Operational safety in offshore activities is a paramount concern to the oil and gas industry. No one wants to be killed or cause harm to fellow workers, employees, or the general public. Our awareness of when and how to act on that concern has changed over the years. We have made huge strides to improve the safety and environmental aspects in the design, construction, operation, and maintenance of drilling and producing systems.
However, we can still do better on this front. The evolution of safety awareness in our industry is generally driven by the occurrence of major accidents, the threat of new regulations, and our response to those threats to assure that the regulations are practical and efficient. Based on my experience, I think further industrywide changes in attitude are necessary for a true safety culture.
Besides, real men—and we were all men in those days—did not show fear. Who needed walkways, handrails, or safety lines? The loss of a finger or two was the mark of a driller who had the necessary field experience in “throwing a chain” to make up pipe.
I joined the industry in 1964, before a well operated by Pan American Petroleum (Unocal) blew out in the US Gulf of Mexico (GOM) and engulfed the CP Baker barge in a fire (June 1964) that put offshore safety and potential pollution on the public radar. The vessel was a catamaranlike drilling barge, and the force of the blowout caused an eruption in the water between the hulls. Many of the crewmen jumped to safety into the sea, but 22 died.
Back then, we accepted that this was a hazardous business in which accidents would happen, and we took for granted that people would get hurt, and even killed, as we went about our business. We took a kind of perverse pride in that fact. We were doing things that had never been done before and providing much needed energy in the world.
Besides, real men—and we were all men in those days—did not show fear. Who needed walkways, handrails, or safety lines? The loss of a finger or two was the mark of a driller who had the necessary field experience in “throwing a chain” to make up pipe.
We have come a long way from the days of missing fingers. Our industry recognizes the importance of appropriate standards for equipment, system design, and paying attention to personnel safety. We understand the need to manage safety using the same principles of planning, organizing, implementing, and evaluating that we use for managing other activities. Efforts are being made to incorporate the science of human factors and a culture of safety into our operations.
Those efforts have borne some fruit. From 1991 to 2009, there was an average of 6.5 deaths per year in the GOM. In the 3 years after the Macondo blowout (April 2010) from 2011 to 2013, there was an average of 3.3 deaths per year. It is too early to tell if these numbers mean that we have learned lessons and things are better, or if there has been no significant change in safety. I think we are safer, but there are things I worry about.
How We Got Here
In 1965, I accompanied our division safety man for the annual inspection of the South Pass Block 27 facilities in the GOM. The inspection involved my climbing over pipe to the top of the pressure vessels and reading the tags on relief valves to verify they had been tested to the proper pressure within the past 5 years.
I do not remember us checking anything else. There were no process safety sensors to check, and the piping and instrumentation diagrams we had were probably out of date. It did not matter. We had no rules for determining pressure specification breaks in the piping system and no shutdown sensors or systems.
Before condemning the industry, remember this was a time when cars did not have seat belts, home fans did not have blade guards, motorcycle helmets were uncommon, and children’s toys had sharp edges and small parts that could be swallowed.
Since the term “environmental protection” had yet to be invented and there were no permitting systems or regulations governing point source discharges, we accepted a certain amount of pollution as being necessary for production. It was not uncommon to dump produced water from freewater knockouts directly into the GOM without further treatment.
When flying over the GOM in one of Trans-Texas Airlines’ propeller-driven Electras (after the science of fatigue analysis was advanced enough to explain why their wings kept falling off in flight), one could spot the production platforms by following an oil slick back to the dot where it first appeared. The National Pollutant Discharge Elimination System did not come into effect until after the US Clean Water Act of 1972 was implemented.
It was also easy to identify marsh fields. They had burn pits where produced water and slop oil were routed for skimming and burning, which sent a black cloud into the air. Later in the 1980s, the required elimination of these burn pits created a cottage industry in south Louisiana for the installation of produced water treating equipment and the cleaning of the soil underneath and around the old burn pits.
I am uncertain that we would have come as far as we have in developing better methods for safety and environmental protection without the prodding of bureaucracies such as the US Geological Survey and the US Environmental Protection Agency to challenge the industry. I would like to think that we would have eventually figured something out on our own.
Toward the end of the 1960s, some companies were beginning to adopt new safety practices. Some operators were starting to use safety sensors such as high-pressure and high-level sensors, shut-in valves, and emergency shutdown systems. Some were paying attention to recording lost time accidents and cases requiring medical care. Some were installing produced water treating equipment and experimenting with different designs of flotation cells. But these were the exceptions and not the rules.
And then came the Unocal blowout in the Santa Barbara channel in 1969. And Piper Alpha in the UK North Sea in 1988. And Macondo.
And now, here we are today.
Compliance Attitudes
There are 120 separate operator entities in the GOM, though the true number may be around 70 since some companies are related. Many larger operators and some of the leading smaller operators have gotten the message that safety is more than compliance with regulations and passing a government inspection. Still, I see evidence that the industry as a whole and its regulator, the US Bureau of Safety and Environmental Enforcement (BSEE), are exhibiting signs of a compliance mentality.
In 2010, 6 months after Macondo, the US Department of the Interior enacted the Safety and Environmental Management Systems (SEMS), which aimed to promote a safety culture by requiring all operators of rigs and platforms to develop operational, safety, and environmental management plans. It was meant to be a performance-based regulatory approach, and it should be a performance specification. It outlines the elements that should be addressed, but the specifics should depend on the organization, the work being performed, and the installation. The goal is not in the documentation, but in the thought process that goes into the task at hand.
Unfortunately, the first thing BSEE did was establish a list of program-specific potential incidents of noncompliance (PINC) that had to be addressed in the documentation of each element. The list looked like a checklist of forms, which set the foundation for the current line of thinking toward SEMS: Instead of viewing it as a way to evaluate operational safety, it was perceived as paperwork to be filled out. Though BSEE later withdrew the PINC list, the damage had been done.
But you cannot blame just BSEE. As soon as the requirements were announced in the Federal Register, BSEE was barraged by questions on how to interpret each word and exactly what constitutes acceptance. So while the government set the foundation, we helped bog down the process in endless minutiae.
On top of that, we did not pay attention to the details. Many operators had outside parties provide them with complete SEMS programs based on a standard template and set of forms, which were filled out quickly with little or no discussion or input from operational staff. I have seen inadequate piping and instrumentation diagrams, hazard analyses filled out with no real discussion of anything, and operating instructions that were not well thought out or verified to fit actual conditions. There is nothing wrong with using templates and “go-bys” to keep from reinventing things. However, the real goal is to have staff at all levels engaged in thinking through what is important for a specific installation and to buy in to the intent of SEMS. That is a first step in changing behaviors.
The industry will not change until BSEE changes its compliance mentality at the regional and district level. At the request of the Minerals Management Service, the Marine Board of the Transportation Research Board (TRB) of the National Academies issued TRB Report 309, “Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems.” The 2012 report, the authoring committee of which I chaired, makes recommendations for a holistic approach that BSEE could use in inspections and audits to work cooperatively with the industry in improving safety culture.
SEMS Audits and Punishment
A proper audit of any safety management system should unearth areas that need improvement because, when it comes to safety, there is always room for improvement. A perfect system does not exist. People make mistakes. Things slip over time. The goal of the audit is not to find a perfect system, and an SEMS audit that does not find something is probably not a good audit. For this reason, an SEMS system never wholly passes or fails.
BSEE requires operators to perform third-party audits and to submit the results to the bureau. The first round of results has been submitted, and I have been told that the quality of the audits varies greatly. This is another indication that some operators view the audits through a compliance mentality mode. Instead of caring to find out if the intent of their SEMS program is actually working in the way people perform their work, they see the audit as a document that must be processed and submitted to BSEE.
This should be a concern to the industry. BSEE should be working with the industry to help improve SEMS for those operators who need improvement. A little regulatory and peer pressure can go a long way. There must be lessons learned from these audits that could benefit all. I see a potentially great benefit in BSEE working cooperatively with a re-structured Center for Offshore Safety in this regard, but first we have to stop focusing on punishing the bad guys.
In the US, we have a mentality that all will be good if we could just locate the bad guys and punish them with issuances of “incidents of noncompliance” and penalties. Of course, punishing those who willfully violate regulations and best practices is important. But does anyone really think that people who made mistakes leading up to the Macondo blowout really stopped to think that they were risking their own lives as well as those of their coworkers? Does punishing someone for a paperwork failure make him see the importance of managing safety or the importance of managing paper? Does punishment alone change behavior?
Punishment gets people’s attention, but so do accidents. No amount of punishment at this point is necessary for anyone in this industry to better understand the cost of Macondo to BP and its contractors. No amount of punishment will create a more thoughtful job safety analysis from someone who does not see the benefit of it.
Initially, the Offshore Energy Safety Institute seemed to be focused on the best available and safest technologies for equipment. Hopefully, BSEE will realize this is the wrong focus and work with the industry to solve the much harder problem of changing behaviors. Safety is driven by a managerial philosophy that leads to desired behaviors; it is not merely something that is documented to avoid punishment.
Imagining the Impossible
Many people in our industry have come to realize the benefits of developing and maintaining a safety culture within their organizations. This is perhaps untrue for the industry in general.
I think we are still a long way from having everyone at all levels of every offshore operator and contractor organization understand that it is their actions and not just their pronouncements, health, safety, and environment organizations, and safety programs that determine if their organization is highly reliable.
The traits that characterize organizations with good safety cultures are as follows:
- Leadership communication
- Problem identification and resolution
- Acceptance of personal responsibility
- Planning and control of work processes
- Continuous learning
- Freedom to raise concerns
Leaders at every level of supervision, from the chief executive officer to the gang pusher, have to buy into the safety management system, take action to implement the concepts, and perform good audits to identify areas for improvements in the system and how they will be translated into actions. Before the Piper Alpha explosion, we had not conceived that it was possible that a process accident could lead to such a massive loss of life. Before Macondo, no one thought such loss of life and pollution was possible in a temporary abandonment operation.
The next unimaginable accident will probably not mirror either Piper Alpha or Macondo. We are good at battling the last war. In hindsight, we identify the overlooked clues that indicated where the problem would arise. If not, we would never have come up with the recommendations in “the 30-day report” (formally titled “Increased Safety Measures for Energy Development on the Outer Continental Shelf) following Macondo.
I do not know how to see those clues today. My personal worry is that a deepwater riser will part prior to the boarding valve on a floating platform. These risers can contain production from one or more wells that could cause an explosion or fire. A subsea valve, located miles away from where the riser hits the seafloor, may not help because of the inventory between the valve and the platform. A heavy valve suspended in a riser causes a stress concentration that may lead to fatigue failure.
Perhaps we should be working on a surface-controlled riser safety valve that would fit inside the riser, be easily tested and repaired, and which would not cause stress rises due to weight and stiffness in a steel catenary riser.
Maybe this is a stupid idea or impossible to do. I do not know. I wish there were a forum to explore “stupid” ideas and respond to them before the next disaster occurs and then find out that we knew how to avoid it all along.
Training the Next Generation
In the 10 years before 1964, when I started my career, the oil industry hired very few engineers. This was great for me: I had to learn fast, and my employer had to give me responsibilities, perhaps even before I was really qualified for them. The industry survived my class and the following classes because, in those days, there were only about a dozen operators in the GOM and almost all of them had training programs.
I was given a 1-year training program of multiple assignments at several field locations and in various engineering groups. On top of that, I went through 3 months of classroom training before I was allowed to do engineering work under the direct supervision of a mentor.
I am afraid that today we are not doing as good a job at preparing new engineering staff as we did in the past. The oil companies have cut back formal training programs and opportunities for field trips and assignments. The oilfield service companies do a better job of this.
In the past, engineering companies in the projects, facilities, and construction area of specialty relied on construction company- and oil company-trained engineers for their technical backbone of key staff. Others spent time at fabrication yards and offshore during installations. This is now harder to do as there is less construction of major offshore projects being done locally, and oil companies are reluctant to allow young engineering personnel to spend time offshore.
There are two types of knowledge:
- Explicit knowledge. Facts that can be codified, written down, and easily shared
- Tacit knowledge. Understandings based on experience that are difficult to capture, codify, and share
In the past, we relied too heavily on the tacit knowledge of engineering companies’ key staff. Now, we are increasingly forced to rely on policies, procedures, and stage gates to assure safety of design. I worry that in the long run, this may have a negative effect on the safety and efficiency of offshore designs.
However, it is not all bad. The levels of education and technical knowledge of operating employees have increased in the past 50 years. For example, I had an occasion early in my career when the foreman in charge of starting a project, which I designed, was unable to read the startup procedure that I had prepared for him. I doubt that would happen today.
The history of safety awareness in the oil and gas industry is actually a good story. Yes, we have tended to make step changes in safety only after disasters or threats of regulations. Our record is spotty, and at times, the industry fought change, which we now know should not have been done. However, tremendous changes in safety have been made while the industry took on more difficult and risky operations to provide the world with the energy it needs.
There was never a time when we lacked the leadership needed to push safety awareness to higher levels. We have made mistakes, but we have learned how to improve along the way. We have had regulators who are dedicated to the task and have helped us achieve results. They have not been perfect, but neither were we. This is a fraternity that I am honored and proud to be a part of.
To read Ken Arnold’s personal recollection, “History of Operational Safety Awareness in the US Gulf of Mexico: 1964 to 2014,” visit the Engineering and Technology History Wiki at www.ethw.org.
Ken Arnold is the principal of K. Arnold Consulting and was an SPE Distinguished Lecturer in 1994–1995 and 2002–2003. He is a member of the Editorial Board of Oil and Gas Facilities, the coauthor of two textbooks, and the author of more than 50 technical articles on project management and facilities design. He holds a BS in civil engineering from Cornell University and an MS in civil engineering from Tulane University. He may be reached at karnold@karnoldconsulting.com.
