Section by section: Practical safety case development to make it a valuable document

By Neil Holland and Victor Gibson, Marex Marine & Safety Services

In a number of offshore environments, a safety case is required, either by the flag or coastal state or by the operator. Rig owners will hire some suitably experienced and expert organisation to produce the required document, and the result will be submitted for admiration and, in some cases, approval.

In many cases, the whole activity will pass by the workforce, who will only be aware of the existence of the document if they have access to the OIM’s office. Of course, the rig manager will have one as well, visible on his shelf of important documents. He will regard it as his licence to drill.

The compilation is invariably extremely expensive, so it should be more than a heavyweight that can be used to keep doors open. A big stone would do the same thing. Surely, we can do better.

As a result of the inquiry into the loss of the UK production platform Piper Alpha, offshore installations working in the British sector of the North Sea were required to be provided with safety cases. Lord Cullen, who headed the inquiry, suggested that they would encapsulate, in one document, the information that would be required to prove that an installation was operating as safely as possible in the offshore environment.

This recommendation was only one of more than 130. Another was that offshore safety was to be administered by the UK Health and Safety Executive (UK HSE), which was becoming notorious even then for, among other things, requiring schoolchildren to wear safety glasses when playing conkers.

There were few consultants developing safety cases for mobile units at the time, and much of the expertise in the HSE and drilling industry was recruited from nuclear consultancies, primarily based in Warrington. While they were expert at developing and assessing quantitative risk assessments (QRAs), few had much knowledge of the marine world.

Another failing in the earliest safety cases was a realistic means of assessing hazards. As a result, a number of qualitative assessment techniques were developed, one of which was the “bow-tie,” which was pioneered in the UK by EQE (Earthquake Engineering).

Over the years, a variety of safety case templates have been developed to assist rig owners with the task, which remains onerous. Templates have become extremely complex, which tends to ensure that the document will continue to be compiled by consultancies. It also ensures that they will remain opaque and of little use to anyone except the producers of the document and the assessors who determine whether it is actually a case for safety.

The latest templates contain more words, more matrices, more evaluation processes and more acronyms than ever before, but seem to have mislaid the original objective.

Of course, the templates are approved by committees, and it is natural that they don’t wish to commit the industry to anything too onerous. So these documents are gradually reduced to processes with limited value.

Will today’s safety case templates contribute to the safety of those offshore? Whatever its intentions, does it just look like a paper exercise? There are pertinent questions, such as, “How can you carry out a risk assessment without having any recommendations?” and “How can you have a risk matrix for major accidents that included a level of ‘several times a year at the location’ when the most frequent major accident should not occur more than once in 1,000 years on any installation?”

In the UK, a second iteration of safety case regulations has resulted in a closer relationship between the regulations themselves and the supporting legal requirements – the Prevention of Fire and Explosion and Emergency Response (PFEER) regulations, the Design and Construction Regulations (DCR) and the Management and Administration Regulations (MAR). Aside from requiring consultation with the workforce, the new regulations also require that the case be reviewed at suitable intervals by someone not involved in the production of the original case.

WHAT’S TO BE DONE?

We probably need to go back to what Lord Cullen intended in order to find a way forward and to make the safety case a valuable document, not just for the rig manager who gets his licence to drill, or the HSE or other regulatory body who get to feel that they are doing the right thing, or for the consultancies who make money. He intended that the compilation of the document would:

• Assist in the maintenance of a suitable safety management system;

• That the system would be visible to the workforce;

• That the details of the installation should be included because they would be unlikely to exist anywhere else;

• That the risks in the operation of the unit should be assessed to ensure that they would be reduced to an acceptable level; and

• That, as part of the process of assessment, improvements in the existing systems, structure and procedures would be identified and put in place.

SIX SECTIONS

We have more or less accepted that the case should be divided into six sections because all templates have followed this layout for some years. However, what is important is the content.

Section One

It’s accepted that this section should contain the roadmap for the rest of the document.

Section Two

This section traditionally contains the summary of the safety management system. Several guidance documents are available that can be used to ensure it contains the appropriate information.

At this point, the safety case compilation will assist the owners of the unit to ensure that their safety management system contains what is required to keep people safe. Identified deficiencies can be addressed during the development of the case.

However, it may be best to summarise the various components of the system rather than writing a few words followed by a reference. References were recommended by the original guidance to the 1993 safety case regulations, but it may be time to limit their use. References require the reader to look at other documents or other sections of the safety case. The result is that the section itself is often almost impossible to read.

Section Three

This has become the repository for the “technical details” of the installation. It would seem to be the simplest thing in the world to write out the specification of the equipment on the rig. Surely, everybody knows what there is in the way of equipment.

Sadly, this is not so. Compilers researching the details of an installation often find conflicting information written in different places. Such problems are frequently resolved by writing language that is so vague, it is no good to anyone. At the very least, the compilers should carry out in-depth research on one rig of a class, possibly going to the extreme measure of reading the specification of the equipment off of the attached brass plates and tracing the ventilation ducts from individual compartments to the vents on the exterior of the unit.

Once a single rig of a class has been thoroughly researched, the details can be checked by the engineering department of other rigs. This ensures that the details are correct and therefore have a value for the existing and future crew members.

Section Four

There is more than one way of dealing with the dreaded risk assessment section. Whatever processes are used, it could be best to develop a separate risk assessment document and summarise it in the safety case. The case should therefore contain a description of the processes used and the results. Both should be presented in a way that the workforce can understand.

Lord Cullen was keen on the inclusion of QRA in the risk assessment, and the HSE in the UK set a standard that the Individual Risk Per Annum (IRPA) for each offshore worker should be less than 1 x 10-3. Attempts at an explanation will only increase the level of boredom, and this is the problem with QRA. It has a use, but no one except for statisticians understand it, and it is easy to manipulate.

We are better off concentrating on qualitative risk assessments, all of which can involve the workforce. One of the most effective is the bow-tie method. If properly used, it is conducted by a facilitator assisting members of the rig’s team to assess the barriers in place that would prevent major accidents. The technique allows failings to be identified and recommendations to be made.

Section Five

Mitigation is the means by which the effects of major accidents are limited. In the event that the accident happens, it is essential that the management system and the emergency equipment on the rig offers the best opportunity for saving lives. This is usually described in Section Five of the safety case. In the UK, it is usually the summary of the PFEER Assessment, but it should describe the emergency equipment and systems to be used on the rig. Remember that a major accident is one where there are likely to be more than five fatalities; occupational accidents have a place elsewhere.

When it comes to emergency equipment, we live in a prescriptive world, with standards set by the flag state of the unit, usually for drilling rigs, in accordance with the MODU Code.

It is common for the qualitative risk assessment process to determine the adequacy of the emergency arrangements, and nothing prevents the owners of the unit from doing better than what’s required by regulations. Once more, the section should summarise the emergency provisions, and the safety case process gives the workforce the opportunity of looking at them and making improvements to the basic requirements.

UK regulations require that all emergency arrangements be interlocked in a workable way, including the station bill, the offshore emergency manual and the onshore procedures and organisation.

When discussing the arrangements during the risk assessment, it is up to the facilitator to make sure that the emergencies are realistically considered. It is a common approach to provide emergency response documentation, which does nothing more than lay out a basis for a weekly exercise. We have to do better.

Section Six

Finally, the safety case of old contained a section that was called “Justification for Continued Operations,” which more or less contained the recommendations from the risk assessments and the programme for their implementation, or why they were not to be implemented.

If one is to approach the safety case process as a means of keeping the workforce safe while they are offshore, it is essential to detail such a programme. No installation is perfect. No safety management system is without fault. The safety case process provides a means of using the collective knowledge and expertise of the workforce to tease out these failings and improve systems and procedures, and as participants they will then be likely to know what it is, where it can be found and how best to use it.

This article is based on a presentation at the 2010 IADC Drilling HSE Europe Conference & Exhibition, 29-30 September, Amsterdam.