API documents. The initial subjects covered prior to 1975 were SCSSVs (14 A&B), process safety sensors and controls (14C), piping systems (14E), electrical systems (14F), and firefighting systems (14G). These were all later adopted into and incorporated by reference in 30 CFR 250, the section of the Code of Federal Regulations which replaced the OCS Orders.

The story of the development of API RP 14C is interesting. In 1971, a report was prepared by the National Aeronautics & Space Administration (NASA) for the USGS entitled “Applicability of NASA Contract Quality Management and Failure Mode & Effect Analysis (FMEA) Procedures to the US OCS Oil and Lease Management Program.” As a result of this report, USGS contracted General Electric (GE) and Southwest Research Institute (SWRI) to analyze several example offshore platform facilities and make recommendations for a technique to assure that appropriate safety devices are installed to sense and control process upsets. In 1972 the USGS published in the Federal Register their intent to require an FMEA analysis for each new installation or major modification.

Industry believed that performing a detailed FMEA on each facility would be a monumental task. In addition, a review by the OOC Technical Subcommittee of the example FMEAs which had been performed for the USGS showed that the results were internally inconsistent as well as being inconsistent from platform to platform. Unfortunately, since the FMEA documentation was so voluminous it was difficult to spot these inconsistencies without a significant amount of effort and the USGS technical staff had missed the inconsistencies.

The OOC review pointed out a different direction to arrive at a better, more consistent and more traceable result. It was apparent all facilities were made up of a small number of components (wellheads, flowlines, headers, pressure vessels, pumps, compressors, etc.) which were assembled in systems which were reasonably similar, and a shorthand FMEA system might be possible.

API formed the 14C committee to work with the OOC Technical Subcommittee in developing Recommended Practice 14C, “Recommended Practice for Analysis, Design, Installation, and Testing of Basic Surface Safety Systems for Offshore Production Platforms”. The resulting document performs an abbreviated FMEA on each of the common components on a standalone basis to identify protective devices needed to sense and mitigate production upsets. It also provides a method for taking into account the effects of assembling the component into a system which might mitigate the need for certain protection devices. Documenting and presenting the analysis in a proscribed matrix provides a simple way for a regulator or reviewer to quickly determine if the analysis was performed correctly. API RP 14C was adopted by USGS and later updated and turned into an ISO standard.

All of the API OSAPE committees included at least one USGS technical staff member. This helped keep the committees work focused on the objectives of USGS and made it easier for the USGS to accept the work and incorporate it into the CFR standards. The incidents of 1969 and 1970 had placed both the industry and its regulator under tremendous pressure. By working together in a very short period of time between 1971 and 1975 tremendous improvements were made in equipment and system design, installation and testing.

In the following fifteen years until about 1990 the focus of both industry and the regulator on equipment specification and design did not substantially change. Minor changes to the OSAPE documents were periodically made but no emerging new safety concepts were incorporated in the regulations. For the most part our collective attitude was if we just followed the regulations for design and testing of equipment and systems, and paid attention to personnel safety (see below) we would be safe. The one exception might be the beginning of the use of HAZOPs by a few large operators.

In 1974 there was an explosion in a chemical plant in the UK (Flixborough) which would eventually lead to the development of a hazard analysis technique called HAZOP for Hazard and Operability study. Over time the concept of performing design HAZOPs became popular in the downstream industry. I first heard of it being used in the offshore industry after DuPont had purchased Conoco in 1981 and introduced many of its chemical plant safety practices into Conoco’s upstream operations. By the mid-1980s several large offshore operators had determined, without any push from the regulator, to perform HAZOPs on their major offshore designs to check that the designs were actually in accordance with the OSAPE documents and perhaps uncover and mitigate potential problems which were outside the scope of the OSAPE documents. Performing HAZOPs was not a requirement of the MMS, who in 1982 became the regulator, and so they were not yet widely carried out in the Gulf of Mexico.

2. Personnel Safety

“Personnel safety” concepts focus on protecting the safety, health and welfare of individual workers. The potential workplace risks associated with personnel safety include those relating to walking and working surfaces, dropped objects, occupational noise exposure, hazardous materials handling, and lack of use or misuse of tools and personal protective equipment.

If you look at pictures of onshore construction activities from the dark ages prior to 1964 you will often see workers without a hard hat or other personal protection equipment (PPE). It is not that we didn’t know about hard hats, etc. It is just that, like seat belts in cars, their use was not enforced and thus they were often not used. I worked on a summer construction job in 1962. US Steel took a picture of us installing a new type of bell and spigot pipe in a river crossing. They drew hardhats on us before publishing the picture in their catalogue. None of us on that job owned a hard hat but US Steel figured we should have been wearing hard hats.

In 1971 OSHA came into being which focused the attention of all industries on the need for a concentrated focus on personnel safety. USCG and not OSHA has jurisdiction for personnel safety offshore. However, the attention paid by other industries to personnel safety under OSHA rules was certainly felt in offshore operations.

Throughout this period operators and contractors paid ever increasing attention to personnel safety. Operators and contractors began to track OSHA reporting statistics and it became a common belief that safety was defined by Heinrich’s 1931 Theory of Accident Prevention (Figure 4). That is, in a workplace, for every accident that causes a major injury, there are many more that cause minor injuries and since many accidents share common root causes, addressing more commonplace accidents that cause no injuries can prevent accidents that cause injuries. Thus, reducing the frequency of first aid cases will reduce the frequency of doctor cases, which will reduce the frequency of lost time incidents which will reduce the frequency of deaths.

According to the International Association of Drilling Contractors the worldwide lost time incident rate fell by over 70% from 1969 to 1988.

From a safety standpoint this period can be considered to be approximately 15 years where the focus was on compliance with equipment specification, design and testing regulations as well as a focus on personnel safety. Although the regulations went through minor modifications and updates the only real change in safety awareness was a greater attention on what safety specialists call “slips, trips and falls”. That is reducing personnel safety incidents. Overall personnel safety incidents fell dramatically during this period. When the companies paid visible attention to these indices, the staff noticed and they learned to act differently.

On the other hand, the incidence of major accidents like fatalities, loss of well control, fires/explosions, and spills>50 Barrels fell off initially as the industry learned how to be compliant with the regulations, but did not decline after that initial period even as personnel safety indices continued to drop.

The publication of OCS Order 8 in 1970 also provided the first environmental limit on oil and grease in produced water discharge. An average of four samples within a 24 hour period during a month could not exceed 50 ppm and no discharge during the month could exceed 100 ppm. It is an unexplainable bureaucratic mystery why this requirement was in Order 8,”Platforms and Structures”, and not in Order 7, “Pollution and Waste Disposal”. But such are the ways of Government.

OOC had funded a data collection project to determine the effluent quality of well-designed and operated water treating systems and based on statistical analysis USGS and OOC had agreed on these numbers. EPA had just been established and given jurisdiction over discharges on the OCS that year and had not yet done its own analysis of the data.

In 1974 OOC did a study of the 38 platforms in the Gulf which had gas flotation units for produced water treating (this was assumed to be best available technology). After eliminating the highest 10% all data points and all platforms which then averaged over 100mg/l, the survey only included 19 platforms and 1,218 data points. From this they recommended the maximum discharge limit be maintained at 100 mg/l which represented the 98th percentile of the data. Even at this level 21.5% of the 19 platforms which presumably had the best available technology would fail one month out of the year.

The first EPA effluent guidelines for produced water were issued in 1975. Due to their re-analysis of the OOC generated data plus some additional data, they mandated an average for a month to not exceed 48 mg/l (roughly the same as 48 ppm) with a maximum during the month not to exceed 72 mg/l in any one day during the month. The industry argued that the EPA had misinterpreted the data to come up with the 72 mg/l maximum and the new limit would cause disruption of production. The new regulation was promulgated and counter to industry predictions did not force shut-down of any production. I suspect this was mostly because the rules allowed us to sample the produced water with a different technique than that required by EPA to make sure the equipment was working properly prior to taking the “official” EPA samples.

The EPA had to balance on a tight rope between environmental groups who would sue if the limits were set higher than they thought they should be and the industry who would sue if the limits were set too low without adequate justification. Over the years there have been enough law suits on this one regulation to send many lawyers’ children to college.

In 1993 EPA further reduced the requirements for new sources to an average of less than 29 mg/l for the month and less than 42 mg/l for any one day. This was a substantial change and was the result of a long drawn out legal process where the industry argued the EPA statistical analysis to establish Best Available Technology Economically Achievable (BAT) upon which this standard was based was flawed. The EPA was challenging industry to meet criteria which, based on several OOC studies of existing facilities, showed that even platforms with BAT installed would fail to meet about 5% of the time.

Once again, we fought the new regulation and predicted doom. On behalf of the OOC I coauthored a paper with a statistician professor from the University of Houston to show the devastating effect his new regulation would have on production. After the regulation was passed we adjusted our operations and were able to meet it without a serious effect on production.

Today several of the major oil companies in the industry that in the past fought hard to maintain the 48 mg/l average; 72 mg/l maximum limits are on their own designing produced water treating facilities to meet 15 mg/l under the self-motivated banner of “sustainability”. Our change in produced water treating certainly shows a change in “environmental awareness”. However, perhaps as an old curmudgeon and someone who knows the 15 mg/l specification means adding another stage of equipment to operate and maintain, I am not sure this is a good thing. We lived with the29/42 limit for 20 years and no one has shown any harm to the environment. There are natural oil seeps in the Gulf of Mexico (and most places where oil and gas are found) which discharge about 1 million barrels per year into the Gulf. Assuming 29 mg/l of oil and grease in produced water discharges, this represents about 15,000 barrels of oil per year or 0.04% of the oil and grease discharged into the Gulf by the Mississippi River and a tiny fraction of that discharged into the Gulf through natural seeps. Yes, we have come a long way from accepting discharges direct from Free Water Knockouts without any further treatment, but are we crazy?

OXY Piper Alpha (1988- Figure 5)

On July 6, 1988 at 10 PM an explosion occurred on Oxy’s Platform Alpha in the UK North Sea. By 11 PM 167 people died. During the day shift, a relief valve on the discharge of condensate pump “A” had been removed for its annual safety inspection. The pump was vibrating and taken out of service for maintenance. No work had been performed on the pump. During the night shift, condensate pump “B” tripped off line and could not be restarted. Due to failures in the permit to work and lockout-tagout procedures, the night crew was unaware the relief valve had been removed. It was located in the compressor module which was in a separate module above the pump. When they opened the suction valve on pump “A” 700 psi condensate was routed directly to the compressor module. There was an explosion which blew out the walls separating modules and started a fire in the oil process module. Twenty minutes later falling debris caused a gas pipeline which crossed Piper from Tartan to part and a fire ball to engulf the entire platform.

This tragedy shocked the whole industry. We had not conceived it possible that we could lose so many people due to a process accident. In the UK Piper Alpha led to a major overhaul of the regulatory process and the implementation of the Safety Case regime. In the US the MMS asked the Marine Board of the National Research Council to look at alternatives to inspecting safety and MMS began to contemplate the implementation of Process Safety Management (PSM) requirements to offshore operations.

1. Marine Board Report (1990)

In 1990 the Marine Board issued its report “Inspection Alternatives for Outer Continental Shelf Operations”. This report pointed out that both industry and the MMS had been concentrating their efforts on compliance to the regulations which focused on equipment and safety systems. Industry was developing an 'attitude of compliance'. As long as they were in compliance with the regulations and passed an MMS inspection they were by definition safe. Yet the accident history showed that the causes of deaths, fires and explosions, and spills had nothing to do with failure of safety systems to operate as designed or failure to have the proper equipment in place. The “majority of accident events occurring on the OCS in a representative year (1982) were related to operational and maintenance procedures or human error that are not addressed directly by the hardware-oriented PINC list”. The PINC list is a list of Potential Incident of Non-Compliance which was used by MMS inspectors (and still used by BSEE inspectors) to test compliance to a specific regulation.

The report concluded the MMS should “place its primary emphasis on detection of potential accident-producing situations—particularly those involving human factors, operational procedures, and modifications of equipment and facilities.”

2. Process Safety Management

OSHA published in 1990 an intent to establish a proposed standard, “Process Safety Management of Highly Hazardous Chemicals” (PSM), as a result of accidents in chemical process plants and refineries including the 1984 Bhopal, India, incident resulting in more than 2,000 deaths and the 1989 Phillips Petroleum Company, Pasadena, TX, incident resulting in 23 deaths and 132 injuries, A final rule was published in 1992. OSHA has no jurisdiction offshore in OCS waters, but the MMS indicated in the Federal Register a desire to adopt PSM for offshore.

After OSHA adopted PSM, API then Published Recommended Practice 750 which defined the elements required for refineries to meet the intent of PSM. In 1993 API RP 75 “Safety and Environmental Management Programs on the Outer Continental Shelf (OCS) Operations and Facilities” (SEMP) was published in the hope that we could convince MMS to adopt it rather than a version of OSHA’s PSM with no offshore input. MMS had participated with two of their technical experts on the API committee and there was every indication they would incorporate the RP in the regulations.

SEMP was really a step change in the way we looked at safety. It basically said safety had to be managed in much the same way that we manage any other part of our business by applying the management principles of Planning (Leadership Commitment, Employee Participation, Process Safety Information, Process Hazards Analysis, Pre-Startup Safety Review, and Emergency Planning and Response), Organizing (Operating Procedures, Safe Work Practices, and Training), Implementing (Contractor Safety, Mechanical Integrity, and Management of Change), and Evaluating (Incident Investigation, Compliance Audits, and Records and Documentation).

A Companion document to SEMP was also created by API in 1993; “RP 14J Recommended Practice for Design and Hazards Analysis for Offshore Production Facilities”. This was referenced in SEMP as a guideline for addressing the specifics of the Hazards Analysis element and the proper use of HAZOPs.

To its credit, OOC and API embraced SEMP and encouraged its members to implement it even before a final rule was promulgated. OOC and API working with MMS put on workshops to train operators as to the meaning of the various elements of SEMP and help in sharing experiences in implementation.

It is an interesting side note about the state of safety awareness in the industry in 1993 that the title specifically mentioned “OCS Operations and Facilities”. The implication is that SEMP only applies to US operations where the term “OCS” applies. As a committee member I specifically remember when my motion to change “Outer Continental Slope (OCS) Operations and Facilities” in the title to “Offshore Operations and Facilities” was voted down as 'we don’t want to be forced to live with this in other locations.' That is, in 1993 the state of our safety awareness as an industry was, 'We will adopt SEMP if we have to, but we are not sure it is worthwhile'. In later revisions, as the industry’s increased attention to safety issues and knowledge of safety theory deepened, the title of RP 75 was changed to Safety and Environmental Programs for Offshore Operations and Facilities.

Another interesting note: The Piper Alpha accident occurred because a relief valve had been removed for a safety test and the permit to work and lockout-tagout systems did not work as written. In the Gulf of Mexico it is normally the practice to test relief valves in-place using either a pilot operated valve and testing just the pilot or by installing a lock open valve underneath the relief valve and a test port so the relief valve setting can be tested by applying an artificially high pressure. If the relief valve passes the test, it is left in place and not removed. In the North Sea the same oil companies which test relief valves in-place in the Gulf of Mexico still remove relief valves for an annual bench test as was done on Piper Alpha.

There is no doubt that from the standpoint of the relief valve alone a bench test is more accurate and allows the valve to be cleaned and maintained. It is also no doubt that the act of removing a relief valve for a bench test introduces the possibility of a Piper Alpha incident and increases the risks of dropped object and personal injury from handling heavy objects.

It has always puzzled me that in the 20 years after Piper Alpha, industry has not figured out, balancing all the risks, which is the best way to test a relief valve and that companies which do it one way in the North Sea are perfectly comfortable doing it another way in the Gulf of Mexico. Maybe the lack of any quantified risk analysis study of the two alternatives says something about industry’s faith in quantified risk analysis in safety matters where the data is sparse. Perhaps after performing hundreds of Safety Cases in the North Sea which do not address this issue, it also says something about our awareness of potentially critical safety issues and the usefulness of Safety Cases in uncovering potential problems.

Piper Alpha (1988) to Macondo (2010)

In the twenty years between Piper Alpha and Macondo some oil companies had taken to heart the recommendations in the Marine Board Report and SEMP, and had improved their understanding of how best to manage safety and address human factors, operational and work procedures, management of change, hazards analysis, etc. They had adopted advance incident reporting and root cause analysis techniques, behavioral safety systems and increased training for operating personnel.

I wish I could say the same for industry in general; but I can’t. Just as industry was getting ready to embrace SEMP, and MMS was starting to promulgate a rule based on SEMP and RP 14J, a Congressional election based on the Republican “Contract with America” changed the political environment towards regulation. At the same time that some smaller operators were lobbying with their Congressmen against making SEMP a requirement, the MMS Regions were opposing the adoption of SEMP. The Regions had a prescribe, approve and inspect culture and did not approve of a goal setting, management system approach which they would find hard to inspect.

The MMS Head Office was forced to take the politically correct position that since SEMP was good for the oil companies and they had shown a willingness to operate by its precepts there was no need to make it a rule. The MMS encouraged the industry to adopt SEMS on a voluntary basis and for a few years had the industry self-report their percent complete in its adoption. Most companies reported they had adopted certain elements, were in the process of adopting others and were considering adopting the rest.

Over time participation by industry in the MMS self-reports declined, and many companies forgot SEMP existed or just paid it lip service. They may have had some written procedures but they made no effort to assure they were followed. We were back to the “compliance mentality” identified by the Marine Board, and the MMS knew it but could do nothing about it.

Industry continued its concentration on the Heinrich Triangle and personnel safety. As shown in Figure 6 the loss time incident rate and other measures of personnel safety kept improving. Industry congratulated itself that it was doing the right thing and safety awards and bonuses were distributed to one and all based on these measures.

This was a good thing but it did not tell the whole story. Figure 7 shows that the Heinrich Triangle did not necessarily apply to the low frequency, high consequence incidents the industry was experiencing. Although there are improvements in personnel protection indices throughout the time frame it is difficult to see a trend in the incidents listed in Figure 7.

Figure 7: GOM Loss of Well Control, Fatalities, Explosions (BSEE)

Year	Loss of WellControl	Fatalities	Explosions
1991	6	2	1
1992	1	4	0
1993	2	1	1
1994	0	6	1
1995	1	8	0
1996	4	10	8
1997	5	8	9
1998	7	14	4
1999	5	5	7
2000	9	5	2
2001	9	7	6
2002	6	6	3
2003	5	10	6
2004	4	3	4
2005	4	5	2
2006	2	10	0
2007	7	5	*
2008	8	11	*
2009	6	4	*

* Indicates Explosions no longer reported separately

In 2006 MMS started the process of promulgating SEMP as a regulation. The OOC objected on the grounds that it was not needed. They contended industry understood the need for safety management systems and a regulation would just duplicate efforts and create a paperwork burden for no increase in safety. This was perhaps true for the companies represented on the OOC Safety Committee, but perhaps not true for many of the other operators in the Gulf of Mexico.

In 2009, as a response to industry’s objections and after a thorough review of what was causing accidents, MMS then proposed that the new rule would only contain four elements of SEMP (Hazard Analysis, Management of Change, Operating Procedures and Mechanical Integrity). The OOC took the position that a SEMP regulation was still not needed, especially if the MMS’ focus would be on documentation, but if SEMP were to be implemented it should be implemented as a whole as the elements support each other. The MMS than proceeded to document a rule to implement SEMP in its entirety and had prepared a draft Federal Register announcement which was almost completed and ready for publication. But then came April 20, 2010.

BP Macondo (April 20, 2010- Figure 8)

At approximately 10 PM on April 20, 2010 a blowout occurred on the Transocean Deepwater Horizon rig. It was in the process of temporarily abandoning the Macondo well for BP in Mississippi Canyon 252 in 5100 ft. of water. The ensuing explosion and fire led to the loss of 11 lives, the sinking of the rig and the worst oil spill in US history. Approximately 4 million barrels of oil flowed from the well during a period of 87 days until the well was finally capped on July 15. The flow from the well was estimated to exceed over 50,000 barrels per day at various times. 115 people who were on the rig at the time of the blowout were saved.

Production casing had been set and cemented. The negative pressure test clearly showed that the cement job was not adequate but the results had been misinterpreted by the crew. The first indications that the well was flowing were available 50 minutes before the blowout but were overlooked or ignored. The blind shear rams on the BOP were activated after the explosion but did not totally close. As was the case with Piper Alpha, no one in industry, not the oil companies nor the MMS, anticipated that an accident of this magnitude could occur. All previous thinking had been around a maximum worst case discharge of 10,000 barrels a day. Over 50,000 wells had been drilled by industry in the US OCS of which 4,000 were in over 1,000 feet of water using subsea blowout preventers. The last major blowout resulting in oil coming ashore was Santa Barbara in 1969. From 1971 through 2009, a total of 1,784 barrels was spilled as a result of loss of well control and there were no incidents where a BOP failed to stop flow.

Just as with Piper Alpha, this was a very rare event which no one thought could ever happen but which had very high consequences and which indeed happened. The industry and regulator had focused on personnel protection (injury) metrics and believed in the Heinrich Triangle. We had convinced ourselves we were doing what needed to be done. But clearly there was more that could be done. There were mistakes made in the planning and implementation of the abandonment operation in the days prior to the accident and there were mistakes made on the rig the day of the accident. The question remains, “How could people who were trained to do their jobs, told to be safe, and had no intention of risking their lives, make such mistakes?” The answers reside with understanding human factors, process safety management concepts and developing an organizational culture of safety.

On April 30, only 10 days after the accident, while the well was still flowing and the causes were under investigation and not entirely clear, the President charged the Secretary of the Department of Interior to give him a 30-day interim report of actions that could be taken to improve safety. The Secretary asked IADC and API to put together a Joint Industry Task Force (JITF) to make recommendations, and asked the National Academy of Engineering to put together a group of experts to peer review the report. The report dated May 27 contained many of the recommendations of the JITF. Many of these have subsequently been adopted as regulations. Unfortunately it also included a 6-month moratorium on new permits and a stop to drilling for 6-months on the 33 wells currently being drilled. The moratorium had not been recommended by the JITF nor agreed to by the peer reviewers and this caused some controversy.

The point I wish to make here is that in a matter of weeks the industry could put together a JITF which came up with numerous technical and operational recommendations as well as some potential changes in regulations which can make drilling safer. Perhaps it is our failure of imagination that we need an example of an accident to jolt us into thinking about improvements that can be made and should be made globally in our operations.

The recommendations address well-control and well abandonment operations; specific requirements for devices, such as blowout preventers and their testing; industry practices; worker training; inspection protocols; and subsea containment systems. To its credit the JITF also focused on the need to address safety management systems by adopting the IADC safety case guidelines for drilling rigs, SEMP systems for operators and bridging documents to tie the two together.

In October, 2010 the DOI finally promulgated Safety and Environmental Management Systems (SEMS) as 30 CFR 250 Subpart S. This document, whose issuance was actually delayed by the Macondo blowout, is based on and refers to API RP 75 (SEMP). To DOI, SEMS was meant to be a performance-based regulatory approach which aimed to promote a culture of safety by requiring all operators of rigs and platforms to develop operational, safety, and environmental management plans. It is a departure from historic MMS prescriptive regulations.

It has become clear to many in the industry that the key to reducing the likelihood of very low frequency very high consequence incidents is by assuring a culture of safety throughout our operations. Managing safety through a SEMS system is a necessary but not sufficient condition for ensuring a culture of safety. For a culture of safety to exist from an organizational perspective there must be: mechanisms establishing structure and control and actions establishing safety norms. From an individual perspective there must be mechanisms establishing competency and actions establishing motivation.

SEMS establishes the mechanisms but it requires leadership on the part of every supervisory level of the organization to supply the necessary actions to firmly establish the norms and motivations. Many in industry have adopted this new view of moving from a compliance attitude to prescriptive regulations and a focus on personnel safety, to the more expansive view of maintaining compliance and personnel safety but also assuring the mechanisms and actions are in place to develop a culture of safety which will create the appropriate safety norms and behaviors.

The Center of Offshore Safety has been established by industry. It has developed protocols for auditing SEMS, a process for certifying SEMS auditors, and guidelines for supervisors and executives for demonstrating appropriate actions in field visits. It is a clearing house for sharing information on establishing and maintaining a culture of safety amongst its members.

Unfortunately not all operators are members. In the beginning only deepwater operators could join but as of April, 2014, membership was opened to all operators as well as contractors. Membership means dues and only a small number of the 70 to 120 operators (depending on how you count) are members. Perhaps it would be better if BSEE made membership in a modified COS organization compulsory. COS could be re-organized to split entirely from API, which is perceived to be heavily influenced by a few majors, have a higher participation by small and medium size companies on the Board, and charge dues apportioned by production to make it affordable by all.

Another effort by industry to help foster an improved safety culture was undertaken by the Society of Petroleum Engineers. SPE has published a Technical Report giving guidelines for addressing “Human Factors, Process Safety and Culture” and has established a Human Factors Technical Section to further understanding in this area. SPE now holds conferences and workshops worldwide to promote new concepts in safety and environmental management.

BSEE has established the Offshore Energy Safety Institute (OESI) to provide a forum for dialogue, shared learning and cooperative research among academia, government, industry and other non-government organizations. The Institute is a partnership of Texas A&M, University of Texas and University of Houston. Unfortunately, the focus seems to be on providing recommendations and technical assistance to BSEE related to best available and safest technologies (BAST) in developing and maintaining and testing equipment. This once again puts the focus on equipment design, maintenance and testing. OESI does have a mandate to train Federal employees to enable them to remain current in state-of-the-art technology. I hope this component of OESI’s charge will include safety and regulatory theory, helping the government evaluate the effectiveness of SEMS and promoting safety culture. I can dream, can’t I?

The Post Macondo World

We have come a long way since the days of missing fingers and being able to see produced water discharges from commercial planes flying over the Gulf of Mexico. We have progressed to recognizing the importance of the need for appropriate standards for equipment and system design, the importance of paying attention to personnel safety, the need to manage safety using the same principles of planning, organizing, Implementing and evaluating that we use for managing any other activity, and finally to the current efforts to incorporate the science of human factors and developing a culture of safety into operations.

From 1991 to 2009 we averaged 6.5 deaths and 4.8 incidents of loss of well control per year in the Gulf of Mexico. Macondo occurred in 2010. In the years 2011 to 2013 we averaged 3.3 deaths and 5.0 incidents of loss of well control per year. It is still too early to tell if these numbers mean we have learned lessons and things are better or if they show there has been no significant change in safety. I think we are safer, but there are things I worry about:

1. Compliance Attitudes

There are 120 separate operator entities in the Gulf of Mexico, although since some are related companies the true number may be around 70 independent entities. Many of the larger operators and the leading smaller operators have gotten the message that safety is more than compliance to regulations and passing a government inspection. But I think I see evidence that the industry as a whole and BSEE as a regulator are still exhibiting signs of a compliance mentality.

SEMS should be a performance specification. It outlines the elements that should be addressed but it is not intended to be read as to how to specifically perform these elements. The specifics should depend on the organization or organizations performing the work, the work being performed, and the installation. The goal is not in the documentation but in the thought process that goes into the task at hand.

Unfortunately, the first thing BSEE did was establish a PINC list of specific items that must be addressed in the documentation of each element. The PINC list looks a lot like a checklist of forms and paperwork that must be in place. BSEE later withdrew the PINC list but the damage to SEMS thinking by both BSEE and industry had been done.

You can’t blame BSEE alone. As soon as the requirements where announced in the Federal Register, BSEE was barraged by questions as to how to interpret each word and exactly what constitutes acceptance in BSEE’s opinion. That is, both BSEE and most of the industry became focused on SEMS as a regulation which specifies paperwork to be filled out and filed in order to pass an inspection, and not items to be considered in planning, organizing, implementing and evaluating activities to assure safety of operations.

Many operators had outside parties provide them with complete SEMS programs based on a standard template and set of forms. Forms are filled out quickly with little or no discussion or input from operating staff. For example, I have seen inadequate P&IDs, hazards analysis filled out without any real discussion, and operating instructions which were not well thought out and verified to fit actual conditions. There is nothing wrong with using templates and “go-bys” to keep from re-inventing things. However, the real goal is to have staff at all levels engaged in thinking through what is important for a specific installation and to buy-in to the intent of SEMS. That is a first step in changing behaviors.

Until BSEE changes its compliance mentality at the Regional and District level, I don’t think industry will be able to change. At MMS’ request the Marine Board of the National Academies (which had become a branch of the Transportation Safety Board since issuing its 1990 report on Inspection Alternatives) issued TRB Report 309, “Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems”. The 2012 report makes recommendations for a holistic approach that could be utilized by BSEE in inspection and auditing to work cooperatively with industry to improve the culture of safety. (I was chair of the committee that wrote the report so perhaps I am biased.)

2. SEMS Audits

A proper audit of any safety management system should find areas that need improvement. When it comes to safety there is always room for improvement. The goal of the audit is not to find a perfect system. They never exist. People are human and over time things slip. Indeed a SEMS audit that doesn’t find something is probably not a good audit. For this reason a SEMS system never wholly passes or fails.

BSEE requires operators to perform third party audits and to submit audit results to BSEE. The first round has been submitted and I have been told the quality of the audits varies greatly. This is another indication that some operators view the audits through a compliance mentality mode. Instead of caring to find out if the intent of their SEMS program is actually working in the way people perform their work, they see the audit as a document which must be processed and submitted to BSEE.

This should be a concern to industry. BSEE should be working with industry to help improve SEMS systems for those operators where improvement is needed. A little regulatory and peer pressure would go a long way. There must be lessons learned from these audits that could benefit all. I can see a great benefit in BSEE working cooperatively with a re-structured COS in this regard, but first we have to stop focusing on punishing the bad guys.

3. Punish the Bad Guys Mentality

In the US we have a mentality that all will be good if we could just locate the bad guys and punish them with INCs and penalties. Of course punishing those who willfully violate regulations and best practices is important. But does anyone really think that people who made mistakes leading up to the Macondo blowout really stopped to think that they were risking their own lives as well as those of their co-workers? Does punishing someone for a paper work failure really make him see the importance of managing safety or just the importance of managing paper? Does punishment alone really change behavior?

Punishment gets people’s attention but so do accidents. No amount of punishment at this point is necessary for anyone in this industry to better understand the cost of Macondo to BP and its contractors. No amount of punishment will create a more thoughtful job safety analysis from someone who doesn’t see the benefit of a thorough job safety analysis.

BSEE and the industry working together need to improve the way safety is managed in actuality rather than just the way it is documented to avoid punishment. It is a shame that the Offshore Energy Safety Institute seems to be focused on BAST for equipment rather than the much harder problem of what can industry and BSEE do, working together, to change behaviors.

4. Safety Culture

Many in industry have come to realize the benefits of developing and maintaining a safety culture within their organization. This is perhaps not true for industry in general.

I think we are still a long way from having everyone at all levels of every offshore operator and contractor organization understand that it is their actions, and not just their pronouncements, HSE organizations and safety programs which determine if their organization will exhibit the traits of a highly reliable organization. These traits (which include: Leadership communication, Problem identification and resolution, Acceptance of personal accountability, Planning and control of work processes, Continuous learning, and Freedom to raise concerns) characterize organizations with good safety cultures.

Leaders at every level of supervision from the CEO to the gang pusher have to buy-in to the safety management system, take action to enforce the concepts as real, and perform good audits to see where improvements should be made in how the system is translated into actions in the work being done.

5. Imagining the Impossible

No one before Piper Alpha thought such an accident was possible in a producing operation. No one before Macondo thought that such loss of life and pollution was possible in a temporary abandonment operation. The next unimaginable accident will probably not mirror either Piper Alpha or Macondo. We are good at battling the last war. In hindsight we always see there were clues we overlooked which indicated where the problem would arise. If not, we would never have come up with the recommendations in the 30-Day report after Macondo as quickly as we did.

I don’t know how to see those clues today. My personal worry is that a deepwater riser will part prior to the boarding valve on a floating platform. These risers can contain production from one or more wells which could cause quite an explosion or fire. A subsea valve, miles away where the riser hits the sea floor, may not help because of the inventory between the valve and the platform. A heavy valve suspended in a riser causes a stress concentration which can lead to fatigue failure. Perhaps we should be working on a kind of Surface Controlled Riser Safety Valve (SCRSV) which would fit inside the riser, be easily tested and repaired, and which will not cause stress rises due to weight and stiffness in a steel catenary riser.

Maybe this is a stupid idea or impossible to do. I don’t know. I wish we had a forum to look for these stupid ideas and respond to them before the next disaster occurs and we figure out we knew how to avoid it all along.

6. Training the Next Generation

In the previous ten years before 1964 when I started my career, the oil industry had hired very few engineers. This was great for me. I had to learn fast and my employer had to give me responsibilities perhaps even before I was really qualified for them. The industry survived my class and the following classes because in those days there were only about a dozen operators in the Gulf of Mexico and almost all had training programs.

There are two types of knowledge:

Explicit Knowledge: Facts which can be codified, written down, and easily shared, and

Tacit Knowledge: Understandings based on experience which are difficult to capture, codify and share

I was given a one year training program of multiple assignments at several field locations and amongst various engineering groups, and went through three months of classroom training before I was allowed to do engineering work under the direct supervision of a mentor.

I am afraid that today we are not doing as good a job at preparing new engineering staff as well as we did in the past. In the oil companies formal training programs have been cut back as have been opportunities for field trips and field assignments. The oilfield service companies do better.

In the past engineering companies in the projects, construction and facilities area of specialty relied on construction company and oil company trained engineers for their technical backbone of key staff. Others got to spend lots of time at fabrication yards and offshore during installations. This is now harder to do as there is less construction of major offshore projects being done locally, and oil companies are reluctant to allow young engineering company personnel to spend time offshore.

In the past we relied maybe too heavily on the tacit knowledge of engineering company key staff. Now we are forced more and more to rely on policies, procedures and stage gates to assure safety of design. I worry that in the long run this may have a negative impact on both the safety and the efficiency of our offshore designs.

I need to point out it is not all bad. The level of education and technical knowledge of our operating staffs has been increasing all through the past 50 years. I had an occasion early in my career where the foreman in charge of starting up a project I had designed could not read the startup procedure I had prepared for him. I doubt that would happen today.

Conclusion

The history of safety awareness in the past 50 years is actually a good story. Yes, we have tended to make step changes in safety only after disasters or threats of regulations. Our record is spotty and at times as an industry we fought change that we now know we should not have done. But we have made tremendous changes in safety while at the same time have taken on ever more difficult and risky operations to provide the world with the energy it needs. Within the industry there was never a time when we lacked leadership to push safety awareness to higher levels. We have made mistakes, but we have learned how to be better along the way. We have had regulators who are dedicated to the task and have helped us achieve results. They have not been perfect, but neither have we. This is a fraternity I am honored and proud to be among.