Department of Commerce, Community, and Economic Development
Alaska Oil and Gas Conservation
Commission
HOME
EVENTS
DATA
Data List
Drilling
Production
Orders
Data Miner
Document Search
REPORTS
Reports and Charts
Pool Statistics
FORMS
LINKS
Links
Test Notification
Data Requests
Regulations
Industry Guidance Bulletins
How to Apply
ABOUT US
History
Staff
HELP
Loading...
The URL can be used to link to this page
Your browser does not support the video tag.
Home
My WebLink
About
Binders 50-51
50. Petroleum Safety Authority, Norway, Trends in Risk Level in Petroleum Activity, 40 pages, web posted April 275 2011, with accompanying BOE blog entry, web posted April 27, 2011 51. Internal Marathon Report, 12 October, 2010 regarding the Macondo Incident, 60 pages, web posted December, 2010, with accompanying Steffy editorial, web posted December 3, 2010, 2 pages, and BOE blog entry, web posted December 27, 2010 0 Bud's Offshore Enemy (BOE) • C7 Energy Production, Safety, Pollution Prevention, and More Magne Ognedal discusses risk management challenges April 27, 2011 by offshoreenergv "�The 2010 study of trends in risk level in the Norwegian petroleum activity (RNNP) shows a sharp rise in well control incidents and gas leaks back at a high level. Magne Ognedal, director-general of the Petroleum Safety Authority Norway (PSA), describes this as a matter of concern. More information about the study, and interviews with Magne, Torleif Husebo, and Oyyind Lauridsen can be found at the PSA site. The full report will soon be available in En lg ish. • �J PETROLEUM SAFETY AUTHORITY NORWAY RNNP 2010: major challenges in important areas 27.04.2011 1 The 2010 study of trends in risk level in the Norwegian petroleum activity (RNNP) shows a sharp rise in well control incidents and gas leaks back at a high level. Magne Ognedal, director-general of the Petroleum Safety Authority Norway (PSA), describes this as a matter of concern. Web-tv: Watch the PSA's press conference (In Norwegian) • The Norwegian petroleum industry has paid great attention over the past decade to reducing the number of hydrocarbon leaks, and has established clear reduction targets on several occasions. A goal of no more than 20 leaks above 0.1 kilograms per second in any one year was reached in 2005, and that maximum had been halved by 2007. Since then, however, the trend has been in the wrong direction, with 14 leaks in 2009, 15 in 2009 and 14 in 2010. Leaks in the 0.1-1 kg/s category showed a particular rise in 2010, while one leak greater than 10 kg/s was registered during the year. "A more purposeful and not least continuous effort is required to change this trend," affirms Mr Ognedal. Gas leaks have a big potential for causing damage because of the danger that an explosion will occur as the gas cloud spreads. Well control The indicator for well control incidents showed a generally positive trend up to 2008, but rose from 11 in that year to 28 in 2010. Even when the number of occurrences is correlated with the level of activity — in other words, the number of wells drilled — the increase is clear. • "It's very important that the industry comes up with good measures for reversing this development," Mr Ognedal emphasises. The PSA has asked the industry to get to grips with the challenges presented by hydrocarbon leaks and well control incidents. It wants the companies to come up with specific measures which can help to ensure that developments move in the right direction (link). Negative Viewed overall, the conclusions from the RNNP survey show a slightly negative movement in the risk picture during 2010. The total indicator for major accidents on both fixed installations and mobile units has flattened out over the past five -six years. "Our goal is continuous improvement," Mr Ognedal notes. "It's a matter of concern that the major accident indicator isn't moving in a positive direction." Positive But the RNNP 2010 report also presents a number of positive development trends. There were no fatal accidents on the NCS during the year. The serious personal injury frequency has also developed positively in recent years, and now stands at 0.68 per million working hours for the whole NCS. That is significantly below the average for the previous 10-year period. A positive trend was also recorded for the number of ships on collision course, which was significantly lower than the mean value for 2002-09. In addition, the indicator for the most serious helicopter incidents moved in the right direction from 2009 to last year. And a marginal improvement was seen during 2010 in the indicator for exposure to noise. "The noise problem has been on the agenda for a number of years, and we had undoubtedly expected even greater progress in this area than has been the case so far," says Mr Ognedal. "However, we've noted that the industry is now launching a dedicated project to overcome the challenges posed by noise. That's good news." On land With effect from 2006, measurements of the risk level in Norwegian petroleum • operations were extended to the industry's land -based plants. • Eight hydrocarbon leaks which did not ignite were reported from these facilities in 2010, on a par with the year before and significantly lower than the 21 recorded in 2008. No leaks which ignited occurred in 2010. Nine serious personal injuries were reported in 2010, compared with 11 in 2009. Working hours came to 12.4 million, down from 14.3 million the year before. The total serious personal injury frequency for the land -based plants was 0.73 per million working hours in 2010. RNNP in brief The RNNP process was initiated in 1999-2000 to develop and apply a tool for measuring trends in risk level in the Norwegian petroleum activity. This work has acquired an important position in Norway's oil and gas industry because it contributes to a shared understanding of risk developments by everyone involved. The RNNP process monitors risk trends with the aid of various methods, such as incident indicators, barrier data, interviews with key informants, working seminars and field work. A major questionnaire -based survey is also conducted every two years. Results from these studies are presented in annual reports, which also provide the basis for taking action to combat a negative trend. lJ d TRENDS IN RISK LEVEL r1 'Aw IN THE PETROLEUNy,ACTIVITY .f r- �s.� ifs �• •, r ,� � _ Alt,- '='?�. •• 0 r "-� Or C, - Iva E T R 0 L E U M SAFETY AUTHO,RiTY _ NORWAY PETROLEUM SAFETY AUTHORITY • Foreword Trends in risk levels in the petroleum industry are not only a matter of concern to everyone involved in the industry but are also of interest to the public at large. It was therefore a logical and important step to establish a structure for measuring the effect of the collective HES work in the industry. As a tool, RNNP has undergone substantial development since its initial years 1999/2000 (the first report was issued in 2001). This development has taken place in the context of collaboration between the partners in the industry and consensus that the chosen approach is sensible and rational with a view to establishing a basis for a common understanding of the level of risk. In 2010 the first report on acute discharges to sea was published. The report was based on a combination of RNNP data and data from OLF's Environmental Web database. Because of the period required for the collection of data for the Environmental Web, the RNNP report on acute discharges will not be published until the autumn. The intention is that this should also be an annual report. The petroleum industry has a high level of competence in the field of HES. We have sought to draw on this competence by making the process an open one and inviting key resource • persons from operating companies, shipping companies, the Civil Aviation Authority, helicopter operators, consultancy firms, research and teaching institutions to contribute. Objectivity and credibility are key words if opinions on safety and the working environment are to carry any weight. This is conditional on all the parties concurring that the methodology offers a logical approach and that the results create value. Their joint ownership of processes and results is therefore important. To promote continuing active ownership of the process, a reference group representing the partners in the industry was constituted in 2009 with the mandate of contributing to the further development of the work. Many people, both in and outside the industry, have contributed to the project. It would take too long to list them all but I should like to mention in particular the positive response we have met with in all our contacts with the parties concerned in connection with the implementation and continuing development of the work. Stavanger, 27. April 2011 Oyvind Tuntland Director for Professional Competence Petroleum Safety Authority 0 PETROLEUM SAFETY AUTHORITY • TABLE OF CONTENTS 1. Purpose and limitations................................................................................ 5 1.1 PURPOSE...................................................................................................................5 1.2 OBJECTIVES............................................................................................................... 5 1.3 IMPORTANT LIMITATIONS.................................................................................................5 2. Conclusions................................................................................................ 6 3. Implementation.......................................................................................... 9 3.1 IMPLEMENTATION OF THE WORK.........................................................................................9 3.2 USE OF RISK INDICATORS.............................................................................................. 10 3.3 TRENDS IN ACTIVITY LEVEL............................................................................................. 11 3.4 DOCUMENTATION....................................................................................................... 12 4. Scope...................................................................................................... 12 5. Causal factors and measures relating to hydrocarbon leaks on the Norwegian ContinentalShelf....................................................................................... 13 6. Status and trends - DFU12, helicopter events ............................................... 14 6.1 ACTIVITY INDICATORS.................................................................................................. 14 6.2 EVENT INDICATORS..................................................................................................... 15 7. Status and trends - indicators for major accidents on installations ................... 17 7.1 DFUS RELATED TO MAJOR ACCIDENT RISK............................................................................ 17 7.2 RISK INDICATORS FOR MAJOR ACCIDENTS............................................................................ 18 7.3 TOTAL INDICATOR FOR MAJOR ACCIDENTS............................................................................ 24 8. Status and trends -barriers against major accidents ....................................... 26 8.1 BARRIERS IN PRODUCTION AND PROCESS FACILITIES................................................................ 26 8.2 BARRIERS RELATING TO MARINE SYSTEMS............................................................................ 28 8.3 INDICATORS FOR MAINTENANCE MANAGEMENT....................................................................... 28 9. Status and trends - occupational accidents resulting in fatalities and serious injury30 9.1 SERIOUS INJURIES, PRODUCTION INSTALLATIONS................................................................... 31 9.2 SERIOUS INJURIES, MOBILE UNITS.................................................................................... 31 9.3 COMPARISON OF ACCIDENT STATISTICS BETWEEN THE UK AND THE NORWEGIAN CONTINENTAL SHELF........ 31 10. Risk indicators - noise, chemical work environment and ergonomic factors........ 32 10.1 NOISE EXPOSURE HARMFUL TO HEARING.............................................................................. 33 10.2 CHEMICAL WORK ENVIRONMENT....................................................................................... 35 10.3 ERGONOMIC FACTORS.................................................................................................. 36 11. Other indicators........................................................................................ 39 11.1 DFU21 FALLING OBJECTS............................................................................................. 39 11.2OTHER DFUS........................................................................................................... 39 12. Definitions and abbreviations...................................................................... 40 12.1 DEFINITIONS............................................................................................................ 40 12.2 ABBREVIATIONS......................................................................................................... 40 13. References............................................................................................... 40 • PETROLEUM SAFETY AUTHORITY Overview of figures • Table 1 List of DFUs and data sources.................................................................... 11 Overview of figures Figure 1 Trends in activity level, production.............................................................. it Figure 2 Trends in activity level, exploration............................................................. 12 Figure 3 Volume of crew change traffic and shuttle traffic, person flight hours and flight hours, 1999-2010.....................................................................................14 Figure 4 Event indicator 1, events with small or medium remaining safety margin, 2006-10................................................................................................. 15 Figure 5 Helideck factors, 2008-10......................................................................... 16 Figure 6 Flight control aspects, 2008-10.................................................................. 16 Figure 7 Collision with birds, 2008-10..................................................................... 16 Figure 8 Reported DFUs (1-11) by category.............................................................. 17 Figure 9 Number of hydrocarbon leaks exceeding 0.1 kg/s, 1996-2010 ........................ 18 Figure 10 Number of hydrocarbon leaks exceeding 0.1 kg/s, 1996-2010, weighted by riskpotential........................................................................................... 18 Figure 11 Trend, leaks, normalised against installation year, manned production installations............................................................................................. 19 Figure 12 Average leak frequency, per installation year, 2006-10.................................. 20 Figure 13 Comparison of gas/two-phase and oil leaks on the Norwegian and the UK Continental Shelf per 100 installation years, average 2000-08 ........................ 20 Figure 14 Well incidents according to degree of severity per 100 wells drilled, for • Figure 15 exploration and production drilling ................................... Distribution of well control events by area, 1996-2010................................... 21 22 Figure 16 Well classification -category red, orange, yellow and green, 2010 ................... 22 Figure 17 The number of cases of serious damage to risers and pipelines within the safety zone, 1996-2010............................................................................ 23 Figure 18 Cumulative distribution of size of vessels (excluding tankers) in DWT involved in collisions, 1982-2010............................................................................ 24 Figure 19 Total indicator, production installations, normalised against manhours, yearly values and 3-year rolling averages.............................................................. 25 Figure 20 Total indicator, mobile units, normalised against manhours, yearly values and 3-year rolling averages............................................................................. 25 Figure 21 Mean fraction of failures for selected barrier elements, 2010........................... 26 Figure 22 Total fraction of failures presented per barrier element for operators 1-10 ....... 27 Figure 23 Fraction of failures for closing tests of wing and master valves ........................ 28 Figure 24 Overview of preventive maintenance, production installations .........................29 Figure 25 Overview of preventive maintenance, mobile units ........................................ 30 Figure 26 Serious injuries on production installations in relation to manhours.................. 31 Figure 27 Serious injuries per million manhours, mobile units ....................................... 32 Figure 28 Average noise exposure by job category and installation type, 2010 ................ 33 Figure 29 Plans for risk -reducing measures................................................................ 4 Figure 30 Indicator for the chemical spectrum's hazard profile - production installations... 36 Figure 31 Indicator for the chemical spectrum's hazard profile - mobile units .................. 36 Figure 32 Risk factors from reported tasks, distributed by personnel category - productioninstallations............................................................................. 37 Figure 33 Risk factors from reported tasks, distributed by personnel category - mobile • units................................................................................................... 38 Figure 34 Triggering factors distributed by main work process categories, 2002-2010 ...... 39 Figure 35 Triggering factors distributed by detailed work process categories, 2002-2010 ..40 PETROLEUM SAFETY AUTHORITY . Part 1: Purpose and conclusions 1. Purpose and limitations 1.1 Purpose The project 'Trends in Risk Levels - Norwegian Continental Shelf' was launched in year 2000. The Norwegian petroleum industry has evolved from a development phase encompassing many major fields to one in which operation of facilities dominates. Among factors marking the industry today are problems associated with older facilities, exploration and development in environmentally sensitive areas and the development of smaller and economically less viable fields. The future development of petroleum activities must be pursued in a perspective of continuing improvements in health, environment and safety (HES). Measuring the effect of all safety work in these activities is therefore an important contribution. Changes are also taking place in relation to participation, with increasing numbers of new players making their entry on the Norwegian Continental Shelf. The industry has traditionally used selected indicators to illustrate safety trends in petroleum activities. An indicator based on the frequency of occupational accidents resulting in lost working time has been particularly widely applied. These indicators give only a partial picture of the overall safety situation. The preference in recent years has been for a range of indicators to be used to measure trends in certain key HES factors. The Petroleum Safety Authority wishes to form a nuanced picture of trends in risk level based on information from different sides of the activities, with a view to measuring the effects of safety work in the industry as a whole. 1.2 Objectives The aim of the work is to: • Measure the impact of HES-related measures in the petroleum industry. • Help to identify areas which are critical for HES and in which priority must be given to identifying causes in order to prevent unplanned events and accidents. • Improve understanding of the possible causes of accidents and their relative signifi- cance in the context of risk, among other reasons to create a reliable decision -making platform for the industry and authorities in planning preventive safety and emergency preparedness measures. The work will also help to identify potential areas for regulatory changes and for research and development. 1.3 Important limitations The work focuses on risk to personnel and covers major accidents, occupational accidents and working environment factors. Both qualitative and quantitative indicators are used. For the present report, a qualitative study has been made of hydrocarbon leaks, their causes and preventive measures. • The activity is limited to factors which fall under the PSA's area of authority in regard to safety and the working environment, and includes all helicopter transport of personnel, in cooperation with the Civil Aviation Authority Norway and helicopter operators on the Norwegian Continental Shelf. The work covers the following areas: • • All production installations and mobile units on the Norwegian Continental Shelf, including subsea installations • Transport of personnel by helicopter between helicopter terminal and installation (point of departure to point of landing). • The use of vessels inside the safety zone around the installations. PETROLEUM SAFETY AUTHORITY Eight specified land facilities have been included since 1.1.2006. Data acquisition started from that date and separate annual reports have been published for the last five years, with results • and analyses for land facilities. A separate report was issued for the first time in 2010 on acute discharges to sea from the offshore petroleum industry. 2. Conclusions We endeavour in this work to measure trends in risk level in relation to safety, the working environment and the external environment' through applying a range of relevant indicators. Analysis is based on the triangulation principle i.e. the use of different measurement tools to measure the same phenomenon, in this case trends in risk level. Our primary focus is on trends. It is to be expected that some indicators, particularly within a limited topic field, will show sometimes substantial variation from year to year. Accordingly, and especially in view of the government's goal that the Norwegian petroleum industry should be a world leader in HES, the industry should direct its efforts towards achieving positive long- term trends. Ideally, it should be possible to arrive at a synthesised conclusion based on information from all measurements. In practice this often proves complicated, partly because the indicators reflect HES factors on sometimes widely -divergent levels. In this survey we concentrate primarily on risk indicators relating to: • Major accidents, including helicopter -related accidents • Barriers, particularly those relating to major accidents 011 Serious injury to personnel • Occupational illness and injury o Chemical work environment o Noise -related injury o The physical work environment • Qualitative evaluations relevant to the above. In recent years the industry has focused much of its attention on reducing the number of hydrocarbon leaks. Clear reduction targets have been set on several occasions: first a maximum of 20 leaks greater than 0.1 kg/sec in 2005, next maximum 10 leaks in 2008 thereafter a further reduction. The first target was met in 2005 and in 2007 10 leaks of this type were registered. In 2008 to 2010 there was again an increase: 14 in 2008, 15 in 2009 and14 in 2010. In 2010 it was particularly leaks in the category 0.1-1 kg/s where this increase occurred. In 2010 there was also one recorded instance of a leak greater than 10 kg/s. A comparison of leak frequency per operator continues to show that there are relatively substantial differences between operators. In addition, a comparison of leak frequency on the Norwegian and British Continental Shelf shows that there is potential for reduction on the Norwegian Continental Shelf. In other words, the targets for the period 2008-2010 have not been met and the trend is not one of continuous improvement. More directed, and not least continuous, effort is required to reverse the trend. In 2010 a qualitative study was performed in the context of the negative trend in recent years relating to reported hydrocarbon leaks. In the last few years a number of studies have been • made at national and international level and many accident investigations conducted following events, to establish the causes of hydrocarbon leaks and relevant risk -reducing measures. The Petroleum Safety Authority (PSA) accordingly expressed the wish for a study to be performed in which this documentation was to be used as a basis for analysing causal factors and ' Data collected through RNNP is used together with data from Environmental Web database in order to consider discharges to sea. The results are presented in a separate report published in the autumn. PETROLEUM SAFETY AUTHORITY measures relating to hydrocarbon leaks in the Norwegian petroleum activities. A perusal of investigation reports and other material gives a picture of (1) the causes identified for hydro- carbon leaks in the Norwegian petroleum activities, (2) proposed preventive measures and (3) if there is clear correspondence between identified causes and proposed measures. From a scrutiny of the causal factors and proposed measures contained in these investigation reports, four key challenges have been identified in the work of reducing the number of hydrocarbon leaks. These relate to: "design factors as a major cause", "learning from previous events", "formulation of concrete measures" and "risk assessments and analyses". The indicator for well control events also pointed to a consistently positive trend in the period up to 2008. In the period 2008-2010 there is a further increase, from 11 events in 2008 to 28 in 2010. Even when the number of events is normalised against activity level (the number of wells drilled), the increase is clear. An assessment of the contribution to risk, weighed in relation to its potential contribution to loss of life, shows that well control events in 2009 and 2010 make a clearly higher contribution. The number of events involving vessels on collision course continues to show a positive trend. The level in 2010 is significantly lower than the mean value for the period 2002-2009. In this case the monitoring of the zones around the installations from dedicated traffic centres must be acknowledged as a definite contributory factor. In the last ten years there have been 28 collisions on the Norwegian Continental Shelf between installations and visiting vessels. These events are due to weaknesses in the organisation of work and responsibility, deficient training of relevant personnel and technical equipment failure. Six of the reported events had major hazard potential. Responsibility for the events is attributable to operators, shipowners and crew. In other words, the events result not from any single cause but from a number of factors. Substantial improvement is needed in terms of how vessels are operated and followed up. There was a reduction in the number of collisions in the period 1998-2001, but the period • 2004-2010 shows an increase in the number of serious events. The other indicators reflecting incidents with major accident potential show a stable level, with relatively minor changes in 2010. The total indicator, which reflects potential for loss of life if registered incidents develop into actual events, is a product of frequency (probability) and potential consequence. A risk indicator based on history is not an expression of risk but can be used to evaluate trends in parameters that contribute to risk. A positive development in an underlying trend for this indicator therefore suggests that a greater degree of control is being gained over factors contributing to risk. In the last 5-6 years the total indicator, for both production installations and mobile units, has flattened out at a lower level than in the foregoing period. An overarching goal of a continuous risk -reduction process could possibly have shown a consistent reduction in this indicator. Since individual events with large potential influence the indicator to a relatively marked degree from year to year, the analysis is based on 3-year rolling averages. Helicopter -related risk accounts for a major part of the total exposure to risk to which offshore personnel are exposed. The helicopter indicators used in this work were extensively modified in 2009/2010 in order to better reflect real risk factors associated with the events covered in the survey. The steps taken include the establishment of an expert group under the RNNP umbrella tasked with evaluating the level of risk associated with the most serious events. The expert group is composed of personnel with competence in relevant disciplines: aviation (pilot), technical and risk. The last major accident entailing fatalities on the Norwegian Continental Shelf occurred in September 1997 in connection with the helicopter accident off Bronnoysund. In 2009 there were several serious helicopter accidents in the petroleum industry worldwide. The indicator reflecting the most serious events, and evaluated by the expert group, shows a positive trend from 2009 to 2010. Among other factors, it may be assumed that this trend PETROLEUP S/,FEIY r.JTrIOR1TY reflects the introduction of new types of helicopter. The number of ATM -related events (air traffic management), particularly in connection with deficient radio cover, shows an increasing trend over the last three years. The industry is now turning its attention to pro -active (leading) indicators, i.e. indicators that can provide information about robustness in relation to capacity for withstanding potential events. Our barrier indicators are examples of these. The barrier indicators show that there is substantial variation between the different installations, some of which show relatively poor results for certain barrier systems. On the whole, the average result for all installations is approximately as anticipated but we must remember that the value of these indicators lies primarily on individual installation level, with the exception of some types of safety valves (ESDV, DHSV and BDV) where the number of failures is slightly above the anticipated level. For certain types of barrier elements, for example BOP, the data material still suffers from a considerable degree of uncertainty. On facility level, some installations are observed to deviate substantially from the expected results, a possible indication of a challenge relating to the robustness of the barrier. For the last two years we have collected data on maintenance management. Normally, data must be acquired over several years to obtain a sufficiently stable set of data. The figures from 2009 and 2010 show that some participants are experiencing challenges in establishing the expected level of maintenance management, seen in the light of the rules and regulations. Mobile units have the greatest challenges. These challenges relate to the classification of equipment and the extent of outstanding tasks within both preventive and corrective maintenance, including maintenance that is HES-critical. The indicator for serious injury to personnel points to a positive trend in recent years. Injury frequency is now 0.68 serious cases of injury per million manhours for the Norwegian • Continental Shelf as a whole. This is significantly lower than the average for the preceding ten- year period. For production installations there is no clear trend for the last five years, where frequency has varied between 0.65 and 0.87, and in 2010 it is at 0.79. In 2010 there was a decrease in frequency among the contractor personnel group, while operator personnel have experienced an increase. Injury frequency on mobile units shows a marked reduction in 2010 (to 0.42) compared with previous years. In 2010 the frequency of serious injury in connection with drilling and well operations on mobile units was a third of that in corresponding functions on production installations. The noise exposure indicator shows only a marginal improvement in 2010, despite the fact that both the authorities and the companies have given close attention to the problem. Part of the explanation may be that effective noise -reducing measures take a relatively long time to plan and implement. Data from the survey indicate that most categories of personnel have a noise exposure value above the limit of 83 dBA. A joint project involving the industrial partners and spearheaded by OLF and Norsk Industri is in the process of establishment, with the aim of enhancing risk reduction work. Indicators for ergonomic factors were reported for the second time this year. A new feature this year is that companies report data for a total of 80 % of all work tasks for each of the relevant personnel categories. This helps to ensure that the indicators give a more correct picture of the total load for each group. A comparison of the results between production installations and mobile units shows that all groups on mobile units report substantially higher loads in relation to job category. We find substantially higher values for drill floor workers, catering assistants and mechanics on older production installations compared to newer. Surface treatment workers on production installations comprise the group which collectively has the highest score of all groups on offshore and land facilities, while on older installations it is roughnecks who have the highest average score for ergonomic factors. PETROLEUM SAFETY AUTHORI T Y Part 2: Implementation and scope 3. Implementation The work done in 2010 is a continuation of previous years' activities over the period 2000- 2009, see NPD (2001), NPD (2002), NPD (2003), PSA (2004), PSA (2005), PSA (2006), PSA (2007), PSA (2008), PSA (2009) and PSA (2010). (Complete references are given in the main project report on www.psa.no/rnnp). This year we have applied the same general principles and expanded reporting with special emphasis on the following elements: • The qualitative study consists of an analysis of the causes of, and follow-up of measures for preventing, hydrocarbon leaks, based on investigation reports from the period 2001-2009 and other material. • The work of analysing and evaluating data relating to defined situations of hazard and accident has been continued, both for installations and for helicopter transport. • A substantial quantity of experience data has been acquired for barriers against major accidents and analysed as in the period 2003-2009. Greater weight has been attached to nuances in the data for well barriers. • Indicators for noise, chemical work environment and ergonomics have been followed up as before. • Data from onshore facilities have been analysed and presented in a separate report. • Cases of acute discharges to sea and potential discharges to sea have been analysed and presented in a separate report. • 3.1 Implementation of the work Work on this year's report began in summer 2009 and involved the following participants: • The Petroleum Safety Authority: • Operator companies and shipping companies: • Civil Aviation Authority Norway: • Helicopter operators: • HES expert group: (selected specialists) • The Safety Forum (representing unions, employers and authorities): • Advisory group (representing unions, employers and authorities): Responsible for implementation and follow- up of the work Contribute data and information about activities on the installations and in the work of adapting the model to land installations, which have been included since 1.1.2006 Responsible for the reporting of public data on helicopter activities and quality assurance of data, analyses and conclusions Provide data and information on activities in the helicopter transport sector Evaluate methods, databases, views on development, evaluate trends, propose conclusions Comment on methods, procedures and results and make recommendations for further work. Joint advisory group for RNNP, to advise the Petroleum Safety Authority on follow-up of the work. The Petroleum Safety Authority has had support from the following external experts with responsibility for specific aspects of the work: • Jan Erik Vinnem, Preventor • Odd J. Tveit • Jorunn Seljelid, Beate Riise Wagnild, Grethe Lillehammer, Bjornar Heide, Cecilie A. Nyronning, Aud Bursting, Peter Ellevseth, Ole Magnus Nyheim, Sverre Kvalheim, Oystein Skogvang and Terje Dammen, Safetec PETROLEUts SAFETY AUTHORITY • Bodil Mostue, Stein Hauge, SINTEF Teknologi og Samfunn, Trond Kongsvik, Studio Apertura The PSA working group is composed of: Einar Ravnas, Oyvind Lauridsen, Mette Vintermyr, Birgit Vignes, Arne Kvitrud, Trond Sundby, ]orunn Elise Tharaldsen, Hilde Nilsen, Inger Danielsen, Elisabeth Lootz, Sigvart Zachariassen, Hilde Heber, Rse Larsen, Anne Mette Eide, Hans Spilde, Semsudin Leto and Torleif Husebo. The following persons have contributed to the work on indicators for helicopter risk: • Evelyn Westvig, Civil Aviation Authority • Egil Bjelland, Inge Antonsen, CHC Helicopter Service • Inge Loland, Per Skalleberg, Bristow Numerous others have also contributed to the implementation of the work. 3.2 Use of risk indicators Data have been collected for situations of hazard and risk associated with major accidents, occupational accidents and working environment factors, specifically: Defined situations of hazard and accident, with the following main categories: o Uncontrolled release of hydrocarbons, fires (i.e. process leaks, well events/ - shallow gas, riser leaks, other fires) O Structural events (i.e. structural damage, collisions, threat of collision) • Experience data relating to the performance of barriers against major accidents on the . installations, including well status data and maintenance management • Accidents and events in helicopter transport activities • Occupational accidents • Noise, chemical work environment and ergonomic factors Diver accidents Other DFUs with minor consequences or significance for emergency preparedness The term major accident is used at various points in these reports. There is no universally agreed definition of the term but the following definitions are often used and coincide with the definition applied in this report: • Major accident is an accident (i.e. entails a loss) in which at least 5 persons may be exposed. • Major accident is an accident caused by failure of one or more of the system's integral safety and preparedness barriers. In the light of the definition of major accident in the Seveso II directive, the definition used here is closer to that of a large accident'. Data acquisition for the DFUs relating to major accidents is based partly on established Petroleum Safety Authority databases (CODAM, DDRS, etc.) but also includes to a considerable • extent data acquired in cooperation with the operator companies and shipping companies. All event data have been quality assured by e.g. checking them against the event register and other Petroleum Safety Authority databases. Table 1 shows an overview of the 19 DFUs, and the data sources used. The industry has applied the same categories for data registration through the Synergi database. • 1� Table 1 List of DFUs and data sources DFU DFU description Data sources 1 Non -ignited hydrocarbon leaks Data acquisition* 2 Ignited hydrocarbon leaks Data acquisition* 3 Well kicks/loss of well control DDRS/CDRS (PSA) 4 Fire/explosion in other areas, flammable liquids Data acquisition* 5 Vessel on collision course Data acquisition* 6 Drifting object Data acquisition* 7 Collision with field -related vessel/installation/shuttle tanker CODAM (PSA) 8 Structural damage to platform/stability/anchoring/positioning CODAM (PSA) + industry failure 0 10 11 12 13 14 15 16 Leaking from subsea production systems/ pipelines/risers/flowlines/loading buoys/loading hoses Damage to subsea production equipment/pipeline systems/diving equipment caused by fishing gear Evacuation (precautionary/emergency evacuation) Helicopter crash/emergency landing on/near installation Man overboard Injury to personnel Occupational illness Total power failure 18 Diving accident 19 H2S emission 21 Falling object i.Pi� FCOtJIFC(7 A'Ith ih, roci)Cr ic-n cf crCrnr cc .11r.,riCS CODAM (PSA) CODAM (PSA) Data acquisition* Data acquisition* Data acquisition* PIP (PSA) Data acquisition* Data acquisition* DSYS (PSA) Data acquisition* uisition* 3.3 Trends in activity level Figure 1 and Figure 2 show trends over the period 1996-2010 for production and exploration activities, of those parameters used for normalisation against activity level (all figures are relative to the status in year 2000, which is put at 1.0). Appendix A of the Main Report (PSA, 2011a) presents the base data in detail. Errors in the database in previous reports have been corrected. Changes in activity level in relation to the individual parameters are dissimilar, the number of manhours on production installations having marginally increased (approx.1 %), while there is a clear decrease for mobile units. On mobile units the variations from year to year are even larger than for production installations. The presentation of DFUs or risk may therefore differ according to whether we use absolute or "normalised" values, depending on normalisation parameters. Normalised values have been presented in the main. 1,6 1,4 v 1,2 0,6 0,4 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 * No of prod. install. —411�—Manhours, prod. --*--Produced volume f No of prod. wells - —Pipeline length (km) Figure 1 Trends in activity level, production PE1 kOLEUM SAFETY AUTHORITY • C7 2,8 2,6 2,4 2,2 v 2,0 L 1,8 1,6 1,4 1,2 v 1,0 0,8 0,6 0,4 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Figure 2 Trends in activity level, exploration — 0 No of MODUs -A Manhours, MODUs --411—No of expl. Wells A corresponding activity overview for helicopter transport is shown in Subsection 6.1. 3.4 Documentation The analyses, evaluations and results are documented as follows: • Summary Report - Norwegian Continental Shelf for 2010 (Norwegian and English versions) • Project Report - Norwegian Continental Shelf for 2010 • Land Facilities Report for 2010 • Acute Discharges to Sea Report - Norwegian Continental Shelf for 2010, to be published autumn 2011 These reports can be downloaded free of charge from the Petroleum Safety Authority's website. (www.PSA.no/rnnp) 4. Scope The qualitative study this time consists of a report on the causes of hydrocarbon leaks and appropriate preventive measures. The statistical analysis methods applied in previous years have been continued, with only minor changes. A new indicator for maintenance was introduced in 2009 and continued in 2010, together with new indicators for helicopter risk. The work on serious injury related to occupational accidents has also been continued as in previous years, along with indicators for noise, ergonomic factors and chemicals. PETROLEUM SAFETY AUTHORITY • Part 3: Results from 2010 5. Causal factors and measures relating to hydrocarbon leaks on the Norwegian Continental Shelf The last three years show a negative trend in the number of hydrocarbon leaks reported on offshore production installations. Various studies on national and international level have been performed in recent years, together with many post -event investigations, in the search to identify the causes of hydrocarbon leaks and determine appropriate risk -reducing measures. With this in mind, PSA expressed the wish for a new study to be made, drawing on this documentation, which would analyse the causal factors of hydrocarbon leaks on the Norwegian Continental Shelf and propose appropriate measures. The research group from SINTEF/Studio Apertura has scrutinised 42 investigation reports (2002-2010), diverse reports from various research communities, consultancies and authorities, 33 research articles and descriptions of measures considered by the operator companies' own specialists to be the most important contribution to risk reduction. This perusal of investigation reports gives a picture of (1) what causes can be put forward to explain the occurrence of hydrocarbon leaks on the Norwegian Continental Shelf, (2) what measures have been proposed and (3) if there is good correspondence between identified causes and these measures. From a reading of the causal factors and proposed measures contained in investigation reports, four key challenges have emerged in association with the work of reducing the number of hydrocarbon leaks: "design factors as a major cause", "learning from previous events", "formulation of concrete measures" and "risk assessments and analyses". The following five categories of direct/triggering causes have been found to be the most important in our study of the documentation: 'Factors relating to the technical design of the system' (24 %), Technical condition/aging/wear and tear' (21 %), 'Wrong actions stemming from non -observance of prevailing practice/procedures' (14 %), 'Wrong actions of an negligent/careless nature' (11 'Cognitive errors (lack of competence and/or poor understanding of risk)' (9 %). Distributed over the categories of human factors, technology and organisation, our scrutiny of direct/triggering factors shows that 48 % of direct causes are technical in origin and 41 human, while only 11 % are classified as organisational in nature. With reference to underlying causes the picture is different. Here the distribution is 65 organisational, 21 % human and 14 % technical. No single causal factors dominate this picture. The four most frequent underlying causes have been found on the other hand to be: 'Factors relating to the technical design of the system' (11 %), 'Cognitive errors resulting from lack of competence/training and/or poor understanding of risk' (10 %), 'Poor communication/cooperation/interfaces/conflicting objectives' (9 %). Of the measures described in the investigation reports, 79 % are classified as being of an organisational nature, 20 % technological and 1 % people -related. The most frequent measures registered are: 'Control/checks/verification' (29 %), 'Procedures/documentation' (15 %), Technical design' (11 %) and Technical condition etc.' (6 %), 'Competence/training/- understanding of risk' (10 %). A general observation is that many measures are organisational in character while relatively • few are technical. In other words, there is no noticeable degree of correspondence between identified causes, particularly triggering factors, and the measures specified. A further observation in regard to measures is that these often lack specificity and require substantial additional work to give them concrete form. Four areas for improvement have been identified with regard to the reduction of hydrocarbon leaks: • The adoption of a more offensive approach to designing or re -designing technical solutions where these are deficient, rather than accepting and adapting to them. • • Appropriate learning and experience transfer and the systematic and efficient use of information from event databases, investigations, indicators and other sources relevant to preventive work. • Definition of precise and concrete measures to be taken in the wake of investigations, an area in which there is substantial room for improvement. • The implementation and application of risk assessments and analyses of the risk of hydrocarbon leaks. 6. Status and trends - DFU12, helicopter events Cooperation with Civil Aviation Authority Norway and helicopter operators continued in 2010. Aviation data collected from the relevant helicopter operators cover event type, risk class, degree of severity, type of flight, phase, helicopter type and information about points of departure and arrival. The Main Report (PSA, 2011a) contains further details of scope, limitations and definitions. The last major accident involving fatalities on the Norwegian Continental Shelf was in September 1997 in connection with the helicopter accident off Bronnoysund. In 2009 changes were made in two of the three event indicators which had been in use for several years, and these modified indicators were applied again in 2010 while the activity indicators have continued unchanged. The activity indicators reflect how exposure to helicopter risk evolves and is thus a more proactive indicator. These indicators are explained in detail in is the Main Report. For one of the event indicators, work has been done in 2010 on re -analysing data for the period 2006-2008, in order to incorporate data for the new indicator into a five- year period. The new indicators point to interesting trends, even though data are currently limited in scope, with resultant larger uncertainty. 6.1 Activity indicators Figure 3 shows activity indicator 1 (crew change traffic) and activity indicator 2 (shuttle traffic) in number of flight hours and number of person flight hours a year in the period 1999-2010. There has been an increase in crew change traffic in recent years. Data for 2008 and 2009 have been partly amended. There was a slight decrease in the volume of shuttle traffic for the period taken as a whole. Crew change traffic Shuttle traffic 90 000 80 000 70 000 60 000 t 50 000 L 40 000 u 30000 20 000 10 000 0 1999 2000 20012002 2003 2004 2005 2006 2007 2008 2009 2010 e000go 00000 j goo goo L Ot aa0000 � C x0000 s000ao N a m 000 12 000 10 000 8 000 C6 000 m ff 4 000 2000 0 1999 200020012002 200320014 2005 20062007 200920092010 120 000 100 000 80000 c 60000 m tFl ight hour N P--fl ight hours 40 000 `a n 20000 Figure 3 Volume of crew change traffic and shuttle traffic, person flight hours and flight hours, 1999-2010 • Activity indicator 1, volume of crew change traffic per year, must be seen in the context of activity level on the Norwegian Continental Shelf. There is a continuing slight increase in the number of manhours on production installations while the number of manhours on mobile units has varied to some degree but with an increase after 2003. There is in general a constant need for transport per manhour, which would indicate an increase in both flight hours and person flight hours. A balancing factor is better use of helicopters and the ability of the new helicopters to take off with a maximum passenger load under practically all weather • conditions. On several Installations shuttle traffic is part of the daily routine. The Ekofisk Field has most shuttle traffic activity. To a certain extent, shuttle traffic is flown using larger helicopters than previously, a factor which may go some way to explaining the decrease in the number of flight hours. In 2010 the number of flight hours in association with shuttle traffic is reported as being a little higher than in 2009 (approx. 2.8 %) and the number of person flight hours has fallen (approx. 4.8 %) against the figures for 2009. 6.2 Event indicators 6.2.1 Event indicator 1 - serious incidents Figur 4 shows the number of events included in a new event indicator 1. From 2009 (as for 2006, 2007 and 2008) the most serious incidents reported by the companies have therefore been scrutinised by an expert group comprising operative and technical personnel from the helicopter and petroleum companies and personnel from PSA's project group, with a view to classifying events on a finer scale, based on the following categories: • Small remaining safety margin against fatal accident: No remaining barriers • Medium safety margin against fatal accident: One remaining barrier • Substantial remaining safety margin against fatal accident: Two (or more) remaining barriers. Event indicator 1 covers those events/incidents with small or medium remaining margin against fatal accident for passengers, i.e. no barrier or one remaining barrier. In the years 2006 and 2007 there was one event a year with no remaining barriers, while there were two • events of this kind in 2008. There were zero events with no remaining barrier against fatal accident in 2009 and 2010. As before, events in the parked phase have not been taken into account. 14 12 10 4 2006 2007 2008 2009 2010 Incidents related to helideck movement ■ Turbulence during rig approach Static discharge ATM related incidents i Operational incidents ■ Technical incidents Figure 4 Event indicator 1, events with small or medium remaining safety margin, 2006-10 Six of 13 events in 2007 were associated with the S-92, one of the newest helicopters on the Norwegian Continental Shelf. In terms of traffic, the S-92 stands for approximately 60-70 of flying hours, while various generations of the Super Puma stand for most of the remaining • hours. The number of events associated with the S-92 came to three in 2008, four in 2009 and three in 2010. Of a total of 16 events with the S-92 in the period 2007-2010, nine were due to technical factors while the remainder had operational or other causes combined with strong turbulence from the installation. The EC-225, which is also a new Super Puma helicopter, has had only one event in the same period, caused by technical factors. 6.2.2 Event indicators in relation to cause categories • Event indicator 3 has been replaced from 2009 by event indicators based on cause categories, with the following content: • Helideck factors • Erroneous information about the position of the helideck • Erroneous/incomplete information • Equipment fault • Turbulence • Obstacles in the landing/take-off sector or on deck • Persons in the restricted sector • Failure to follow procedures • Flight control (ATM) aspects • Collision with birds. All degrees of severity beyond "no safety -related consequences" are covered by these indicators. Data are presented in Figure 5-Figure 7 for 2008-2010. For 2008 some events may not have been included but not so many that there is no clear increase up to 2009. In 2010 a sharp reduction in helideck-related events is noted, in all probability a result of the industry's closer attention to these factors. In contrast, the number of events related to flight control aspects increased in both 2009 and 2010. On the basis of these cause -related indicators certain areas and factors are mentioned in the Main Report (PSA, 2011a) where an effort should be made to effect improvement. 120 100 - • 80 v 0 60 v E � 40 z 20 0 2008 2009 2010 Figure 5 Helideck factors, 2008-10 30 25 20 9 0 15 EE z' 10 • 5 0 2008 2009 2010 Violation of procedures IN Persons in restricted section ■ Obstruction Turbulence Equipment malfunction N Wrong/Missing info ■ Wrong position rigg 2008 2009 2010 Figure 6 Flight control aspects, Figure 7 Collision with birds, 2008-10 2008-10 U • 7. Status and trends — indicators for major accidents on installations Indicators for major accident risk have been continued from previous years, with emphasis on indicators for events and incidents with major accident potential. Indicators for major accident risk associated with helicopters are discussed in Section 6, and barriers against major accidents in Section 8. There have been no major accidents, by our definition, on installations on the Norwegian Continental Shelf after 1990. None of the DFUs for major accident risk on installations have entailed fatalities in the period. The last time there were fatalities in association with one of these major accident DFUs was in 1985, with the shallow gas blowout on the rig "West Vanguard"; see also page 13 in connection with the helicopter accident off Bronnoysund. In addition, there have been no cases of ignited hydrocarbon leaks from process systems since 1992, apart from the occasional minor leak with no potential for major accident. In 2010 there was a very serious accident in the Gulf of Mexico, in which the mobile unit Deepwater Horizon experienced a blowout with almost immediate ignition, followed by explosion and fire. 11 people died in the explosion while the remaining crew were evacuated in two lifeboats, some with serious burn injuries. The rig sank after burning for about one and a half days, and the blowout lasted for almost three months. Two investigation reports have been published to date, and more are being prepared. Norwegian industry, through reports from both OLF and the Petroleum Safety Authority, is drawing lessons from this accident of relevance to the Norwegian Continental Shelf. Potential injury to personnel in the case of any similar accident occurring on the Norwegian Continental Shelf is covered in the DFU 'well control events', see Figure 8 and the weight given to events of this nature. The most important individual indicators for production installations and mobile units are discussed in Subsection 7.2. The other DFUs are discussed in the Main Report. The indicator for total risk is discussed in Subsection 7.3. 7.1 DFUs related to major accident risk Figure 8 shows the trend in the number of reported DFUs in the period 1996-2010. It is important to emphasise that these DFUs vary widely in their contribution to risk. The average level after 2000 is higher than that in the period 1996-99. The level decreased consistently from 2002 to 2007 and in 2007 was on a par with that in the period 1996-99. The number of incidents increased by 10-15 % in the period 2008-10 but remains below the level for 2000-06. In particular DFU5 (vessel on collision course) was substantially underreported up to 2001, in our view. The increase shown in DFU5 (vessel on collision course) in Figure 8 is not a good indication of risk trend (see the discussion in Subsection 7.2.4). This applies to a lesser extent to the DFUs related to hydrocarbon leaks and loss of well control. Figure 8 shows that these dominate in number up to 2003 but that the percentage falls to below 50% from and including 2004. From their lowest level in 2007, the DFUs related to hydrocarbon leaks and loss of well control rose again in the period 2008-2010 and are back over 50 % in 2010. 140 120 w u c m 100 V o 80 0 60 v 40 Z 20 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 ■ Evac/muster ■ Dam. subs inst ■Subs equipm leak ■ Struct. damage ■Coll. attend vess. ■ Drifting object ■Ship on coll course Otherfire/expl ■ Well incident ■ Ign Weak ■ Unign HC leak Figure 8 Reported DFUs (1-11) by category r� This applies to a lesser extent to the DFUs relating to hydrocarbon leaks and loss of well control. Figure 8 shows that these are dominant in number up to 2003, but the percentage falls to below 50 % from and including 2004. The increase in DFU5 (vessel on collision course) Figure 8 in is not a reliable indication of trends in risk level (see the discussion in Subsection 7.2.4). 7.2 Risk indicators for major accidents 7.2.1 Hydrocarbon leaks in the process area Figure 9 shows the total number of leaks exceeding 0.1 kg/s in the period 1996-2010. Up to 1999 there was a falling trend, succeeded by a period of large variation from year to year. There was a marked drop from 2002 to 2007, but the number of leaks exceeding 1 kg/s did not decrease to the same extent. After 2007 the number of leaks stabilised at a level 50% above that in 2007, without the industry's objective of a continuous reduction per year being met. The number of leaks exceeding lkg/s in 2010 is at the lowest recorded level, with one leak in the 1-10 kg/s category and one leak in excess of 10 kg/s. Hydrocarbon leaks are still classified by leak rate in coarse classes as shown in Figure 9, while a finer grading for the period 2001-10 is also shown in the Main Report. 50 45 40 35 Y w 30 ° 25 v E 20 n Z 15 10 5 0 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Figure 9 Number of hydrocarbon leaks exceeding 0.1 kg/s, 1996-2010 0,30 0 0,25 4. 0,20 0 U Y N L 0,15 M v J 0,10 0,05 • 0,00 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 ■ >10 kg/s ■ 1-10 kg/s ■ 0.1-1 kg/s ■ >10 kg/s ■ 1-10 kg/s ■ 0.1-1 kg/s Figure 10 Number of hydrocarbon leaks exceeding 0.1 kg/s, 1996-2010, weighted by risk potential Figure 10 shows the number of leaks when weighted in relation to the contribution to risk they are reckoned to give. In simplified terms, the contribution to risk from each leak is approximately proportional to the leak rate given in kg/s. Leaks exceeding 10 kg/s therefore make the biggest contribution even though there are no more than one or two such events a year. In most cases the weighting for these largest leaks is calculated manually from an assessment of the specific circumstances while the others are weighted following a formula. In 2010 both the leaks exceeding 1 kg/s were assessed specifically according to circumstances, the well control event on Gullfaks C in May 2010 and the collision between Far Grimshader and Songa Dee in January 2010, see Subsection 7.2.4. Figure 11 shows the trend for leaks exceeding 0.1 kg/s, normalised against installation year, for all types of production installation. The figure illustrates the technique universally applied to analyse the statistical significance (robustness) of trends. Figure 11 shows that the there has been no statistically significant change in the reduction of the number of leaks per installation year in 2010 in relation to the average for the period 2005-09, despite a minor reduction from 2009. This is illustrated by the falling height of the column for 2010 in the middle hatched field of the column to the far right of the figure ("Int 05-09", see also Subsection 2.3.5 in the Pilot Project Report). Leaks are discussed in the Main Report, normalised against both manhours and number of installations. 1,01 0,9 0,8 N M 0,7 T 0 0,6 M 0,5 N 0,4 d a 0,3 J 02 0,1 0,0 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Int 05-09 Figure 11 Trend, leaks, normalised against installation year, manned production installations The frequency of leaks exceeding 0.1 kg/s shows considerable variation between operators. These differences have remained almost constant for many years, evidence that there is still clear potential for improvement. This is further substantiated by Figure 12, which shows the average leak frequency per installation year for operator companies on the Norwegian Continental Shelf. In previous years this figure has been presented for the entire period from 1996 to the present day. If the period is limited to the last five years, the same companies are seen in general to have the highest frequencies, but they are no longer much above some of the other companies. A presentation of average leak frequency for each installation shows that the five installations with the highest average frequency in the period 2005-2010, all under the same operator, account in total for one-third of the number of leaks on the Norwegian Continental Shelf in this period. Four of the five installations with the highest average frequency were also among the top five in corresponding presentations in RNNP reports from and including 2005. A systematic comparison has been made for gas, condensate and oil leaks on the UK and the • Norwegian Continental Shelf in the areas north of Sleipner (59 ON), where the installations on both sectors are of generally corresponding scope and complexity. It should be noted that the reporting period of the UK Health and Safety Executive runs to 31.3. each year. The last period for which data are available is 1.4.2009-31.3.2010 (called '2009'), which is compared with the 2009 period on the Norwegian Continental Shelf). �i Is 0,4 , 0, 3 0, 3 0 L 0,2 0,2 v fl 0 1 - ---- Y 0,1 0,0 - --�- 10 ■ > 1 kg/s ■ 0,1 - 1 kg/s Operator Figure 12 Average leak frequency, per installation year, 2006-10 Figure 13 shows a comparison between the Norwegian and UK Continental Shelf, in which gas/two-phase leaks and oil leaks are both included, normalised against installation year, for the two respective continental shelves north of 590N. The figure applies to the period 2000-09. The data included in the figure are limited to process facilities in which oil leaks have occurred. In this period there was also one leak per year in shafts in connection with storage cells, on the northern sector of the UK Shelf, and one leak every third year in connection with tank ope- rations on production ships or storage tankers. No corresponding leaks occurred in this period on Norwegian production installations but in 2008 there was a major oil and gas leak in the shaft on Statfjord A on the Norwegian Continental Shelf. These leaks are not included in the figure. 50 45 40 0 35 c 0 30 25 0 20 n Y u0 15 0 m Z3 10 E z Z Norwegian sector, north of British sector, north of 59'N 59'N Pen ode 2000-09 ■ Oil, >lkg/s ■ Gas/2-phase, >lkg/s ■ Oil, 0,1-1kg/s ■ Gas/2-phase, 0,1-1kg/s Figure 13 Comparison of gas/two-phase and oil leaks on the Norwegian and the UK Continental Shelf per 100 installation years, average 2000-09 The number of leaks on the Norwegian Continental Shelf has been considerably lower in recent years, so the period in question is of some significance. For example the following observations can be made from the data in regard to average leak frequency per installation year for all leaks exceeding 0.1 kg/s: For the period 2000-09: The Norwegian Continental Shelf 76 % higher than the UK Continental Shelf For the period 2006-09: The Norwegian Continental Shelf 30 % higher than the UK Continental Shelf On the Norwegian Continental Shelf no occurrences of ignited hydrocarbon leaks (> 0.1 kg/s) • have been registered since 1992. The number of hydrocarbon leaks > 0.1 kg/s since 1992 is probably in the region of 440. There is evidence that the number of ignited leaks is significantly lower than on the UK Continental Shelf, where approximately 1.5 % of gas and two-phase leaks since 1992 have been ignited. 7.2.2 Loss of well control, blowout potential and well integrity Figure 14 shows the incidence of well incidents and shallow gas events distributed by exploration drilling and production drilling, normalised per 100 drilled wells. Exploration drilling and production drilling are shown collectively and with a common scale, for purposes of comparison. For exploration drilling there have been large variations throughout the period, perhaps around a stable average on a par with the level in 1996. There was a substantial reduction in the period 2005-08, but frequency increased markedly in 2009 and 2010. Production drilling showed a rising trend up to 2003, with minor variations. In the period 2004 to 2008 there was a fall but frequency rose sharply in 2009 and 2010. With one exception all well incidents in 2009 fall into the category "regular" i.e. events with minor potential. There were also seven shallow gas events in 2010, a record high figure for events registered since 1996, all during exploration drilling. Exploration drilling 35 v 30 25 20 £ IS c 10 3 5 � n 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Production drilling 35 v 30 25 D 20 15 c 10 3 5 z n 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Serious sh gas ■ Shallow gas ■ High risk ■ Serious ■ Regular Figure 14 Well incidents according to degree of severity per 100 wells drilled, for exploration and production drilling Figure 15 shows an overview of all well control events (for exploration and production wells) in relation to the areas on the Norwegian Continental Shelf in which well control events have occurred. The area classification corresponds to that given in the Norwegian Petroleum Directorate's map of the continental shelf. There were previously many well control events in the Ekofisk area, but in 2009 and 2010 there has been a sharp rise in the number of well control events reported from the Norwegian Sea. Well 34/10-C-06A, which was drilled from the Gullfaks C installation in the period November 2009 to July 2010, experienced several serious well control events. The last event, resulting in loss of well control, occurred on 19 May 2010. The Petroleum Safety Authority views this event as extremely serious. The event entailed enduring loss of a barrier and only chance prevented the event from developing into a major accident. The PSA's conclusion is that the planning of the drilling and completion operation on this well contained serious and extensive deficiencies with respect to key factors such as risk and change management, experience transfer and competence, together with knowledge of, and compliance with, management documentation and decisions. CJ 35 • 30 c > 25 a 0 20 0 u d 3 15 0 v E 10 z • • a Ekofisk area ■ Barents Sea ■ Norwegian Sea ■ Gullfaks/Statfiord/Snorre area ■ Oseberg/Troll area ■ Sleipner/Balderarea 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Figure 15 Distribution of well control events by area, 1996-2010 The Well Integrity Forum (WIF) established a pilot project in 2008 aimed at defining measurement parameters (KPI) for well integrity. Operator companies, ten in all, have reviewed all their "active" wells on the Norwegian Continental Shelf, a total of 1741 wells, with the exception of exploration wells and permanently plugged wells. Results were first reported in 2008 based on WIF's list of well categories, using existing definitions and subgroups per category. WIF has adopted the following system for well classification: Red: one barrier failed and the other degraded/unverified or with external leak Orange: one barrier failed and the other intact, or a single fault which may cause leaking into the external environment Yellow: one barrier leaking within acceptance criteria or the barrier is degraded, and the other is intact Green: intact well, with no or insignificant integrity factors. 0,3 % 7,5 74,3 ,8 ■ Fraction of wells in red category ■ Fraction of wells in orange category ■ Fraction of wells in yellow category ■ Fraction of wells in green category Figure 16 Well classification —category red, orange, yellow and green, 2010 The figure shows well categories by percentage of the total number of wells, 1741. The results show that 7.9 % (8 % in 2009) of the wells have reduced quality in relation to the requirements for two barriers (red + orange category). 17.8 % (16 % in 2009) of the wells are in the yellow category. These are also wells with reduced quality in relation to the requirement for two barriers but the companies have implemented various compensatory measures to meet the two -barrier requirement. The remaining wells, i.e. 74 % (76% in 2009), fall into the green category. These are reckoned to have met the requirement for two barriers in full. However, none of the reported conditions in category red or orange are of a nature requiring corrective measures beyond those already implemented by the companies themselves. 7.2.3 Leaks from/damage to risers, pipelines and subsea installations • In 2010 no cases were reported of leaks from risers or pipelines inside the safety zone of manned installations. This continues the trend from preceding years. In the last five years there has been an average of three serious cases of damage per year to risers and pipelines inside the safety zone In 2010 four cases were reported of serious damage to risers and pipelines in the safety zone, three of which were to a flexible riser on a mobile production unit and one on a rigid riser. This confirms trends in which the fault rate (the number of faults per operational year) is higher for flexible risers than for rigid risers. Cases of serious damage are also included in calculation of the total indicator but with a lower weight than leaks. Figure 17 shows the most serious cases of damage in the period 1996- 2010. 6 ■ NUI ■ Complex ■ FPU ■ Fixed production 199619971998199920002001200220032004200520062007200820092010 Figure 17 The number of cases of serious damage to risers and pipelines within the safety zone, 1996-2010 7.2.4 Vessel on collision course, structural damage There are only a handful of production installations and a few more mobile units where the installation itself or the standby vessel is responsible for monitoring passing traffic where vessels are on a possible collision course. In all other cases monitoring is from the traffic centres at Ekofisk and Sandsli. It would be an improvement, especially for production installations, if all traffic was monitored from traffic centres, as all experience indicates that the quality of monitoring is better than that achievable by the individual installation or standby vessel. For almost ten years there has been an indicator for DFU5 in which the number of vessels reported to be on possible collision course was normalised in relation to the number of installations monitored from the traffic centre at Sandsli, given as the total number of monitoring days for all installations monitored by Statoil Marin at Sandsli. The number of vessels registered as being on collision course has dropped substantially in recent years. For collisions between vessels associated with petroleum activities and installations on the Norwegian Continental Shelf, a high level was observed in 1999 and 2000 (15 events per year). Statoil in particular has worked diligently to reduce the number of these events and in recent years the level has remained at about two to three a year. The most serious collision in 2010 occurred between the supply ship Far Grimshader and the semi -submersible rig Songa Dee. Far Grimshader was working on the lee side of the Songa • Dee. The crane on the rig malfunctioned and the supply ship had to be moved to the windward side to use another crane. During the move, the ship's propeller was caught in a wire attached to the rig's anchoring. The ship lost control and lay striking the Songa Dee for two hours. The Songa Dee sustained damage to two columns and was holed in one place. The hull of the Far Grimshader was breached in six places and there was holing on the main deck, with water penetration to the engine room. The collision force of each impact was low but there may have been as many as several hundred impacts. A comparison of the size of vessels colliding with installations, as seen in Figure 18, shows that • the average size of vessels has substantially increased, by approximately 100 tons a year since the 1980s. Collision force increases proportionately with the size of the vessel. This means that, given the same speed, the average vessel will cause more damage today than 20 years ago. In 2010 there were three events, giving a substantially smaller statistical basis for 2010 than for the other curves. • Current rules and regulations require flotels and production installations to withstand the loss of two anchor lines without serious consequences. The loss of more than one anchor line occurs from time to time, with potentially large consequences but seldom as large as on Ocean Vanguard in 2004. Mobile drilling units are only required to withstand the loss of one anchor line without unplanned consequences. In the last ten years there has been in the order of two events on average per year, with the exception of 2006, when there were six events of this kind. In 2009 and 2010 there were respectively one and zero such events, the lowest inci- dence since 2000. 0,9 0,8 0 0,7 0,6 0,5 > 0,4 75 0,3 E u 0,2 0,1 1 000 2000 3 000 4 000 5 000 6 000 Size in ton deadweight —1982-1989 __ 1990-1999 — 2000-2008 2010 Figure 18 Cumulative distribution of size of vessels (excluding tankers) in DWT involved in collisions, 1982-2010 Structural damage and events included in RNNP are mainly classified as fatigue damage but some cases relate to storm damage. With respect to cracks, only penetrating cracks through the entire thickness of the structure are taken into account. In the wake of the Alexander Kielland catastrophe, structural cracks are taken very seriously in Norway. Cracks are generally the result of errors in design, choice of materials and manufacture. However, some of the installations have been in use for a longer period of time than previously assumed in the analyses. Connections can be shown on mobile units between the degree of cracking and changes in displacement of mobile units since the facility was new. Many other factors play an undoubted role. There is no clear relation between the age of the installation and the number of cracks. Storm damage refers mainly to cases of damage to the deck area but there may also be cracking on the hull. In 2010 three events involving extensive cracks in the hull were reported. The incidences of damage are relatively constant with one to three cases of serious damage a year, with no special trend. 7.3 Total indicator for major accidents The total indicator applies to major accident risk on installations, while risk associated with • helicopter transport was discussed in Section 6. The model gives DFUs a weighting based on the probability of fatalities. We wish to emphasise that this indicator is only a supplement to the individual indicators and is an expression of trends in risk level relating to major accidents. The total indicator weights contributions from observations of the individual DFUs in relation to their potential for loss of life (see the Pilot Project Report), and will therefore vary to a substantial degree from observations of the individual DFUs. Figure 19 shows the indicator with yearly values and 3-year rolling averages. The large jumps from year to year disappear when 3-year rolling averages are considered, making the longterm trend clearer. Manhours are used as a common parameter for normalisation against activity level. The normalised value level is put at 100 in year 2000. The main impression is that of a relatively stable level up to 2006, while from 2007 there is a reduction and a fairly constant lower level. Individual events with substantial risk potential can result in greater variation and have an effect over 3 years because of averaging, as the figure clearly shows for 2004 (Snorre A blowout). In 2010 it was the well event on Gullfaks C on 19 May (see Subsection 7.2.2) which had the highest value, based on the potential of the event. Two other leaks and the collision between the supply ship Far Grimshader and the mobile unit Songa are the other DFU events which have been given higher values based on the potential in these events, although not as high as the Gullfaks C event. 140 120 L 0 100 U C 80 Y N 60 40 Cr 20 0 • 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Tota I indicator per year, normalized over manhours —3 year average Figure 19 Total indicator, production installations, normalised against manhours, yearly values and 3-year rolling averages Figure 20 shows the trend of the total indicator for mobile units, with yearly values and 3-year rolling averages. The values in 2009 and 2010 are the lowest 3-year averaged values for the entire period; in 2010 the collision between Far Grimshader and Songa Dee and a number of well events make the most telling contributions to the increase in yearly value. There is an overall falling trend throughout this period, taking the 3-year average into account. 180 , 160 140 120 100 80 60 40 20 0 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Total indicator per year, normalized over manhours -- 3 year average • Figure 20 Total indicator, mobile units, normalised against manhours, yearly values and 3-year rolling averages 8. Status and trends —barriers against major accidents The reporting and analysis of barrier data have been continued, with no significant changes from preceding years, only minor modifications and additions. As before, companies report test data from periodic testing of selected barrier elements. 8.1 Barriers in production and process facilities The main focus is on barriers relating to leaks in production and process facilities, where the following barrier functions are included: • maintain the integrity of hydrocarbon production and process facilities (covered to a large extent by the DFUs) • prevent ignition • reduce cloud/spill • prevent escalation • prevent fatalities. The different barriers comprise a number of coordinated barrier systems (or elements). For example, a leak must be detected before any isolation of ignition sources and emergency shutdown routines (NAS/ESD) are effectuated. Figure 21 shows the relative fraction of failures for those barrier elements relating to production and process, for which test data have been acquired. These test data are based on reports from all production operators on the Norwegian Continental Shelf. The fraction of failures is generally on a par with the industry's availability requirements for new installations, but the highest values in the figure are above this level. Overall there is no • uniform picture, the most characteristic feature being a stable level with minor variations. Those installations with a low fraction of drills meeting efficiency requirements continue to feature from year to year. 0,035 0,030-- 0,025 ° 0,020 `o 0,015 - w 0,010 m 0,005 _. a 0,000 fire GTotal Closure test Leaktest Total Closure test Leaktest DHSV BDV PSV BOP Deluge valve Fire pump detection detecas tion start Riser ESDV Wing& Master valve Figure 21 Mean fraction of failures for selected barrier elements, 2010 The two barrier elements showing a negative trend in 2010 are ESDV and BOP on risers, where fewer tests have been reported and where there is a higher fraction of failures. A request for more detailed BOP data has resulted in extensive non -reporting for BOPS when these are not owned by the companies themselves. Data for ESDVs are discussed in connection with Figure 23. The Main Report shows the difference between the mean fraction of failures (Figure 21), i.e. the fraction of failures for each installation separately and then the mean for all installations, and the "total fraction of failures", i.e. the sum of all failures on all installations reporting data • divided by the sum of all tests for all installations reporting data. The mean fraction of failures gives all installations the same contribution to the average, regardless of whether they have many tests or few. Installations which have consistently shown many failures in testing of multiple barrier elements have been analysed to enable comparison with the number of leaks exceeding 0.1 kg/s on the same facilities. A corresponding analysis has been performed for successive years, and the results remain consistent over this time. One of the installations in the "top 5" • list for leak frequency (see Subsection 7.2.1) is also on the "top 5" list for a high fracture of failures of barrier elements. Figure 22 shows the total fraction of failures per barrier element for the ten operators reporting test data in 2010. The figure shows that there is substantial variation in the fraction of failures per barrier element between the different operators. The variation noted is due to different factors, which are discussed in the Main Report: • Difference in test interval. The total fraction of failures is calculated as X/N where X is the number of failures and N the number of tests. If the failure rate, i.e. the number of failures per time unit, is assumed to be constant, it is reasonable to assume that the proportion of total fraction of failures will diminish if test frequency increases. Differences in test interval have been observed, although the impact of this has not been analysed in detail. • Difference in the number of installations for which operators are responsible. Fewer installations and components result in greater variation. • Differences in the test pressure companies use. Some companies apply lower pressure for the testing of PSVs than others, resulting in more failures. • Difference in the number of tests. Variation is normally largest in the case of barrier elements with relatively few tests. 0,16 0,14 — --- - ■ Opl ■ Op2 •Op3 ■ Op4 ■ Op5 ■ Op6 0p8 ■ Op9 ■ Op1013Op11_ 0,12 6 0,10 c 0 0,08 0,06 w < 0,04 0,02 0,00 —� Fire Gas Total Closuretest leaktest Total Closuretest Leaktest DHSV BDV PSV BOP Delugevalve Fire pump detection detection start Riser ESDV Wing& Vlastervalve Figure 22 Total fraction of failures presented per barrier element for operators 1-10 The failure criteria for ESDV (generally the acceptable internal leak rate) can vary between installations and between companies, since criteria are determined on the basis of risk calculation. Acceptable internal leak rate for wellhead wing and master valves is given by API and is thus common for all installations and companies. Figure 22 shows average values for each of the operator companies and large variations are evident for several of the barrier elements. Even greater variations can be seen if we look at the individual installations, as has been done for all barrier elements in the Main Report. Figure 23 shows an example of this comparison for testing of emergency shutdown valves (ESDV) on risers and flowlines. Each installation has a letter code and the figure shows the fraction of failures in 2010, the average fraction of failures in the period 2002-10 and the total number of tests performed in 2010 (as text on the X-axis, together with the installation code). Most installations have an average of below 0.03, but there are many installations with a higher fraction of failures, some close to 0.10. Two installations had a high number of failures in M 2010, with more than 10 % failures in the number of tests. The figure covers both tests of the time taken for the valve to close (closing test) and tests of whether the valve remains sealed or has minimal leaking below the defined limit for acceptable internal leaking (leaking test). Fewer tests were reported in 2010, owing mainly to previous over -reporting by some installations because of unclear interpretation of reporting requirements. The average fraction of failures for all installations is 2.2% in 2010, while the average for all installations over the period 2002-2010 is 1.65 %. 0,25 1 - - 0 ■ 2010 ♦ Average 2002-10 0,20 -- — - - - 0,05 0,00 ♦ V n m O W N N OO OMN WN N Mrs OlDlD MOO NM. MOM WOm r,00 OON. OOO NlDO.-1 O\ NOON NOON OOO N NN Moo .-I N M =- C ZN Cy.�-1> y�MN.--100 �=M rlYrl M� a.-i V1M �N X }NN�,Q M r1Mw lD Vr lDN O ON.i OiN X N��OO •--I QLL� L O.. <<< <- aaa<Z <aQ a3a as aam mm`D m°°mmm gm°°°°3 °°°°°' Q"V Q Q Q Q m m In U Figure 23 Fraction of failures for closing tests of wing and master valves 8.2 Barriers relating to marine systems In 2010 there was data acquisition for barrier elements relating to marine systems, for: • Watertight doors • Ballast system valves • Time without acceptable signals from three reference systems or fewer than two reference systems following different principles (applies only to mobile units) • Metacentre height for mobile units. Data were collected for both floating production units and mobile units. With respect to production units, the fraction of failures in 2006 in relation to tests of watertight doors and ballast system valves corresponded to 1.5-2 % while the values for ballast valves after 2006 have lain around 0.5 %, with the exception of 2009 when values were at 1%. The fraction of failures of watertight doors for production installations after 2006 has lain around 0.2 %. For mobile units number of tests and number of failures vary from unit to unit. Average values are partly lower than for floating production units with respect to tests of watertight doors and ballast system valves. A new element in 2010 is that there has been a request for data on metacentre height (GM) for floating production installations, while no such data have been requested for mobile units since 2008. GM refers to the distance from the metacentre (M) to the centre of gravity (G) on the installation. A high positive value indicates good intact stability. The installation is stable when the metacentre height is positive and unstable with negative values. This value will generally indicate weight changes on the installations but will also show if there are changes in buoyancy volumes. The average metacentre height on 31.12.2010 was 2.9m for mobile units and 3.3m for floating production installations. The minimum requirement stipulated in the Maritime Directorate's stability regulations for semisubmersibles is 1.0m for all operational conditions, and all the installations satisfy this requirement. The average metacentre height • has fallen by 15% in the period 2008 to 2010, while the minimum metacentre height has increased by 7% in the same period. 8.3 Indicators for maintenance management In 2006 PSA launched the project Maintenance as a means of preventing major accidents: maintenance status and associated challenges. One of the project's aims was to update the status of maintenance management in petroleum activities with a view to determining the importance of maintenance in the prevention of major accidents. The project showed that . classification of systems and equipment had not improved in relation to the status indicated in Storting White Paper No. 7 (2001-2002). Audits conducted by PSA in the period 2006-2009 revealed a number of non -conformities in all companies audited. The most recurrent non - conformities are: • deficient classification of systems and equipment, • inadequate use of classification, • inadequate overview of outstanding maintenance, • lacking/deficient documentation, • lacking/deficient competence • deficient evaluation of maintenance efficiency. As a result of these findings, indicators for maintenance management were introduced in 2009, both for production installations and mobile units on the Norwegian Continental Shelf. Our particular area of focus is the decision basis for maintenance management, i.e. tagging of systems and equipment on the installations, classification of the tagged elements and how much of the classified material is critical in relation to health, safety and the environment ("HES-critical"). Also included is the status of maintenance already performed, i.e. the hours spent on preventive and corrective maintenance, backlogs in preventive maintenance and out- standing corrective maintenance, also with a view to HES-critical systems and equipment. The reporting categories in the introductory phase are the following: Decision basis for maintenance management: • The total number of tagged equipment items • The number of classified tags • The number of tags classified as HES critical • Status of performed maintenance: • Preventive maintenance backlog, number of hours in total • Preventive maintenance backlog, number of hours, HES critical • Corrective maintenance outstanding, number of hours in total • Corrective maintenance outstanding, number of hours, HES critical • The Main Report shows all indicators; only two are shown here. Figure 24 shows a substantial backlog of preventive maintenance for production installations, while Figure 25 shows a substantial backlog for mobile units. s000 4500 4000 tw Y 3500 �a 3000 t 2500 0 2000 � 1500 z 1000 500 1 5 9 13 17 21 25 29 33 37 41 45 49 53 57 61 65 69 Figure 24 Overview of preventive maintenance, production installations 6 000 ii • 5 000 0o 0 4 000 M 3 t 3 000 0 L. W E 2000 M Z 1 000 ■ PM backlog, hours HES critical ■ PM backlog, hours other equipement 1 2 3 4 5 6 7 8 9 101112131415161718192021222324252627282930313233343536 Figure 25 Overview of preventive maintenance, mobile units There is therefore a considerable list of planned maintenance work waiting to be performed, including work on HES-critical systems and equipment. Maintenance backlogs introduce factors that contribute to risk. It is thus important that a strict check should be kept on this backlog and the risk it represents. • In regard to tagging and classification of equipment, the figures for 2010 show that more production installations have tagged their systems and equipment than was the case in 2009. Mobile units continue to show low figures for tagging and classification. For certain installations the level of classification is so low that it can be difficult to establish a risk -based decision - making basis for maintenance purposes. 9. Status and trends - occupational accidents resulting in fatalities and serious Injury For 2010 PSA has registered 279 cases of injury to personnel on petroleum -related installations on the Norwegian Continental Shelf that come under the criteria of death, medical treatment or absence continuing over into the next shift. In 2009, 333 cases of injury were reported. There were no fatal accidents in 2010 within the PSA's area of authority on the Norwegian Continental Shelf. Reports were also received in 2010 of 54 cases classified as occurring during leisure -time (off -duty) activities and 103 cases of injury requiring first aid treatment. By comparison, in 2009 there were 67 cases of leisure -time injuries and 151 cases requiring first aid; these are not included in the figures and tables. On production installations in the period 2000 to 2004 there was a clear and consistent fall from 26.4 to 11.3 cases of injury per million manhours. From 2004 to 2008 the total frequency of injuries has remained generally unchanged at around it cases of injury per million manhours. This positive trend has been maintained in 2010. A total of 210 cases of injury on • production installations were reported in 2010. On mobile units, as for production installations, there has been a positive trend over the last ten years: from 2000 frequency has fallen steadily from 33.7 to 11.1 in 2006. In 2007 there was an increase in frequency of injuries but from 2008 the trend has been positive. Frequency has been reduced by one case of injury per million manhours from 2009 to 2010 (from 6.7 to 5.7) and is more than halved in relation to the level in 2007. In 2010 there were 69 cases of injury on mobile units as against 86 in 2009. 9.1 Serious injuries, production installations Figure 26 shows the frequency of serious injury to personnel on production installations per million manhours. There was a falling trend in frequency from 2000 to 2004, but an increase in 2005. Since 2006 there has been no clear trend, with frequency varying between 0.65 and 0.87 and being at 0.79 in 2010. In 2010 there was a decrease in the contractor personnel group but an increase among operator personnel. There were 23 cases of serious injury to personnel on production installations in 2010. The number of manhours increased from 28.6 million to 29.0 million in 2010. 3,50 - 3,00 p 2,50 t c m E c 2 2,00 v a w 1,50 j c N p 1,00 N 0,50 • 0,00 2000 2001 2002 2003 2004 2005 2006 0,86 Q87 0,79 0,65 2007 2008 2009 2010 Int Figure 26 Serious injuries on production installations in relation to manhours 9.2 Serious injuries, mobile units For 2010 the frequency of serious injury is 0.42 (see Figure 27), a continuation of a marked fall in recent years from a peak in 2000 and 2001. From 2002 to 2006 there were only slight changes in injury frequency. In 2008 we witnessed a renewed increase in frequency while in 2009 it was reduced to one-third of the level in 2008. This positive trend has continued, and in 2010 the frequency of serious injury is at the lowest level ever registered for mobile units. This frequency lies clearly below the value anticipated on the basis of the preceding 10 years. 9.3 Comparison of accident statistics between the UK and the Norwegian Continental Shelf PSA and the UK Health and Safety Executive (HSE) produce a half -yearly joint report in which statistics of injuries to offshore personnel are compared. The classification criteria were basically almost identical, but a closer scrutiny revealed that there were nevertheless certain differences in classification practice. With a view to improving the basis for comparison, we have revised the system in dialogue with the UK authorities and agreed on joint criteria for the classification of serious injuries, so that the categories cover corresponding areas of activity. The calculation of average injury frequency for fatalities and serious injuries for the period 2005 up to and including the first half of 2010 shows that there have been 0.85 cases of injury isper million manhours on the Norwegian side and 1.01 on the UK Continental Shelf. The difference is not statistically significant. However, the difference in frequency of fatal accidents in the same period is larger. The average frequency of fatalities on the UK Continental Shelf is 1.37 per 100 million manhours as against 0.95 on the Norwegian Continental Shelf. This difference is also not significant. On the UK Continental Shelf there were four fatalities in the period as against two on the Norwegian Continental Shelf. 3,50 3,00 N J 2,50 0 C C N E rp 2,00 C d d o 1,50 J C_ N p 1,00 01 n 0,50 0,00 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 Figure 27 Serious injuries per million manhours, mobile units 2010 Int 10. Risk indicators - noise, chemical work environment and ergonomic factors It has been stressed that indicators must express risk factors as early as possible in the causal chain leading to occupational injury or illness and that the indicators must lend themselves readily to use in companies' improvement work. With few exceptions, data for noise and chemical work environment have been registered from all offshore installations and onshore facilities. In regard to noise, the data set shows that there is common understanding of reporting criteria and the indicator seems to give a realistic and consistent picture of the actual conditions. It also appears to be sensitive to change. Indicators for chemical work environment have been slightly modified to give better robustness, but there have been only marginal changes in 2010 in relation to 2009. Indicators for ergonomic factors have been reported for the second time. The indicator has been changed from that in 2009 in which companies reported data for two work tasks they themselves assessed as giving a high risk of muscular/skeletal complaints. The new feature this year is that companies report data for a total of 80 % of the work tasks for each of the relevant personnel categories. This means that the indicators showing risk factors distributed by personnel category will give a more correct picture of the total load for each group. This modification means that data from 2009 and 2010 are not comparable. Response from the companies has been generally positive. The work has created commitment and management interest in the topic of indicators, and the preconditions for prioritised risk reduction have improved. An important aim in the establishment of indicators is that they should support good processes in the companies. There is a high level of activity in the branch directed towards the development and implementation of methods and tools for risk assessment and management in regard to work environment factors, and there are several good examples of major improvement projects in the industry. • Indicators are based on a standardised data set and reflect only some aspects of a complex risk picture. Indicators cannot therefore be used as a substitute for companies' obligations to perform vulnerability and risk assessments as a platform for implementing risk -reducing measures. • 10.1 Noise exposure harmful to hearing Data have been reported from 71 facilities, 44 production installations and 27 mobile units. The production installations include 17 "new" and 27 "older" facilities. New installations are those with an approved plan for development and operation (PDO) after 1.8.1995. At that point of time, more stringent and detailed requirements relating to noise exposure were introduced (the SAM regulations). The noise exposure indicator covers 11 pre -defined job categories. The total data reported represent 2259 offshore personnel. 105 T 100 95 90 m v 85 80 75 70 oo _ c E - L y E a E j 10 d 0 Production, 'new', without hearing prot. 2010 Production, 'older', without hearing prot. 2010 Mobile without hearing prot. 2010 - Production, 'new', with hearing Prot. 2010 - Production, 'older', with hearing Prot. 2010 - Mobile with hearing Prot. 2010 Figure 28 Average noise exposure by job category and installation type, 2010 The average noise indicator for the 2259 persons covered by the survey is 90.2. This is a slight reduction from the 2009 level of 90.7. An improvement was registered on 22 of total 71 installations, a slightly poorer result than in 2009. Only 5 installations report that no detailed risk assessment has been made for certain job categories. There has been a markedly positive trend here since the indicator was first established. In the majority of cases there is very little discrepancy between the noise indicator and the results from detailed risk assessments, which is a valuable verification of the indicator's strength. The noise indicator for the job categories machinist and surface treatment worker (painter) is markedly higher than for other groups and for these groups the noise indicator, including hearing protection, is also relatively high. For most job categories, the noise indicator is lower on "new" installations than on "older" ones. Taking the picture as a whole, the trend has been positive for older installations but not for new installations, so that the risk level now appears to be the same. For mobile units, five of 11 job categories have lower noise exposure compared with the situation on new and older fixed installations. Seven installations reported that technical measures have been implemented which in combination have led to a reduction in noise exposure by respectively 1 dB, five installations with a reduction of 3 dB, 11 installations with a reduction of 5 dB and one installation with a reduction of 8 dB for certain job categories, which is an improvement in relation to the results for 2009. • Reporting of data confirms that some companies have formalised and implemented schemes for exposure hour limitations: of 71 installations there are 11 which have not introduced schemes of this kind for some job categories. This applies particularly to mobile units. As in previous years, there is still potential for improvement in this area on mobile units. Although it may be difficult to verify if this kind of measure is effective, there are examples showing that they can work. Schemes of this nature may have operational drawbacks and may in themselves serve to hasten the implementation of technical measures. • Although indicators point to high levels of exposure, there are still a number of installations which have not established plans for risk -reducing measures, see Figure 29. The picture shows a more positive trend than in 2009, particularly with reference to new production installations. For older production installations the picture has changed little in relation to that in preceding years. For mobile units approximately 90 % have established plans for risk -reducing measures. An improvement has been registered in terms of implementing measures in line with plans, for all installations. More cases of new and exacerbated hearing damage have been registered in the period 2010 for new and older production installations. Mobile units show a reduction in cases of new or exacerbated hearing damage compared to 2009. 100 90 % 80 % 70 % 60 50 40 30 % • 20 10 0% Is binding plan for noise Is the plan based on exposure Are actions made in accordance Are new or more severe noise reduction established? reduction for exposed groups? with plan in this period? damages registered in this period caused by noise exposure on installation? Figure 29 Plans for risk -reducing measures ■ Production, 'new', 2008 ■ Production, 'new', 2009 ■ Production, 'new', 2010 ■ Production, 'older', 2008 ■ Production, 'older', 2009 ■ Production, 'older', 2010 • Mobile, 2008 Mobile, 2009 ■ Mobile, 2010 If the noise indicator is assumed to reflect real exposure to noise, most job categories covered by this survey have a level of noise exposure exceeding 83 dBA, the maximum level stipulated in the Activities Regulations, Section 38. However, if we take into account the use of hearing protection as reported by the companies, we see that most job categories have a level of noise exposure within the stipulated limits. Even allowing for a conservative calculation of the dampening effect of hearing protection, this does not mean that the situation is satisfactory. Hearing protection has clear limitations as a preventive measure. The indicator also calculates uncertainty in the result and the 95 % percentile for indicator values which typically lies 6-8 dB higher/lower than the average values shown in the figures. This means that a relatively high number of employees may have a much higher level of noise exposure than the average figures suggest. If we also take into account the evident uncertainty in regard to the effect of hearing protection and a consistently high level of reporting of hearing damage, a serious picture of risk level presents itself. • For 2010, 605 cases of noise -related injury were reported to the Petroleum Safety Authority as against 397 in 2009. This increase is due primarily to increased reporting for contractor personnel. Taking the picture as a whole, it seems clear that large groups of employees working in the offshore petroleum industry are exposed to high levels of noise and that the risk of developing noise -related hearing impairments is not inconsiderable. The PSA's experience through its contacts with the industry, case -handling and audits indicates that the potential for noise -reducing measures remains large. Both the noise indicator and trends in hearing damage PETROLEUM SAFETY AUTHORITY reports suggest that a special effort must be directed towards personnel categories in whose . work handheld tools make a substantial contribution to noise exposure. 10.2 Chemical work environment The indicator for chemical work environment has two elements. One is the number of chemicals in use listed by categories of health hazard, the hazard profile of the chemical spectrum and substitution data. The second element relates to actual exposure for defined job categories, which seeks to identify exposure carrying the highest risk. In addition, supplementary information has been reported on how companies manage the risk of chemical exposure. The establishment of binding plans and follow-up routines are key elements in this context. The indicator for the chemical spectrum's hazard profile shows the number of chemicals in circulation per installation and chemicals with a high and defined hazard potential. This indicator has limitations in that it does not take into account how the chemicals are actually used and the risk this use represents. It nevertheless tells us something about companies' ability to limit the presence and use of potentially hazardous chemicals. It is a recognised scientific argument that the probability of health -hazardous exposure increases with the number of harmful chemicals in use. The model involving the use of risk matrices to identify a direct indicator for chemical exposure has been applied as in 2009. For four defined job categories, the two cases with highest risk are reported, one based on a short-term assessment and the other on a full -shift assessment. The way in which data are reported does not take into account any risk reduction implied by the use of personal protective equipment. The risk matrix with defined categories of health hazard and exposure is based on Norsok S- • 002 rev. 4 Annex G. Each cell in the matrix is assigned a risk value identical to the product of the numerical values (1-5) for health hazard category (inherent properties) and exposure category (1-6). Data have been reported in 2010 from 40 production installations/fields and 32 mobile units. The reported data show that there is still substantial variation between companies in regard to the number of chemicals in use (Figure 30 and 31). For production installations and mobile units this reflects to some extent the type of installation and the activities on the installation. The total number of chemicals for production installations and mobile units varies from 171 to 882. The arithmetic mean value is 472. For chemicals with a high hazard potential, the number varies from nine to 182. The arithmetic mean value is 75. Both for production installations and mobile units there is an increase in the number of chemicals in relation to preceding years. 628 cases in total have been reported of substitution with health benefits, for production installations and mobile units. This is an increase in relation to preceding years, when 205 cases were reported. The majority of these substitutions occurred on six of the 72 reported installations. Both production installations and mobile units show a marked rise in the number of substitutions in relation to 2009. For production installations there are four which show an improvement in relation to 2009 in terms of the number of chemicals, while 35 installations show a deterioration. Drilling activities are excluded here. For mobile units, 23 show a deterioration in relation to 2009. 36 new cases of job -related skin complaints were registered in 2010, the majority of them the is result of chemical exposure, as against 37 cases in 2009. Pl-IR(:�I�IJIi S"EL-Y=iiiH0R1-1, • • 1000 I I 900 - — —------- --- — - — 800 700 u 600 m t u e 500 7 400 2 300 200 100 0 60 23 30 31 33 32 40 41 42 43 12 13 45 46 47 48 49 10 11 80 90 91 92 93 99 94 95 96 97 100 70 71 72 73 74 75 76 77 78 79 ■ Number with high hazard potentil ■ ■ ■ Total number of chemicals ■ ■ Number with health hazard classification Figure 30 Indicator for the chemical spectrum's hazard profile — production installations 700 600 Soo N A U .E aoo d r 0 E 300 I Z 200 100 FSO F11 F12 F32 F30 F31 F20 F21 F24 F22 F23 F26 F40 F51 F52 F50 F53 F60 F54 F61 F62 F63 F64 F71 F80 FIOOFIOIF102 51 50 F110F111 ■ Number with high hazard potential ■ ■ ■ Total number of chemicals ■ ■ Number with health hazard classification Figure 31 Indicator for the chemical spectrum's hazard profile - mobile units 10.3 Ergonomic factors Indicators for ergonomic factors were reported in 2010 for the second time. The companies report data for a total of 80 % of work tasks for each of the relevant personnel categories. This helps the indicators showing risk factors from reported work tasks distributed by personnel group to give a more correct picture of the total load for each group. The six pre -defined job categories were selected by ergonomic specialists with experience from the industry. • is The indicators were developed in cooperation with relevant disciplines in the companies and STAMI. In 2008 a status report entitled " Work as the cause of muscular/skeletal complaints" was prepared by STAMI at the behest of the Norwegian Labour Inspectorate and PSA. The results from this work were used in developing the indicators. The "Regulations relating to Heavy and Repetitive Work" and associated guidelines list the assessment criteria to be applied for reporting. The involvement of ergonomics experts in quality assurance of these assessments is a precondition emphasised by PSA. Data have been reported from 22 production installations and 31 mobile units. In the red area the probability of incurring load injuries is very high. In the yellow area there is a certain risk of incurring load injuries in the short or long term. The load situation must be assessed more closely. Factors such as variation, tempo and frequency of loads are critical. A combination of loads can exacerbate the situation. In the green area there is little general risk of employees incurring load injuries. If there are any special factors, or if an employee nevertheless incurs load injuries, the situation should be assessed more specifically. The comment "high score" means that the task in question has been rated as red by many respondents. Roughneck Catering 100 % 90 80 % 70 % 60 % 50 % 40 % 30 20 % 10 0% Mechanic Scaffolding I I 11. Surface treatment Proces operator In Fo ° e,e Surface treatment Proces operator In Fo ° e,e ico J 5 �e oo4 J 9,c�c io , �\9 c :oi4 a o 9, c °� ee oo � °e9t Q° VP, �m.ta °� N e,aea °gJ a� Q v a�a Oo�a `°i°e`&5 a t aK421 a �d•, t`°eoQ Pe oQ P oQ P, Q,e°`a A-1 Ila Q a�°�cce cca lac,> ZcZ> lcaoQ`e°a O Figure 32 Risk factors from reported tasks, distributed by personnel category — production installations The highest score on production installations (Figure 32) is reported for surface treatment workers (painters) in relation to working position, repetitive tasks and handheld tools. Only 12.7 % of work tasks here are assessed as "green", i.e. carry little risk for the development of muscular/skeletal disorders. Surface treatment workers are clearly distinguished in this context because of their high degree of repetitive work and use of handheld tools. Working with needle chippers is identified as a high -risk operation on several installations. We note from the report on land facilities that the risk score for onshore surface treatment workers is lower than that reported from offshore production installations. Drill deck workers also have a high overall score, particularly in connection with heavy lifts. Scaffolding workers have many difficult working positions and repetitive work, and few "green" tasks. Mechanics score highest on difficult working positions and heavy lifts. For catering personnel, working position, repetitive work and heavy lifts are noted as factors carrying high risk. All three groups in Figure 33 report high scores for uncomfortable working positions. Comparison of the results for production installations and mobile units in 2010: all three personnel categories on mobile units report substantially higher scores for working position. For catering employees and mechanics this score is almost doubled on mobile units. For drill • deck workers there is also almost a doubling of scores for repetitive work and more than a doubling for handheld tools. We have divided the results into newer and older production installations (with PDO earlier than 1995) in order to see if there is any difference in average risk score distributed by personnel category. This shows that risk is substantially higher for drill deck workers and catering employees in particular, but also for mechanics, on older production installations than on newer facilities. The division into older and newer production installations also shows that it is drill deck workers on older installations who have the highest average risk score. In the results from the RNNP questionnaire survey (2009) for both production installations and mobile units, 83.5 % of surface treatment workers responded that they fairly often/frequently work in a hunkered -down or kneeling position, while 75.3 % report correspondingly for work above shoulder height. Additionally, 56.3 % of catering assistants and 46.3 % of drill deck workers report that they fairly often/frequently find it necessary to work at a high tempo. Roughneck Catering Mechanic 190 % 0 80 70 % 60 % 50 % - 40 % • 30 20 % 10% ' I 0% OP ti 05` o i.01 o -.o \tea �•` a e� eJa c�Q�` �a�e e� tm¢ c�Q oQe �o�a� �o��. �� °�a� °� Qec �acaoQe �aca0 Figure 33 Risk factors from reported tasks, distributed by personnel category — mobile units The RNNP questionnaire survey also shows that neck and shoulder pains are the most commonly reported complaints. Among surface treatment workers, 26.4 % have suffered from these complaints to a high or fairly high degree in the last three months, while for catering assistants the corresponding figure is 24.8 %. Approximately 30 % of these two groups report that they have not experienced these complaints. Among mechanics, 20.1 % report neck and shoulder pains. Back pain is something catering assistants report most: 16.3 % state that they have been troubled by back pain to a high or fairly high degree in the last three months. For 2010, the sample relating to management of the risk of muscular/skeletal disorders and injury is slightly broader than in 2009: The number of production installations has been expanded from 19 to 22 and the number of mobile units from 19 to 31. The results show that mobile units have reported substantial improvement with reference both to planning and • implementation in 2010 compared with 2009. For production installations too, improvements have taken place. is • 11. Other indicators 11.1 DFU21 Falling objects In the period 2002-2010 an average of 265 events related to falling objects has been reported to RNNP each year. The number of events reported for each year remained fairly constant in the period 2002-2007 but the last three years show a slight falling trend, down to 211 events in 2010. On the Norwegian Continental Shelf there have been one fatality and 85 cases of injury since 2002 involving falling objects. This year a comprehensive analysis has been made with the aim of classifying events in relation to initiating causes. The main period studied was 2006-2010. Classification follows the categories model developed in the BORA project, see the Main Report. This method was originally designed for the purpose of classifying hydrocarbon leaks but has been generalised and adapted to apply to events involving falling objects. Figure 34 shows the distribution of events in main categories of work processes. Causal factors are differently distributed among the defined work processes and of special interest are crane - related events, for which cause category F: external factors accounts for almost 40 % of these events. For internal lifting operations, cause category F external factors is even more dominant than for crane operations as a whole (59 % against 37 %). A more thoroughgoing analysis has therefore been made of cause distribution under main category F. Events with falling objects in connection with work processes using cranes are also of particular interest since these events are concentrated in the two highest energy classes. 100 % 90 % 80 % 70 % 60 % 50 % 40 % 30 % 20 % 10% 0% Drilling Crane Process General related related related liftine F: external ■ E: Design ■C: Human, immediate ■ B: Human, latent ■ A: Technical Figure 34 Triggering factors distributed by main work process categories, 2002- 2010 Figure 35 shows a detailed presentation of the causes of falling objects in association with the work processes loading and unloading operations (from vessels) and lifting operations taking place internally on the installation. The data material for these work processes has been expanded to include events registered as far back as 2002. Category F3: effect of impact/snagging accounts for a relatively high fraction of events in the main category of crane - related work processes. A high fraction of these events is found in lifting operations on the installation itself. The Main Report contains a more comprehensive analysis. 11.2 Other DFUs The Main Report presents data for events reported to the Petroleum Safety Authority, and for the following remaining DFUs, which have no major accident potential: DFU10; 11; 13; 16 and 19, see Table 1. 100 • 90 80 70 %>= m 60 % N > 50 % cu kn 0 40 a 30 20 10% 0% - - Loading and Internal lifting unloading to supply vessel F3: I mpact from hooking/bumping F: Other external ■ E4: Malfunction of equipment ■ E1-3: Other design ■C: Human activity, immediate triggering incident ■ I34:Other latent hazard due to i nterventi on 133: Other latent error due to operation i32:Inadequate securing ■ 131: Misplaced/forgotten equipm. ■ A: Technical degradation/fail ure Figure 35 Triggering factors distributed by detailed work process categories, 2002-2010 12. Definitions and abbreviations 12.1 Definitions See Subsections 1.9.1-1.9.3 and 6.2 in the Main Report. 12.2 Abbreviations • For a detailed list of abbreviations, see PSA, 2011a: Trends in Risk Level on the Norwegian Continental Shelf, Main Report, 27.4.2011. The most important abbreviations in this report are: API American Petroleum Institute CODAM Database for damage to structures and subsea installations DDRS/CDRS DFU Defined situations of hazard and accident PM Preventive maintenance GM Metacentre height HES Health, environment and safety KPI Key Performance Indicator CM Corrective maintenance NPD The Norwegian Petroleum Directorate PSA The Petroleum Safety Authority STAMI The National Institute of Occupational Health WIF Well Integrity Forum • 13. References For a detailed reference list, see the Main Reports: PSA, 2011a. Trends in Risk Level on the Norwegian Continental Shelf, Main Report, 27.4.2011 PSA, 2011b. Trends in Risk Level - Land Facilities in the Norwegian Petroleum Activities, 27.4.2011 • http://www.chron,com/disp/story.mpl/business/steffy/7323901.html#ixzz1TR9XYkx2 Yes, oodles of wells drilled, but still it's no time for complacency By LOREN STEFFY Copyright 2010 Houston Chronicle Dec. 3, 2010, 11:49PM Complacency kills. That may be the most important lesson from the Deepwater Horizon accident in which 11 rig workers died last April. Really, it's more a reminder. BP had been warned about the danger of complacency by a commission led by former Secretary of State James A. Baker III that investigated the Texas City refinery explosion in 2005. Other energy companies such as Exxon Mobil Corp. for years have admonished their employees to never think that disaster couldn't strike at their companies. The best defense is vigilance. The co-chair of the presidential commission investigating the spill last week said that the Macondo disaster underscored an industrywide sense of complacency. • Yet at least once a week I get an e-mail saying, in effect, that we're making too much of BP's Macondo disaster, that 50,000 wells were drilled in the Gulf of Mexico without a major accident. That's why I was struck by the conclusions of an internal training document from Marathon Oil Corp. that I obtained recently. Like many companies, Houston -based Marathon has been examining the events that led up to the Deepwater Horizon blowout and reviewing its own policies. The report, dated Oct. 12, cautioned employees against a false sense of security. "We must always guard against complacency in the absence of recent consequences," it concluded. "We must maintain a sense of vulnerability." In other words, 50,000 wells drilled right doesn't mean that the next one won't be drilled wrong, that a mistake couldn't be made or a test misinterpreted with catastrophic results. Nor does it mean another 50,000 will be drilled before there's another disaster. Marathon didn't directly study the evidence from the Macondo disaster. It reviewed publicly available information, such as testimony of the Deepwater Horizon survivors and BP's own internal investigation into the accident's cause. Cultural differences Almost 60 pages long, much of the document is highly technical. Marathon spokesman John Porretto said it was designed to start a dialogue among the company's drilling professionals about lessons from the Macondo disaster. • But its conclusions underscore key cultural differences between BP and many other companies in the oil industry. It's something I've heard repeatedly over the months I've been writing about the Gulf disaster for this column and a book I recently completed. BP has a thorough and detailed process for documentation, for tracking changes, for reviewing well design. In the end, it didn't matter. As we saw in the Texas City disaster, BP would bend its own rules in the name of expediency and, indirectly, expense. I've spoken with people who worked for and with BP, and they share a frustration of being unsure who was in charge of decisions or projects. At hearings conducted by government investigators this summer, BP engineers said they were unaware who had approved changes in well designs. Steps in prevention Marathon may not have all the answers, but its document provides some good ideas on how to prevent another Macondo. Companies need: A preoccupation with deviations, lapses and errors. Aboard the Deepwater Horizon, rig workers got confusing results from pressure tests but apparently rationalized the discrepancies. A listening environment. Leaders have to listen to front-line employees and defer to their day-to- day expertise. Those workers have to feel confident they can raise concerns without retaliation. This has been a long-standing problem within BP. Former BP America Chairman Bob Malone recognized it and tried to create an environment in which "bad news travels fast." To create as much certainty as possible. Standard procedures are standard for a reason, and they need to be followed. Eliminating uncertainty about basic procedures means workers are better able to deal with the unexpected. That helps catch bad decisions early. A sense of accountability and responsibility. When employees — from executives to front-line workers - know they are responsible and accountable, they become more focused and aware of potential consequences. That, above all, may be the greatest weapon against complacency. Loren Steffy is the Chronicle's business columnist. His commentary appears Sundays, Wednesdays and Fridays. Contact him at loren.steffy@chron.com. His blog is at http://blogs.chron.com//orensteffyl.. 49 Is Marathon's Macondo Presentation December 27, 2010 by offshoreeneray http://budsoffshoreenergy.wordpress.coml2010/ 12l271marathons-macondo-presentation/ 'M' MARATHON A colleague sent a link to a Marathon Oil Company Macondo presentation that was posted by the Houston Chronicle. The presentation was intended for internal training and discussion purposes. Firstly, I applaud Marathon for ensuring that the blowout is studied and debated within the company. Hopefully, they did the same thing for Montara, have a good internal system for studying accidents throughout the industry, and thoroughly investigate all of Marathon's incidents and near misses. is I thought Marathon's comments about safety culture were particularly interesting, including these on slide 58: Although harder to define and measure, and even more difficult to regulate, we pointed to our culture as the single most important differentiating attribute when comparing us to BP. In a recent meeting with an individual who has numerous dealings with BP, he observed that regardless of the purpose of the gathering (planning session to morning rig call), it is almost impossible to determine who is ultimately responsible and accountable for the operation being discussed. Evidence of this exists in the very report this presentation was derived from. I wonder what convinces Marathon that their safety culture is superior. The above anecdote, while interesting, doesn't tell us much. Prior to Macondo (and perhaps even after the blowout), I'll bet most BP employees thought that they had a strong safety culture. Ditto for Transocean. Does Marathon have any better evidence demonstrating the strength of their safety culture? If not, what makes them so confident? Does Marathon have a process for assessing and monitoring the attitude and commitment of their employees? Have they conducted regular internal surveys to gauge safety culture? My sense is that they have not. If they had, they could make their case without the very subjective comparison with BP. 0 The Macondo Inciden �s Findings and Conclusions Prior t Published Inspection of the Subsea BO 12 October, 2010 0 • CONFIDENTIAL FOR MARATHON OIL COMPANY USE The material contained in this presentation is for internal training purposes and is not to be further distributed • The Event ❑ On the evening of April 20, 2010, control of the BP operated Macondo Well, located in approximately 5,000' of water in Mississippi Canyon Block 252, was lost. ❑ This loss of well control resulted in explosions and fire on board Transocean's rig Deepwater Horizon. ❑ Eleven people lost their lives and 17 others were injured. ❑ The blowout fed the fire for another 36 hours until the rig sank. Hydrocarbons continued to flow uncontrolled from the wellbore for 87 days, resulting in a spill of national significance. ❑ A response effort of unprecedented size, technical complexity, political pressure, media coverage and cost continues today. 0 • 0 The First 36 Hours ❑ At the time of the incident we had two rigs operating in the GOM, the Noble Paul Romano at Innsbruck (MC 993) and the Diamond Ocean Monarch at Flying Dutchman (GC 511). ❑ Our supply vessels were directed to the scene for SAR operations and fire fighting. ❑ The Ocean Monarch was contacted for use of their BOP ROV intervention stab, but the Ocean Endeavor had the same model and was closer. An Unprecedented Response Effort As an Industry we watched as hours turned into days. days became weeks, and weeks grew into months. In contrast to the failures which led to the phenomenal. AIS Res _ .. V,ssge_ M..-Orr.,,o,Dnl U.-WODUO F....... P.00acna. Urn, IFPU.I 0--, S.— V.N, IOSVI C o..nvnw. ROV v,... ♦ C— G...M C.—. C...... IC..,... ♦ R.".. 0........ S, ..N V.,u„ R, ...cM V,a.. F... '—.r Dnn A,.., v...... S+ANO, NtrTua ♦i TTLEt STEPPE. RESOLUTE t CONTAINMENT Con"m[NCT Oritom - LMRP C nr A-, ♦ C � _. — —� ADRIATIC�— — Ton. P,sas 8 C FIONffR Evl KNUTsfN � DISCOvf REM BOA _-y ,.� Sao C H., Q4000 .ZaI[la[ Haut PRouucf. DDII Loch R-RMH H.Su— EHAL, j GEco TOPAZ ♦ AmmomMATtLT 4 M,l[A AIS VESSEL OVERVIEW AS OF 1 HTH DULY, 2010 (ALL POSITION APPROXIMATE TO WELL) Hos ! s , RIM DDIII FORZA s s Y +il .l' •' zit . M MARATHON 0--.EN H.P,,.H Rrsror — A—,— C.......... N C..-. Spotter/Observer r;-,t., riApf Ofn0YE08Yfln ...". HY. Swi1DVl0eD �U11 �MN N111O ZEE Integrated Subsurface MoMtoring Skimming s Vessels t / I COntnng 6ornirq Oil Spill Response Operation DISTRIBUTION UNIT At i- lip- STACK MANIFOLD C/K BOP MANIF( CDP MANIFOLD DDII DDI I BOP ` c�ti, �: BOP �'4 t_. • .� STATIC KILL OPERATIONS MAR RELIEF WELLS & SUBSEA CONTAINMENT PROGRESS ► DDII - MC 252 N2 ► Spudded well - May I6th ► Set 36" casing at 5,471' - May 16th ► Set 28" casing at 6,614' - May 21st ► Set 22" casing at 8,576' - May 24th ► Set 18" casing at 9,898' - June 20th ► Set 16" casing@ 11.939' -June 27th ► Set 13 5/8" casing@ 13.870'- July 4th ► Set It 7/8" casing 15.874' -July filth -- ~_ 5,000 4csG 36 .156 12 .C5G 1R .CSr::a .CSC Iy 41NR 13 �, h .Csc. b; VCSG 135/8 ".GSG 11 7 N 0 4CSG 135 4 CSG I OVERVIEW (Too 8P intends to drill two wells designed to Intersect the 1 original wellbore above the oil reservoir. This will allow heavy fluid to be pumped into the well which will stop the flow of oil from the reservoir. Cement will then be pumped down to permanently seal the well. IN / 4(A 117,R Na-9 7. R► CSG9 7,'a► tanned Intersection Depth 18.000' MD-RNR ,4RESERVOIR PROGRESS ► DDIII - MC 252 N3 ► Spudded well - May 2nd ► Set 36" casing at 5.494' - May 2nd ► Set 28" casing at 6,730' - May 5th ► Set 22" casing at 8,762' - May 8th No Set 18" casing at 9,945' - May 24th ► Set 16" casing at 12,057' -June 2nd ► Set 13 5/8" casing at 13.869' June 9th ► Set 117/8" casingat 15,836' -June 19th ► Set 9-7/8" casing at 17,864' August 1st RWD0802201OV1 IF lL�J I-] The Flow Path Float Collar Shoe Track t r, Casing Hanger Seal Assembly Wwphwwd _._. Swi fbor � BLOWOUT PREVENTER Lower Annular Preventer Blue — Control Pod Potential Flow Path Through Seal Assembly 9 7/8" X 7" (Discounted fnfhrx was through the .shoe, tn, ck) Production Casing Annulus Cement ■ T• Potential Flow Path Through Probably experienced Annulus and Casing nitrogen braakout) (Discoarnted - No evidence of casing faijf. . -) Hydrocarbon Reservoirs Shoe Track Cement Flow Path Through Shoe Track and Float Collar _ _- (Failed to prevent hydrocarbon influx) Upper Annular Preventer Yellow Control Pod Blind Shear Ram ITS The Flow Path In the early days of the incident we, along with most of the industry, identified the three potential flow paths for the blowout: Annular flow thru a failed or off -seated casing hanger pack -off, annular flow thru parted or leaking production casing, or flow thru the float equipment. The majority of the industry, including us in the early days, became convinced that the flow path was thru the casing hanger pack -off. We reached this conclusion for two major reasons: 1. Reports confirmed that the lock -down sleeve had not been installed before the blow-out occurred. Quick calculations indicated that if hydrocarbons had been allowed to migrate during and after the cement job, forces due to probable differential pressures could have off - seated the hanger and pack -off. 2. More importantly, the feeling was that whatever happened occurred so fast that the rig crew had no time to react appropriately. The thought of an influx coming all the way from TD to surface without being detected and secured was considered next to impossible and dismissed. As days turned into weeks, several of us began to question why the exposed formations had not failed, collapsed and bridged over the flow path. There are several hundred feet of open formation between the productive interval and the 9-7/8" liner shoe. Despite the implications (well unloaded from the bottom, up the production casing, undetected), some of us reached the conclusion that flow through the float equipment was the only path that could explain the sustained flow without bridging. Unfortunately BP's investigation team, which had access to much more information than the majority of the industry, reached the same conclusion based on multiple pieces of evidence. They go so far as to state that well control efforts were not initiated until 49 minutes had elapsed and approximately 1,000 bbls of influx had occurred. 11 0 0 Evidence of Flow Path from 13P's Accident Investigation IV ■ i� ■ 1 1111111IIM 1 1 lamp scwce, � m 1 prg SOHM (MLA C 9.6pru seilwalrr 1 1MIur Casing Shoe Failure Casing Key Observations for Flow Seal Shoe ( Through Shoe vs. Seal Assembl Failure Assembly Failure Y Mechanical Barrier Y Failure Mode Identified YAssumption Realistic Net Pay R� N Ydrill 1400 psi recorded on pipe during negative test at 18:30 Ability to flow from pi � M 20:58 Pressure Increase from 21:08 to 21:14 Y Pressure Response from 21:31 to 21:34 Y Timing for Gas Arrival to Surface Y Static Kill N Im MARATHOR Well Design Information .k ❑ The discussion regarding the flow path is important because BP was heavily criticized for running the final production casing as a long string. The assumption was that annular flow thru poor cement and a damaged or off -seated casing hanger pack -off was the failure mode. ❑ The investigation team included a diagram that suggested the original Macondo well plan called for a long string of production casing (9-7/8"). According to mutual partners, this design is not uncommon for BP. While it eliminates at least one annular barrier (liner -top packer), it also eliminates leak paths associated with liner hangers and tie -back seals. In some cases this design provides mitigation for annular pressure build-up, and this appears to play heavily in BP's decision to install long strings. ❑ Although we have not utilized a long string in our deepwater completions for a variety of reasons, it is not appropriate to say the use of a long string across a productive interval is negligent. Multiple risks and hazards must be addressed on a case -by -case basis, and there may be times that a long string provides the best solution. ❑ It is the design, installation and proper verification of barriers that is critical 1W 13 Original Well Design and Actual f FV LNIM, 14L ` 4 ndwk C—q "IP F Lww Cwme W am A"A L-9 Sviry Lew Liner vithrobad Depth Hole Size Casing Mud -Fey It B& t 4— T W. 211117 130 SKMT ds Pt 14 FIMMI 721,2"P911" x4m, HSWW JO" 19- TEX*Ord 72., rx lqw� x4w). seww $dlP" now IRA jL01-,D-9 3r 1xv, • I t, I I 10PPI 67-101ma stvv ItIM, .77- 101 1 PP i f VIM A101 16-1 11110 too- III ON 506V Nt to. "611 W # II'mm T IeR-17 It" sow w.w it 71m- Tm 0 - t?,Bm 121 147 k(TT I 179-133wo "AA I' IA' TOL It .14.7'53 0-125 "573 13I I m 147 ILar I 11-7fr 0 ww 9, ?,*- v OW "Sr- TOr 4 -1 7,M VD • 16' MPUMOINJ"t d164 LD1811a %, 6,04t 4,104 ..dP.W 4 1 Fkm CD I m ?- 32W +40% tjS -12,AW 1) 7m- "do I?, t", - 18,1'416- t; 14 h Mg �-QP' Pi' Findings From 13P's Investigation Team 6�31 5 O Riser C4� of BOP -- Sea Floor Casing -11 ReseNo Well integrity was not established or failed OAnnulus cement barrier did not isolate hydrocarbons 0 Shoe track barriers did not isolate hydrocarbons Hydrocarbons entered the well undetected and well control was lost C3,Negative pressure test was accepted although well integrity had not been established Influx was not recognized until hydrocarbons were in riser r5 J Well control response actions failed to regain control of well Hydrocarbons ignited on the Deepwater Horizon 6 Diversion to mud gas separator resulted in gas venting onto rig (-� Fire and gas system did not prevent hydrocarbon `-' ignition Blowout preventer did not seal the well Blowout reventer (BOP) emergency modes did not p g Y seal well Deepwater Horizon Accident investigation 39 • • Investigation Team's Representation of the Physical or Operational Barriers Breached We Integrity Hydrocarbon. Entered the Hydrocaroon_ Blowout Preventer Was Not Well Undetected and Well Ignited on Did Not 5281 E-taoltshed or Control Was Lost Deepware! the Well Failed Horizon Adapted from James Reason {Hampshire Ashgate Publishing Limited, 19971 v Disasters of this nature and magnitude are almost always the result of multiple failures. These failures often involve decisions made, actions taken (or not taken), and barriers. The Macondo 1iiciUUM i5 i]u eX�eptioii. • i- • Well Integrity Was Not Failed ❑ The cement did not isolate the hydrocarbons from within the annular space behind the production casing ❑ The shoe track (cement and float equipment) failed to provide an effective barrier 17 s Established or 88"0 j S' °P9 i Spacer 14.3 ppg SOBM 14.17 ppg . -ta; t ppg (brinill . 13.1 ppg > Foam E Cement 14.6 ppg I Spacer 14.3 ppg 12 6 p jFloat Collar,___.Tev WON? w"y Shoe Track . _ rr t 126 pp9 I .. 12 6 ppg' /__ Reamer Shoe SOBM Tail Cement 14.17 ppg 'M` MNNNTHON • • Cementing Operation The Investigation Team determined the annular cement failed to isolate the hydrocarbon bearing zones for one or more of the following reasons: ❑ Foamed slurry was likely unstable and allowed nitrogen to break out ❑ No fluid loss additives were included in the slurry ❑ Complete lab testing of the slurry was not performed ❑ Contamination of the slurry due to the small volume pumped Channeling due to insufficient mud removal was briefly discussed, with a base oil spacer and only 6 centralizers mentioned. The main focus, however, was on foam instability and possible contamination This complex slurry and spacer program was apparently designed to minimize ECD and maximize the chance of having returns. Having returns at surface during a cement job on a long string at this depth should very seldom be a primary objective, and actions taken to achieve this performance indicator can jeopardize the critical requirements for complete mud removal and minimal contamination of the slurry. 1F Cement Slurry Placement Nitrogen Breakout • Cementing Operation CJ The Investigation Report fails to state the slurry volume, the pump rate used to place it, and the results of the lab testing that was completed. They do state that full returns were achieved during the placement of the slurry. ❑ In a draft report from May, BP states that a 60 bbl slurry was pumped. Based on the wellbore details provided in the final report, the volume required to reach their planned TOC would have been slightly more than 50 bbls assuming a gauge hole ❑ The slurry and spacer densities were very close to the mud density. There would have been very little to no benefit from density differences when displacing the mud. ❑ Although not stated (or at least not found by me), the pump rate while placing the slurry was probably on the low end if fracture margins were tight yet full returns were acheived. Rate (annular velocity) plays a very critical role in effective mud removal, minimizing contamination and eliminating channels. ❑ Time to develop compressive strength was not stated in the report. A Transocean investigation stated "Test on 4112 of 7"casing slurry : 0 psi compressive strength after 24 hours". Attempts to perform a negative test commenced approximately 16-1/2 hours after bumping the plug. rpp d Q UP dF 110 ap S z6paa. 2.6 W P. flare d 1MEN Draft - Work In Progress. Sublset to Revision Data no Circulate 342 hbl before cement Job Pump nitrified foam cement Pumped 60 bbi cement Estimated TOC at 17260' Bumped plug with 1150 psi Cement In piece at 00:35 Bled back 5 bbis to 0 psi Minimal calculated U-tube pressure alter job (nearly balanced) 14.0 ppg mud in rathole with 16.7 ppg cement In shoe track I_nte-q)-retaton Job pumped per plan - no cement losses observed Minimal U-tube may have prevented definitive float test Potential for contamination of cement in shoe track due to density difference between cement and mud Cementing Operation * Based on the information presented, the cement slurry design and implementation had a very low probability of ever providing an effective barrier. Apparently in an effort to maintain an exposed shoe (9-7/8" liner, for future annular pressure buildup mitigation), the overall slurry volume was maintained very close to a calculated gauge hole capacity. Therefore, a 16.74 ppg cap, followed by a nitrified 14.5 ppg lead, chased with a 16.74 ppg tail was crammed into an overall volume of 60 bbls, preceded by a 6.7 ppg base oil and 14.3 ppg spacer to displace 14.2 ppg mud, all pumped at a rate slow enough to allow full returns in an environment with little fracture gradient margin through a tapered string of casing at over 18,000' deep. While there are many factors that must be considered in the planning of a cement job, often times rate and volume can overcome many deficiencies. Rate can help reduce the effects of poor centralization, inability to move the pipe, and reduced density differentials to name a few. Increased volumes compensate for enlarged hole conditions and contamination that occurs during the placement and mud removal process. If cement is going to be relied upon as a barrier, then achieving this becomes the primary objective in the design and execution. Had a significantly larger volume of non -nitrified cement with proper fluid loss additives and LCM material been pumped at a rate that ensured mud displacement and diversion (if losses were experienced below the highest HC bearing zone), it is quite possible this disaster would have been avoided. At these depths and objectives, our practice has and continues to be non -nitrified slurries with tightly controlled fluid loss with LCM additives (if warranted), well centralized casing whenever possible, and rates that ensure proper mud displacement (despite no returns at surface the majority of the time). Ironically, had BP followed our general practice, their concern about maintaining an exposed shoe at the 9-7/8" liner would have been addressed automatically ... no returns equals no cement above the next shoe. M MARATHON ;r • L' The Shoe Track Cement and Float Equipment Failed to Provide Barrier The investigation team identified the following possible failure modes that may have contributed to the shoe track cement's inability to prevent hydrocarbon ingress: 1. Contamination of the shoe track cement by nitrogen breakout from the nitrified foam cement. 2. Contamination of the shoe track cement by the mud in the wellbore. 3. Inadequate design of the shoe track cement (reference to the _ set time of the cement in relation to the attempted negative test?) 4. Swapping of the shoe track cement with the mud in the rat hole (bottom of the hole). 5. A combination of these factors. Three possible failure modes for the float collar were identified: 1. Damage caused by the high load conditions required to establish circulation 2. Failure of the float collar to convert due to insufficient flow rate (reference to a low cement placement rate?) 3. Failure of the check valves to seal. r"Ai Effective area,"Wmf P Cnea valves iF v • • The Shoe Track Cement and Float Equipment Failed to Provide an Effective Barrier We have experienced more than one failure of this type of float equipment. While it is run as a "double valved" installation, an effective seal cannot be taken for granted. Typically, there is enough displacement pressure (differential pressure due to a heavier column of cement in the annulus) following a cement job to immediately determine if the float valves (check valves in the adjacent schematic) are holding. Due to the spacers, nitrified slurry, and very probable channeling and contamination, the differential pressure following the cement job on the 9-7/8" by 7" production casing would have been very little to none. Like we have witnessed more than once in our operations, the check valves may never have been holding. The difference here is there was probably insufficient differential pressure to make this determination. The investigation team pointed out multiple potential failure modes for the cement inside the shoe track. Exposing the cement to a negative differential before it was capable of providing a seal is a possibility as well. A more conventional, higher volume cement job may have provided the differential necessary to determine the integrity of the check valves. 22 cnec* vstvm if tipper v Shoe Tima cenwt fi V U*40 Tubb 14 serer Spas 0 0 Hydrocarbons Entered the Well Undetected and Well Control was Lost ❑ Negative pressure test was accepted despite obvious signs that well integrity did not exist ❑ Influx was not recognized until hydrocarbons were above the subsea BOF ❑ Well control response actions failed to regain control of the well 0 Positive Test Sea floor Cement Mix! Spacer ■ 0 ❑ The Positive Test (2,700 psi) of the production casing was successful. Kill ❑ Although from the opposite direction as the pressure differential experienced after displacing the riser to seawater, the casing and casing hanger seal assembly tested. ❑ Since the wiper plug had landed during the cement job, the positive test pressure was unlikely to be transmitted to the shoe track. ❑ The positive test commenced approximately 10-1/2 hours after the plug was bumped. ❑ At this point a sigh of relief was probably breathed. A very difficult, significantly over -budget well had just been cased, cemented and "tested". ❑ It was also at this point that a False Sense of Security probably set in. .... .... ..... Primary reservoir sands Incorrectly Interpreted Negative Test Choke Boost BOP -�: ❑ Attempts were being made to 15;04 -15:56 accomplish more than one Seawater pumped into Boost, Choke, and Kill tines objective with the negative testing operation. e lit e - ,_.. 16:54 - Close Annular ■ Cement Mud Spacer Seawater W Influx i I 15.56 -16.53 424 bbls of 16 ppg spacer followed by 30 bbls of freshwater and 352 bbls of seawater pumped into well 16;54 -16;59 5o bbls bled off drill pipe due to leaking annular Primary reservoir sands . = (12.5 ppg) ❑ The "spacer" referenced in the Deepwater Horizon Investigation was more accurately described as unused Form -a -Set and Form -a - Squeeze LCM pills in the Deepwater Horizon Interim Incident Investigation dated May 24th 2010 (can't be discharged directly from rig, but if it goes into the well, then the returns can be discharged, so this was pumped ahead of the seawater with the intention of dumping after it returned to surface) ❑ Introducing this additional operation into a very safety - critical test may have added to the difficulty personnel experienced interpreting the results. Ili • • Incorrectly Interpreted Negative Test 17:52 -18:00 Open kill line to conduct _ negative test Bled 3 - 15 bbls into kill line Flow did not x stop and "spurted" Kill line closed11 Cement ; j Mud Q Spacer Seawater Influx Cement Tank rout Vnlurw 15 Wo Kits 16:59 -17:08 Annular seals with Increased hydraulic closing pressure Fill riser with 50 bbls of mud 17:08 -17:27 Monitored that the annular sealed 17'27 Bled 15 bbis of seawater from drill pipe Decision made to change test to kill lima Primary reservoir (12.6 Rpg) ■❑ C When conducted in this manner, the subsea 130P element utilized (ram or annular preventer) must hold a pressure differential from the top, opposite from what it is designed to accomplish. Ironically, the only ram in the stack designed to hold a differential from above was the test ram, the one heavily criticized as a "useless ram" in early media reports. The amount of fluid that reportedly leaked by the annular preventer during the attempted negative test did not help the interpretation of the results (16.0 ppg LCM pill likely entered into and gained height in the kill line). 0 • Incorrectly Interpreted Negative Test '4W Chcke ©csosR i BOP • • i i Cement Mud Spacer Seawater W Il01flux Cement Tank Tntw Vokmie 18 bbis 0-4, 15 t1 u L'1 i 1 t9: 00 - 18: 35 Drill pipe pressure gradually increased to 1400 psi c� 18:42 • r, Pumped into kill line to confirm full Kill line opened for 1 monitorinq negative test 18:42 - 19:55 Monitored kill line for 30 min 1400 psi on drill pipe described as a "bladder effect" 19.55 Negative pressure test was concluded and ❑ At some point it was decided to switch from the drill pipe to the kill line for monitoring. ❑ The kill line reportedly stayed at 0 psi for 30 minutes, while the drill pipe reportedly built to 1,400 psi over a period of time. ❑ The drill pipe pressure was explained as a "bladder effect" and the kill line observations were considered accurate. The negative test was considered successful and displacement of the mud and 16.0 ppg spacer with seawater continued. considered a good test ❑ If two lines are connected directly Additional 3 bbl influx C l to the same compartment, similar pressure responses (variances may exist due to fluid density differences) should be observed. If one reads 0 psi and one builds to 1,400 psi, you STOP and determine why such a discrepancy exists. You PrFnNary rr %ervnir don't blame it on some mythical -sands 112.6 ppg} "bladder effect". r MARATHON Incorrectly Interpreted Negative Test AM Drill Pipe Pressure - Standpipe i psi) Chk,,Nll Pressure (psi) ' Drill Pipe Pressure - Cerne-n! Unit (psi) �Iaw In - Adl Pumps (gpm) r so Raw Out (igm)No 3W E Q � -so oil R44 mommommommoommom min NIEMEN C ISO p OMEN m w0 b. sC 0 MI V f] V V � Y/ p V YJ V VI V VI V � � T V VI � f} V W V Y) V O T CJ T T V EY T 4 H V f] V V ('� n ►-I YI :] i`I R Y) V V d W G ti A A A A A A I>• ti A A }d IC A d 4 W d A fCl d O d 1� W 191 Time 111MMM1EMM1M1M1 C�jIA Y 0 spacer d�ptacerrent complete; mud pumps stopped. © Annular preventer dosed; attempt to bleed drill pipe pressure to zero. © Drill pipe pressure decreases to only 273 psi; annular preventer leaking. 0 Drill pipe pressure increases as annular preventer leaks; hydraulic closing pressure increased to seal annulus. © Drill pipe pressure bled to zero for negativeIxessure test. 0 Decision made to conduct negative-prezzure test -via kill line; kill line opened; 3 bbls to 16 bbis bled to cement unit. � phut in kill line at cement unit, drill pipe pres:;Lre starts to increase. 0 Drill pipe pressure slowly increases #0 1,400 psi. 0 Fluid pumped into kill line to confirm full; kill line opened to mini trip tank for monitoring. � Discussion ongoing about 'annular compression' and 'bladder effect' while monitoring kill line; drill) pipe pressure static at 1,400 psi. m Negative -pressure test concluded, declared a success; preparation made to continue displacement. • • Influx was not recognized until hydrocarbons were above the subsea BC 2,000 400 1,800 350 1,600 a300 ?� 1,400 d cc 1,200 250 � Y 0 ti 1,000 200 800 Y N 150 C a --AV,-4 d) 600 Q 100 N 400 Y n. 50 200 0 0 Flow diverted overboard/77 N N N N Sperry -Sun flow meter N N i),�passed Time —Drill Pipe Pressure (psi) —Flow Out (gpm) — Flow In - Pumps #3 & �4 (gpm) Trip Tank Volume (bbl} Drill pipe pressure increasing Pressure continues to rise 'with constant pump rate 246 psi after pumps are � shut down Trip tank transfer added to flow in Flow out exceeds flow in � and continues after pumps shut down: 39 bb1 gain since 20:52 - End trip tank transfer • • Influx was not recognized until hydrocarbons were above the subsea BO zaav �.00n Based on Real-time Data 1800 FF3w rJut (catiGra'ed — Flaw h (tig pumps) 1 fi00 -- DP Press (rig pump s I 1400 a 1200 1000 two 600 400 ' 20:52-Flaw starts 200 • cumulative Gain Q bbl N N N S08M IMWI �falllfr $ne+�ilai .w Inkm =08M ♦ seff"Wr rnlx 30 Indication #3 Iona i M bbl n :V N Unrecognized Flow Indications In this case the drill pipe had already been completely displaced with seawater. The expectation should be that at a given flow rate, the drill pipe pressure should decline as mud is displaced from the annulus, then remain constant once seawater reaches the surface. During this displacement, influx near the bottom of the well displaced mud above the bottom of the drill pipe, causing a pressure increase. This unexpected response, even with the pumps off, apparently was not recognized. 1. Drill pipe pressure increased by 100 psi when it should have been decreasing (- 39 bbl gain from 20:58 to 21:08 2. Drill pipe pressure increased by 246 psi with the pumps off, and flow does not immediately drop off when shutting down the pumps 3. Drill pipe pressure increased by 556 psi with the pumps off, - 300 bbl gain by now. L 0 0 1 Influx was not recognized until hydrocarbons were above the subsea BO 3,000 — - - - - -- 1,600 2,500 1,400 1,200 2,000 1 a 000 a a� 0 1,%0 s0o d 1,000 600500 LL 400 200 ON // 1�me '1 ,1 O ``� In Y �0 li r — Dntl Pipe r^�resssure psi i — Fbw In A� Pwnps (gpml . 4.>� '/Ib>•wV tiAlet WHM a S.e*.r M. YN :?,M Influx continues to displace mud above the end of the drill pipe, causing the drill pipe pressure to increase with the pumps off. As hydrocarbons pass the end of the drill pipe and the displaced mud and mud -seawater mixture enters the riser (less height for a given volume), the drill pipe pressure starts to decline, rapidly. It wasn't until the last pressure increase with the pumps off that AYF+M 1. Yn someone decided something was not right, but the action taken was to apparently bleed off the drill pipe pressure. r' w e At this point the well must have -_-° been flowing at a very substantial rate for over 10 minutes with the pumps off Mud Flowing Around Influx at Bottom of Drill Pipe MudNVater Mix at Rig Floor Drill Pipe Influx was not recognized until hydrocarbons were above the subsea BOP 3000 Based on Real-time Data Drill Pipe Presssure (psi) 2500 2000 WIN 1000 500 X Influx eaters rr.er jq 101)() WISf'+ Mud shoots up darrikek Attempt to bleed -Diverter ckood pressure -SOP activated Close Drill Pipe SOP Sealing Discussion about Annular. leaking "Differential Pressure" C W Mud and water raining onto deck Mud overflowing onto rig floor TP calls WSL. getting mud back, diverted to MGS, closed or was Pumps shut closing almular Pressure increase due AD calls Serior TP, Well blowing to annular activation out, TP is shutting it in now 0 04 Nt (0 OD (D N v (0 OD CW) CV) M CY) CO Iq 1�r 14 LO N N C%j C14 C14 C14 N I 0 0 Influx was not recognized until hydrocarbons were above the subsea Displacing to seawater Displacing to seawater Sheen test Sheen test ✓- Flow reading affected while emptying trip tank ✓- Meter should have indicated flow ✓- Meter should have indicated flow ✓- Flow reading affected while emptying trip tank ✓- Indicated flow briefly X - Meter bypassed ✓- Indicated abnormal increase (starting at 21:01 ) ✓- Abnormal increase with pumps off ✓- Abnormal increase with pumps off 61 21:14 Displacing to ✓- Meter should have X -Meter bypassed ✓ X - Pits seawater indicated flow bypassed ✓- Meter should have ✓- Increasing with X - Pits 21-31 Stop pumps indicated flow X - Meter bypassed pumps off bypassed ✓ - Data available O - Option to monitor, but not evident if this was performed X - Data not available 33 • • Influx was not recognized until: g -1 k' hydrocarbons were above the subsea BO There have been several discussions regarding the factors that may have contributed to the failure to recognize the influx until it was well above the subsea BOP. The most significant of these, in my opinion, are listed below. I list these, and discount the others on the next slide, because of the following belief: As long as the BOPS and Marine Riser are attached to the wellhead, a conduit directly to the rig exists. As long as a direct conduit to the to rig exists, constant monitoring to ensure well control is maintained is required. The Driller is ultimately responsible, regardless of the other operations going on, for ensuring well control is maintained at all times. 1. False sense of security prevailed since the wellbore had been tested positively, and the negative test had been mistakenly accepted as successful. 2. When preparing to perform an operation, often times the responses can be predicted and should be expected. If the expected responses are not observed, then the operation should be stopped and the reason for the discrepancy should be determined and remedied. The pressure responses shown on the previous slides certainly deviated from what should have been expected. The Driller either did not observe these responses, did not comprehend that these responses should not be expected, or both. Since action was not taken until the last significant pressure increase (with the pumps off, 556 psi), one might conclude that he did not observe. The action, however, (bleed off the drill pipe pressure) indicates he had no comprehension of what should be expected and what was actually happening. 3. It was not uncommon for us to displace the riser with no accurate pit monitoring, but when those cases existed, no - flows were obtained at scheduled intervals and someone was assigned to monitor the flow and confirm no -flow when the pumps were shut down. This was obviously not done on the Macondo well. Flow was not recognized for at least 49 minutes and after 1,000 bbls of influx. New regulations will likely prohibit displacements like this in the future. From now on, displacements will be done with a closed BOP in multiple steps. Almost 20 years ago I stood on the rig floor of a semisubmersible with the Senior Offshore Supervisor I was working nights for. He had worked his way up through the contractor ranks on semisubmersibles, and then hired on with Marathon. He retired not long ago. Pointing at the Driller on the brake, he said "Incase you don't know, that is the most important person on this rig. He can sink this thing faster than anyone else onboard" MARATHON 34 0 Influx was not recognized until hydrocarbons were above the subsea BO Several other contributing factors have been stated or discussed. Some of these are listed below, but while these often receive significant discussion, they are not critical and should have had no impact on ensuring well control was maintained. ❑ VIPs were on board to congratulate the crews for an achieved safety performance milestone. It doesn't matter who is onboard, ensuring constant monitoring occurs and well control is maintained should not be negatively impacted by visitors. ❑ Multiple operations were going on simultaneously, so attention to critical tasks was divided. There are always simultaneous operations taking place on a facility of this magnitude. Well control, however, must always be someone's top priority; and that someone better understand this very clearly. ❑ Transfers of mud to a supply vessel were taking place prior to the displacement, making it difficult to monitor volumes. It was stated in the investigation report that the mudloggers were not notified when transfers ceased and apparently did not monitor the pit volumes. While often used for this task, mudloggers are not the ones ultimately responsible for continuously monitoring the well during all operations. ❑ The mudlogger's flow meter was bypassed and pit monitoring was not possible once returns were routed overboard. Same as above, and other means of verifying the well is stable should have been employed (frequent no flow checks, having someone dedicated to monitoring the returns and verifying no flow each time the pumps are shutdown) 35 0 Well Control Response Actions Failed to Regain Control of the Well ❑ Well control response actions were not taken until water and mud started overflowing onto the rig floor. At this point over 1,000 bbls had entered the well undetected and hydrocarbons were above the subsea BOP. ➢ Mud was expelled through the rotary table up through the derrick towards the crown block before the diverter was closed ➢ Pressure responses indicate an annular preventer was closed, but did not seal immediately. Transocean's protocol was to close the annular, then close a VBR. Eventually the pressure responses indicated a seal was obtained. The annular was only rated to 5,000 psi, and modeling indicated an 8,000 psi differential could be expected at that point. The investigation team concluded that it was very likely that a VBR produced the seal. a.aod 4M --Doll Ppe Pressure Ips'7 Fwr In . All P—Ps Igpmi 390 5,ggg Pock Po nxm lint 1 _—HooN:oaO (M, 3W _CC i Y ..dpg � O 3M F 30D e 3A00 v s 35g : a a e 2ddd 34D d330 s° I.000 320 m ~ � 0 : r 310 U pressure relief verve on pump #2 opens, toolpusher celled to ng floor. © All pump,. -hut down except boon pump. p 4 :tant drlier celled to pump room. p Pump::hut oft. 13 ?ooli usher and driller discus: 'differertal pressure." p Opening of a' surface fine to bleed pre -sure. 0 MucV rater flour: onto rlg "loon and :Per unload: through the demd.. 0 Dverter and arnutar preverte, act vated, diverted to mud ga::eparatot 0 Well :!te leader and :error toolRu:her receive call: from rig floor, annular prevenier attempting to core. 0 BOP sealirg. S OOa -.. _. - - � 200 F'Ipc PrawWC Ips,l 4.500 I.Wilimxf DnulN-q:e. P Ft*v Dp•n ADP u • . - _.. -- lau bmnUW ,oaa 3.5wlow e ? d a ! 2.W '00 • ic " x z a � �p m IOW A 01, « F « « « nm• Well Control Response Actions Failed to Regain Control of the Well 0 37 Flow from the diverter was routed to the mud gas separator (MGS), not directly overboard. This action, regardless of whether someone intentionally lined it up this way or if it was lined up to the MGS as SOP, ultimately eliminated any further human intervention to secure the well and perform emergency disconnect actions. This routing of a major gas event to the MGS resulted in component failures and the rapid dispersion of gas across large areas of the rig. Failure of the fire and gas systems to prevent ignition was listed as another failed barrier, but this is a weak statement. An event of this magnitude would quickly go beyond electrically classified areas, and multiple sources of ignition, including sparks generated by failed components, would have existed. ➢ The subsequent explosion likely took out both MUX cables in the moon pool, thereby eliminating any further actions by the crew to shear the pipe or initiate an emergency disconnect sequence. Well Control Response Actions Failed to Regain Control of the Well Instantaneous gas rates reached an estimated 165 mmscfd with pressures in excess of 100 psi Gas would have likely vented from: Slip joint packer, 12" MGS vent, 6" MGS vacuum degasser vent, I overboard relief line (burst disk), 10" mud line under the main deck Mud by te_r- o'Jacuum Breaker 12" Vent Oise Rated to 60 psi )) E working pressure H Fi0 e ( ose j Ea StarCoard Drverter• Overboard Pori 1--] _ 104 _ Starbcard Oveboard 14" DiverLaw14" Drverterverter Lines Overboard Ovi Rated to 100 or 500 psi Overboard Caisson s a M Seawater M. Seawater/Mud Mix F0 Influx Ui 0 d d d d 0 0 Well Control Response Actions Failed to Regain Control of the Well ripure y. ; . •i a! iuv Vic,_ rigum w. vnpor i jispersion 7T 74U 1P.GOr as 39 Well Control Response Actions Failed to Regain Control of the Well • s Well Control Response Actions Failed to Regain Control of the Well D,l Floor D.vener Pacr e• C Divener "ousiro r le Telescopic Jos-t I—er Bare To Mud ?o Choke & Boost Pump U) Manifokf t Dnd Stnnq MDive^er _ -e Dub Structure verso,•: MUX Cable To Choke & Kill Manifokl To Ftydraulic Power Unit Cesar Deck '.. Mud ; TeiesCopiC Joint Drape Hose—� Packer Housinq Upper Lower h Telescopic Joint Outer Barrel _ iL' Dre loe Hose GII Ri id Choke Conqduit Choke Llne 15K WP Drebe Hose q Mud f aw WP q if Boo.; Riser Hydraulic Conduit Flexible Hose from HPU 41 We-1 certei and BOP,n rt,pq, p Typical MUX reel It is likely the explosion took out both MUX cables, preventing communication to the subsea BOPs Manual activation of either the High - Pressure Blind Shear Rams or the EDS would have been prevented. Testimony indicated that the EDS was pushed and the panel reacted like it should, but "it never left the panel" At this point, only the AMF (Automatic Mode Function) and ROV intervention remained W 0 0 Well Control Response Actions Failed to Regain Control of the Well Although the pressure responses indicated the subsea BOP sealed eventually, flow -21:40 Mud overflowed the flovrline and onto the rig floor. continued after the initial explosion based Mud shot up tnrough the derrick, on the intensity of the fire. -` I �. Diverter closed, and flow routed to mud gas separator (MG'-); BOP activated roelieved to be ar annular preventer). This flow may have come from several (Drill pipe pressure started increasing in response to BOP activation.) sources, including: MN Damon Bankston was advised by Deepwvavr Horizon bridge -o star o" 500 m because of a -21:42 problem with the well. ■ Rig drifting or traveling equipment MN Damon Bankston began to move away. movement moved pipe enough to Mud and water exited MGM vents; mud rained down on rig and MJV Damon Bankston as it pulled away mom Deepwater Horizon. damage the VBR and allow flow again -21:44 oolpusher called well site leader and stated that they were 'getting mud back, and that they had 'diverted to the mud gas separator, and had either closed or were closing the annular" ■ Damage to the drill pipe allowed flow g p p "the Assistant driller ca#led the senior toolpusher to report that well is blowing-21:45 into riser or onto rig floor area out ... [the toolpust er) is shunting it in now" -21:46 Gas hissirg noise heard, and h>gh-pressure gas discharged from MG'_ verts towards deck:. ■ Surface equipment failures (swivel First gas alarm sounded_ packing, kelly hose) -21:47 Gas rapidly dispersed, setting off other gas alarms. -21:47 Roaring noise heard and vibration felt. ■ Pressure relief valves on mud pumps allowed flow into pit area Drill pipe pressure started rapidly increasing from 1,200 psi to 5,730 psi_ (This is thought .o have been the BOP -1:47 � sealing around pipe.) (Possible activation of one or more variable bore rams (VBRs] at 21:46 hours.) -_ 1 AS Main power generation engines stared going into overspeed 1#3 and #6 were online). Rig power lost. Sperry -.Sun real-time data transmiission lost. -21:49 First explosion occurred an estimated 5 seconds ar-ter power Post. 47 second explosion occurred ar estimated 10 seconds after first explosior. 0 9 Well Control Response Actions Failed to Regain Control of the Well Had the 14" overboard line been utilized, as it should have been for any significant gas event, the outcome may have been different. The slip joint packer may still have been at risk, but a significant portion of the gas would have been vented safely away, reducing the chance for ignition. Manual activation of the high-pressure BSR or the EDS would have been much more likely Figure 16. Vapor Dispersion Case for Diverting to the Starboard Dverter. N Emergency BOP Functions Failed to Secure the Well BOP Control Panel `ace HPU & :umulato+s Flex Joint --- .� Upper Annular � Lower Annular Stripping Element LMRP Accumulators Blind Shear Ram -� Casing Shear Ram (Non Sealing) rL Upper VBR --- Lower Stack Middle VBR I. Accumulators Lower (Test) VBR Emergency Methods of BOP Operation Available on DW Horizon Manual Automatic ROV Intervention EDS HOT Stab HP BSR Close AMF AMF 1 Auto -shear Wellhead Connector Wellhead Sea Befit - MIS BOF Stac TM.._ 0 Emergency BOP Functions Failed to Secure the Well Explosions & Fire: Loss of communication Less of electrical power Loss of hydraulics C Damaged Hydraulic Conduit Damaged MUX Cable Yellow Control Pod Emergency Methods of BOP Operation Available on DW Horizon Manual Automatic ROV Intervention HOT Stab EDS AMF AMF HP BSR Close Auto -shear Manual emergency functions had been rendered inoperable by the explosion and fire The AMF (Automatic Mode Function, more commonly called the Deadman System) then became the second to last line of defense. At a minimum this function would have activated the high pressure BSR. The Deadman System requires a loss of communication, electrical power and hydraulics (all three) at both pods to activate. Communication and electrical power would have been lost with the MUX cable damage Although more protected, the hydraulic supply conduit and surface system would have been destroyed as well, if not by the explosion, then by the fire. The Deadman System failed to function Emergency BOP Functions Failed to Secure the Well On this model BOP Stack, the Deadman System relies on lithium battery packs in the subsea control pods to operate the solenoid valves. When these pods were recovered to the surface during the response effort, the Deadman System functions in both were found inoperable. In the Blue Pod, the battery power remaining was significantly below that required to operate the solenoid valve. In the Yellow Pod, there was probably sufficient battery power, but the solenoid valve was inoperable. 30 25 20 A j 15 z m 10 0 0 10 20 30 40 50 Battery Capacity (Ah) OMA I As found yellow pod AMF battery voltage I — A rape pull -In volbpevolts) I• Range of pull -in voltages for Cameron solenoid Battery rapacity (42 Ah) I valve I As found blue pod I ; Estimated battery AMF battery voltage usage for 33 AM (7,81 yottg) I ; actuations (8.3 Ah) I . Blue Pad Yellow Pod '1 aala _ Sa1e�o-o . e; e 1032 ;atero.a var 1 C? t iib f P:bt Sum,P::CY.tO✓"� LAW B� :r+utte `: a ue Hp-�-orossuro Blind Shaar Clo.c tile9MOtA r Ptlt !WCW= Soteno4 t... vonys amp Getter, vea: ra How much attention is given to the lines of defense that are considered "last" or "next to last; especially when there are several barriers before these are needed? OMA I As found yellow pod AMF battery voltage I — A rape pull -In volbpevolts) I• Range of pull -in voltages for Cameron solenoid Battery rapacity (42 Ah) I valve I As found blue pod I ; Estimated battery AMF battery voltage usage for 33 AM (7,81 yottg) I ; actuations (8.3 Ah) I . Blue Pad Yellow Pod '1 aala _ Sa1e�o-o . e; e 1032 ;atero.a var 1 C? t iib f P:bt Sum,P::CY.tO✓"� LAW B� :r+utte `: a ue Hp-�-orossuro Blind Shaar Clo.c tile9MOtA r Ptlt !WCW= Soteno4 t... vonys amp Getter, vea: ra How much attention is given to the lines of defense that are considered "last" or "next to last; especially when there are several barriers before these are needed? Blue Pad Yellow Pod '1 aala _ Sa1e�o-o . e; e 1032 ;atero.a var 1 C? t iib f P:bt Sum,P::CY.tO✓"� LAW B� :r+utte `: a ue Hp-�-orossuro Blind Shaar Clo.c tile9MOtA r Ptlt !WCW= Soteno4 t... vonys amp Getter, vea: ra How much attention is given to the lines of defense that are considered "last" or "next to last; especially when there are several barriers before these are needed? tile9MOtA r Ptlt !WCW= Soteno4 t... vonys amp Getter, vea: ra How much attention is given to the lines of defense that are considered "last" or "next to last; especially when there are several barriers before these are needed? How much attention is given to the lines of defense that are considered "last" or "next to last; especially when there are several barriers before these are needed? Emergency BOP Functions Failed to Secure the Well ROV Intervention also failed to secure the well ❑ The shuttle valves on the Cameron BOP Stack require a minimum flow rate to fully shift and direct fluid to the intended function. ❑ ROV Intervention capability is routinely tested at surface, but it is typically done with a hot line pulling fluid directly from the rig's accumulator system. It is seldom done with or at a rate equivalent to what the ROV pump can generate. ❑ The rate the ROV could generate was insufficient to shift the shuttle valves on this stack. This was due to the design of the shuttle valves and hydraulic leaks subsequently discovered in the system. ❑ The ROV successfully activated the autoshear function (if armed, this function activates the high pressure BSR when the LMRP is disconnected) by cutting the indicator rod. This was done 07:40, 21 April 2010. ❑ The high pressure BSR failed to secure the well, and this was the last line of defense. Additional attempts were made to actuate components with the ROV intervention panel. It was assumed that attempts to close the "pipe rams" meant the middle VBR, but it was discovered that the bottom, inverted test ram was the one actually plumbed to the ROV intervention panel. d7 ,ir A,,ua I— A—" �VP. Eh Bhr S.,— Ran `—g Snmr Ran IN., SMINVI Upm- VOR M..Ab VOR Lr r Nest) VOR 0 .9i Emergency BOP Functions Failed to Secure the Well Failure of the autoshear function, which closes the high-pressure BSR, to secure the well may have been due to: 1. Insufficient hydraulic power to shear the 5-1/2" 21.9 ppf, S-135 which was across the stack at the time of the incident 2. Seal failure due to prevailing flow conditions in the BOP 3. Presence of non-shearable components across the BSR «R 0 • Emergency BOP Functions Failed to Secure the Well 1. Insufficient hydraulic power to shear the 5-1/2" 21 stack at the time of the incident ■❑ ■❑ K 9 ppf, S-135 which was across the Period of approximately 30 hours existed where the subsea accumulators were not being charged from surface (explosion to ROV autoshear activation) During subsequent control efforts, a control system leak of "no greater than" 0.32 gph was determined between pod retrieval and reinstallation. The investigation team stated that a leak of approximately 3 gph for 30 hours would have been required to drop the subsea accumulator pressure below that required to shear the drill pipe. Emergency BOP Functions Failed to Ad Secure the Well 2. BSR seal failure due to prevailing flow conditions in the BOP at the time of actuation. ❑ BSR successfully tested during the positive pressure test on the morning of the incident ❑ The exact flowrate at the time of actuation is not known, but the effect of closing the BSR under what may have been high flowrates is unknown. Much later in the response a rate of 53,000 BOPD was observed, but this was under different conditions at surface (and probably TD). ❑ The investigation team stated that with the leak observed in the hydraulic circuit, the shearing operation would have taken 17 seconds to complete. Without the leak, it should have taken 14 seconds. sn I0 • • Emergency BOP Functions Failed to Secure the Well 3. Non-shearable components were across the BSR at the time of actuation u M7 19 Pictures from later in the response effort showed two distinct drill pipe stubs in the riser section that was cut. This immediately raised questions regarding what exactly was across the stack when the BSR were activated. Through examination of the recovered stubs, the investigation team concluded only one string was across the stack at the time of the BSR activation. Erosion, rig drift and hoisting equipment movement likely resulted in pipe movement and parting of the string above the BOP. The location of tool joints relative to the BSR at the time of actuation is not known exactly. ❑ Results from the physical inspection of the subsea BOP have not yet been released, but may shed more light on this subject. Emergency BOP Functions Failed to Secure the Well or, at top afT: :,r-- ri:er vea- kin 'i 2 Riser lower end cut showing two sections of pipe invde I .) �. r r. I Ik el't I I I&PIP P 41 T" sit Fla.. Z A 6i.h Cut b*Jaw LDUW Azer VA LA Fright led hwtd kafta Pisa gym. Emergency BOP Functions Failed to Secure the Well swo J'Ogg AMMV Pf lkw w,~ COV"K" ---^ +Pt o w' —+ Lao�M jTwlq YAM ----� L Taal .xw" 'A' Tw no.r *w I Tod . - Prior Ott AMtSWO Iwhl Ry 0460 :. Too J"T- ftwCO Of Pow Aw d Rtw SILb OM Fir► Bond Cr, h. s t E�wnd BOP • Recommendations • BP's Investigation team published 25 recommendations, specific to 8 key findings, in the "Deepwatt Horizon Incident Investigation Report". I would encourage you to read these and determine if and how these may apply to your operations. 25 Recommendations Specific to the 8 Key Findings BP Drilling Operating Practice and Management Systems ■ Engineering Technical Practices and Procedures ■ Further Enhance Deepwater Capability and Proficiency ■ Strengthen Rig Audit Action Closeout and Verification • Introduce Integrity Performance Management for Drilling and Wells Activities Contractor and Service Provider Oversight and Assurance • Cementing Services • Drilling Contractor Well Control Practices and Proficiency • Oversight of Rig Safety Critical Equipment ■ BOP Configuration and Capability • BOP Minimum Criteria for Testing, Maintenance, System Modifications and Performance Reliability BP has accepted all the recommendations and is reviewing how best to implement across its world wide operations Deepwater Horizon Accident Investigation 39 Since BP's recommendations are, in some cases, specific to their structure and culture (and maybe influenced by other objectives), let's cover some broader and a few deeper recommendations 61H CJ • Recommendations In the weeks and months following the Macondo Incident, the industry focused on Prevention. The government then demanded similar focus on Spill Containment and Spill Response. The immediate focus on Prevention is both understandable and warranted. We have all heard that "An ounce of prevention is worth a pound of cure". An ounce of prevention would have been worth at least 62 lbs of cure in the case of the Macondo incident. The same philosophy holds true when focused entirely on the multiple layers of Prevention that we rely upon. The earlier in the layers of defense that an issue is recognized and aggressively addressed, the more efficient and reliable the response will be. wen Inlegrtry Hydrocarbon, Entered the Hydrocarbon-, B;ovwout Preventer Wall Not W0 Undetected and Well 19nned on Did Not Seal Established or Control Was Lost Deepwate, the Wefl Flailed HO,'7,0,1 Critical Fmtor Critical Fsdw friticnl Factor Critical Factor U p Y W °EXPLOSION1 Recommendations Barrier Philosophy Maintaining control of fluids, both produced and injected, throughout the life -cycle of a well is of primary concern and is a basic expectation. The design, installation or use, and proper verification of barriers is critical to meeting this expectation. Examples: ❑ If cement is going to be relied upon as a barrier, then achieving this becomes the primary objective in the design and execution. If trying to meet other needs that may jeopardize the barrier objective, the ability of the cement to perform as an effective barrier should be rigorously verified, or another barrier should be installed and tested. ❑ Safety -critical tests should be as simple and straight forward as practical, not encumbered by steps that could contribute to the misinterpretation of deviations from the expected. The reasons for deviations from the expected should be adequately investigated, the risks assessed if needed, and mitigation efforts implemented before proceeding. f 0 56 Recommendations Secondary and Emergency Control systems should be understood and tested. Deficiencies or failures in these systems should be either remedied or risk assessed. If the risk assessment concludes it prudent to proceed, the implications should be well understood by those potentially relying on the system. If another use or configuration exists for a safety -critical system, but this use or configuration may create additional hazards, the circumstances under which the alternate use can be employed must be well defined and understood. Examples: U How much attention is given to the lines of defense that are considered "last" or "next to last'; especially when there are several barriers before these are needed intervention)? At least in the GOM, this is soon to be mandated. (Deadman, autoshear and ROV ❑ A diverter system is designed to divert flow safely away from personnel and the facility while minimizing the pressure on components with low pressure ratings. With the prevalence of SBM usage in the deepwater environment, the ability to route the diverter to a MGS became common. The diverter should direct flow directly overboard through a large ID line to avoid over pressuring the slip joint packer, diverter element and marine riser components. Since SBM can't be discharged, and gas has the ability to go into solution (oil phase of the mud) and then be liberated near surface, the use of the MGS to control relatively minor solution -gas events (bottoms up after a trip, extensive sampling operations, or controlling a kick) has been widely accepted. Routing returns to the MGS during a major event, however, poses significant hazards. In the case of the Macondo incident, this action may have resulted in the death of 11 people and the elimination of some critical barriers that are typically relied upon. a • Recommendations Culture • In the days following the Macondo incident, most companies immediately searched for assurances that this could not happen to them. I won't speculate on how many assurances were made. The established processes that BP had in place (documented reviews, management of change, basis of design) are impressive. Unfortunately, these failed to prevent 11 deaths and a spill of national significance. Although harder to define and measure, and even more difficult to regulate, we pointed to our culture as the single most important differentiating attribute when comparing us to BP. In a recent meeting with an individual who has numerous dealings with BP, he observed that regardless of the purpose of the gathering (planning session to morning rig call), it is almost impossible to determine who is ultimately responsible and accountable for the operation being discussed. Evidence of this exists in the very report this presentation was derived from. 58 Immei Ack Recommendations }r In a "White Paper" presented to the BOEM, we presented what Marathon considered appropriate safeguards to have in place in order to resume operations in the GOM. The language below comes directly from that letter and was drafted by Greg Sills (VP Upstream Developments). Additional comments are shown in blue: The BP incident serves as a stark reminder, however, that systems and expectations are not enough no matter how well presented - a culture that encourages the appropriate leadership and individual behaviors is perhaps even more important. We intend to continue to reinforce the culture of a highly reliable organization that sustains attributes such as the following: ❑ A preoccupation with deviations, lapses, errors - responding quickly and rigorously to anything which falls outside expectations, and refusing to recalibrate expectations in order to avoid normalization of deviance. (Opposite responses during the negative test, yet rationalized and dismissed; continued warning signs during the displacement that well integrity did not exist) ❑ A listening environment - where leaders listen to the front line and defer to expertise, faint signals are heard, and the front line reports confidently - even (especially) when the report is troublesome. (Our established culture of brutally honest reporting) ❑ Certainty is created where possible - standard procedures are followed, not circumvented - creating excess capacity for dealing with the truly "unexpected" (One of the reasons that drove the creation of our Design and Operating Guidelines - unless you have obtained proper approval for a deviation, the established standards will be followed so attention can be focused on other areas) These are examples of a responsive and agile organization that detects small misjudgments early, notices the unexpected while it is still forming, arrests it before it expands, and safely returns to normal o gation. AEC Recommendations f Final Thoughts: Responsibility and Accountability. Focus and awareness increase when you know that you are both responsible and accountable. Take the earlier points made when discussing well monitoring: As long as the BOPS and Marine Riser are attached to the wellhead, a conduit directly to the rig exists. As long as a direct conduit to the to rig exists, constant monitoring to ensure well control is maintained is required. The Driller is ultimately responsible, regardless of the other operations going on, for ensuring well control is maintained at all times. Would an influx of 1,000 bbls over 49 minutes occur undetected if the Driller truly understood and believed this? False Sense of Security. We must always guard against complacency in the absence of recent consequences. For years the industry bragged that there had never been a deepwater blowout of any significance. "Last line of defense" safety systems went years without ever being needed. Guards were lowered. We must maintain a sense of vulnerability. 'M MARATHON 60
