2

Changes in Offshore Safety Since 2010

INTRODUCTION

This chapter presents an overview of recommendations and regulations intended to reduce risk of another major blowout and explosion and what is known about how industry, Congress, and offshore safety regulators have responded to them. This overview addresses the item in the committee’s Statement of Task that states:

The chapter is organized as follows. The first section that follows summarizes safety changes made in response to the major regulatory reforms recommended in several post-Macondo reports, additional actions taken by government and industry to reduce risks and consequences of another major accident, and decommissioning of aged platforms in shallow water, all of which should be reducing risks. The second section discusses other safety changes as well as responses to several key recommendations from major reports that were intended to reduce systemic risks and the extent

to which they have been adopted. Complexity of the offshore workforce, most of which is provided by companies providing drilling and related services under contract to the operators holding leases to drill and produce in public waters, is also discussed. These changes and remaining challenges have implications for overall systemic risk. The final section provides the committee’s conclusions.

Many reports on the causes of the Macondo blowout, explosion, and oil spill were issued after 2011. They made hundreds of recommendations for reform. The number of summary and detailed recommendations from just the eight reports relied on for this chapter, and listed in Appendix A, exceed 150. Rather than attempt to address whether all of the recommendations have been adopted, the committee chose to focus on the major crosscutting themes that address systemic risk. Unless otherwise cited, this chapter is based on findings and recommendations made in the independent reports by the National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling (National Commission, 2011), the Chief Counsel of the National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling (Chief Counsel, National Commission, 2011), the National Academy of Engineering and the National Research Council (NAE and NRC, 2012), the Transportation Research Board (TRB) (NASEM, 2016, 2021; TRB, 2012), the American Bureau of Shipping (ABS, 2015), and the Chemical Safety and Hazard Investigation Board (CSB, 2016).

The reports from the National Commission (2011) and its Chief Counsel (2011), the National Academy of Engineering and the National Research Council (NAE and NRC, 2012), and the Chemical Safety and Hazard Investigation Board (CSB, 2016) are all assessments of the causes of the Macondo disaster. They also made recommendations to address these causes. Other reports after the disaster did the same, but we rely on the ones listed above as the principal objective and independent sources. TRB’s report on evaluating safety and environmental management systems (SEMS; TRB, 2012) was chosen because it makes recommendations for determining the effectiveness of one of the major reforms adopted after Macondo. The American Bureau of Shipping report (ABS, 2015) was selected for inclusion because it was commissioned by the Bureau of Safety and Environmental Enforcement (BSEE) to recommend steps to close gaps in SEMS regarding process safety that were identified by the CSB and others. The National Academies report (NASEM, 2016) is included because it makes recommendations on a culture that supports safety of the offshore industry that was identified as a problematic issue by the National Commission, NAE and NRC, CSB, and virtually all other reports on the causes of the Macondo blowout. The committee also includes the National Academies report (NASEM, 2021) commissioned by BSEE to guide it on how

to improve its inspection program, which has been criticized in multiple reports as being too narrowly focused.

MAJOR RECOMMENDATIONS ADOPTED AND OTHER SAFETY IMPROVEMENTS SINCE 2010

Regulator Reorganization

In response to the recommendations made by the National Commission and others, Secretary of the U.S. Department of the Interior (DOI) Salazar reorganized the department’s oversight and regulation of the offshore oil and gas industry by assigning revenue-generating activities and safety oversight to separate agencies. This action ultimately led to the creation of BSEE with a singular safety mission. Some have argued that DOI itself retains an internal conflict by facilitating oil and gas production in one part of the department while restraining it in another. However, no compelling evidence has been presented indicating that BSEE or its predecessor agency, the Minerals Management Service (MMS) has acted inappropriately in its oversight of the offshore industry.¹ Independent of whether a conflict is real within DOI, BSEE now has a clear and focused safety mission.

Safety Management System Rules

Shortly after the Macondo Well blowout and explosion, BSEE’s predecessor, MMS, pushed through the first SEMS rule, which required the offshore oil and gas industry to implement SEMS as contained in American Petroleum Institute (API) Recommended Practice 75, Third Edition (API RP 75). The required use of SEMS is potentially the most significant safety reform made in the aftermath of Macondo. A subsequent SEMS rule made mandatory the adoption of additional elements defined by BSEE. It also required the use of accredited, independent audit service providers to do all BSEE-required SEMS audits. Formerly, full adoption of API RP 75 had been voluntary, but it had not been fully embraced by companies operating on the Outer Continental Shelf (OCS). These changes were recommended by independent reports post-Macondo, but MMS had been advocating for SEMS for many years beforehand.

___________________

¹ MMS had authority for offshore oil and gas operations from 1982 to 2010. In June 2010, MMS was renamed the Bureau of Ocean Energy Management, Regulation, and Enforcement (BOEMRE) as a response to the Deepwater Horizon incident. On October 1, 2010, BOEMRE’s royalty and revenue management functions were transferred to a new bureau, the Office of Natural Resources Revenue. On October 1, 2011, DOI reorganized the remainder of BOEMRE into two new, independent bureaus: BSEE and the Bureau of Ocean Energy Management.

In response to a request from BSEE about how to evaluate SEMS programs, a 2012 National Academies committee made recommendations focused on an independent audit process (TRB, 2012). The committee for this report favored reliance on company audits by trained and certified audit staff independent of the facilities being audited, but who were nonetheless employees of the company. Their reasoning was that this would ensure that the companies involved would “own” the audits and be more likely to adopt the recommendations. BSEE chose instead to rely on third-party certified auditors, presumably because the public would be more likely to trust the results of independent third parties over those including company employees. There are advantages and disadvantages in either approach; the important development for offshore safety is that there now is a certified, independent audit process in place. The 2012 TRB report committee also recommended that BSEE conduct its own audits by BSEE staff whenever warranted and that it hire qualified and certified auditors for this purpose. This recommendation has been adopted, at least in part, but BSEE has yet to build a cadre of its own accredited auditors.

Ten years after Macondo, the results of the third audit cycle showed progress in operators’ use of SEMS to drive continuous improvement in safety, but the commitment to implementing SEMS as intended by API RP 75 remains uneven across the industry (BSEE, 2020). Other ongoing concerns with individual elements of SEMS are organizational and cultural issues regarding whether offshore workers are comfortable stopping work and reporting safety concerns without fear of recrimination. Whistleblower protection, recommended in several reports, has not been enhanced since 2011; doing so would require an act of Congress, according to BSEE.

Well Control Rule

In 2016, BSEE issued a rule that consolidated guidance to lessees, developed in the aftermath of Macondo, and incorporated 10 updated industry standards by reference. All of the investigative reports on Macondo note the failure of the blowout preventer (BOP) and its components.² This rule added prescriptive requirements for well integrity, such as enhancements to BOP capability and well design, maintenance of a minimum margin of safety while drilling, use of remote real-time monitoring (RRTM) in certain circumstances, and set time limits for operators to test and update their BOPs and related equipment. The rule also mandated reporting to SafeOCS (described below) of BOP failures during operation, maintenance, or testing. In 2019, BSEE revised this rule to reduce unnecessary and overlapping requirements on industry while leaving important safety reforms in place.

___________________

² The BOP is a principal fail-safe system required for all offshore wells.

Important regulatory changes in 2019 were provision of more flexibility via requests for BSEE to review and approve requests for waivers in certain circumstances for (a) maintaining a singular prescriptive minimum overbalance during drilling to provide a margin of safety and (b) required use of RRTM in certain circumstances. BSEE agreed to the revised rule in response to industry proposals for solutions more appropriate to particular drilling situations. BSEE continues to evaluate comprehensive regulations such as the Well Control Rule (WCR) to ensure that it stays up to date with technology and operating practices. BSEE continues to evaluate the effectiveness of the WCR, and in 2022 issued a set of proposed revisions (BSEE, 2022).

Oil and Gas Production Safety Systems Rule

In 2016, BSEE issued revised requirements for safety and pollution prevention equipment (SPPE) used during production. These changes enhanced safety and performance requirements and required third-party verification that the equipment was suited for the most extreme conditions in which it might be used. The rule also required reporting of failures of SPPE during testing or operation to SafeOCS. The 2018 regulatory revisions for simplification and modernization removed the requirement for third-party verification for equipment use under the most extreme conditions and reduced certain visual inspection requirements because of enhanced testing technology. The 2018 revisions also incorporated 12 updated industry standards by reference.

Improved Safety Incident Data

Several reports following Macondo emphasized the importance of greatly improving the reporting and availability of industry-wide safety indicator data based on reporting of safety incidents free of fear of recrimination and whistleblower protection. As discussed in more detail in the next chapter, BSEE has funded the SafeOCS, which, in its voluntary program, is making slow but steady progress in improving the availability of shared industry data on safety incidents and near misses and leading and lagging process safety indicators. The SafeOCS Industry Safety Data (ISD) program is, at the time of this writing (July 2022), pooling the incident data voluntarily provided from operators, contractors, and service providers representing 92 percent of offshore production, but still a small share of the total number of operators, contractors, and service providers. As noted, the WCR and the Oil and Gas Systems Safety Rule mandated that operators submit information to SafeOCS on failures of drilling and production failsafe systems. SafeOCS is making aggregated results of its data, anonymized to protect the identity of providers, available to the public. (Examples of

SafeOCS data are discussed in Chapter 3.) BSEE has also made most of its enforcement data, as well as its reports of fires, explosions, and loss of well control incidents, accessible via its website. BSEE reported to the committee that it plans to improve the accessibility of this information in the future.

Although SafeOCS has made progress in pooling data collected by operators, which includes data from their employees and contracted employees, reports made directly by workers to SafeOCS remain rare. Whereas SafeOCS can protect the identity of reporters to help ensure confidentiality, it does not provide protection for whistleblowers for any infraction or oversight on their part that may have contributed to the incident being reported. In commercial aviation, there are legal and regulatory protections for individuals for reporting infractions as long as they are not criminal. The intent of these protections is to encourage reporting of near misses and procedural violations by avoiding blame and recrimination. Reports by frontline employees allow operators to identify and focus on root causes. The model for SafeOCS is the Aviation Safety Reporting System (ASRS), which averages roughly 100,000 reports per year. Similar aviation programs have emerged to capture reports and protect reporters for operator-run near-miss reporting systems used by air carriers and by the Federal Aviation Administration’s (FAA’s) air traffic control service. These programs have legal protections from recrimination similar to those offered by ASRS, although they are not as extensive. The aviation system has worked diligently to create the “reporting culture” (see Reason, 1997, pp. 191-220) that underpins the remarkable safety gains achieved in aviation over the past two decades (NASEM, 2022). Although offshore operators have created internal near-miss reporting systems on which SafeOCS ISD program is based, it remains an open question whether they have been able to create a blame-free reporting culture without the legal protections offered to reporters in the aviation voluntary safety reporting systems.

FAA has also vowed not to use sensitive safety information that air carriers pool for analysis of incidents as an enforcement tool and has established regulations that protect carriers as long as they are actively analyzing the data to identify hazards. These protections are lacking for the offshore industry. The paths that the offshore industry and BSEE have taken is to (a) create the voluntary pooling of sensitive company data for analysis by companies participating in the Center for Offshore Safety (COS), described below, and (b) the SafeOCS ISD program, described above. In aviation, virtually all carriers participate in the voluntary pooling of sensitive company safety data for analysis. For the offshore industry, participation is largely limited to the largest operators and contractors.

Regulatory Focus on Major Areas of Risk

As a consequence of its shift in focus to higher areas of risk, BSEE has recently begun using risk-based inspections designed by them to better focus its inspection workforce to address major sources of risk, both at the operator and individual facility levels. Most of BSEE’s risk-based inspections are based on the most significant findings from inspections and other sources of BSEE data. BSEE has attempted in the past to develop risk-based models to help it orient its inspections to the highest sources of risk, and continues to work on such quantitative tools, but its current use of risk-based inspections depends on traditional means (primarily inspections) of identifying operators at higher risk of causing a major accident. This approach is not quite the analytically based, data-driven way that several reports have proposed, but use of risk-based inspections is a sign of progress (NASEM, 2021).

Creation of the Ocean Energy Safety Institute

The Ocean Energy Safety Institute (OESI) was established and funded by BSEE as recommended by the DOI advisory committee post-Macondo to enhance BSEE’s ability to assess and promote new technologies in collaboration with industry to enhance offshore safety. OESI was initially underfunded and lost industry support from its advisory board. The revised OESI Phase II is much better funded, a collaboration with the Department of Energy, and has a different external management group.³ It shows BSEE’s and industry’s commitment to expanding offshore safety research and development (R&D), as recommended by the National Academy of Engineering and the National Research Council in their report (NAE and NRC, 2012).

Center for Offshore Safety

As encouraged by the National Commission, the offshore oil and gas industry created COS, which is devoted to improving the safety of offshore oil and gas operations and is funded by member organizations. COS has become an active industry forum for improving SEMS development and implementation and for developing industry SEMS good practices. It also reports on lagging and leading safety indicators shared by COS members, and it established the processes for accrediting independent auditors of SEMS, as mentioned above.

COS is not fully independent of API as the National Commission had encouraged, and COS membership by operators, contractors, and service

___________________

³ See https://oesi.tamu.edu.

companies is not a necessary condition for operating on the OCS, as recommended in the National Academies’ safety culture report (NASEM, 2016). However, COS is part of the technical side of API that is organized independently of its industry advocacy to produce standards and recommended practices. Operating as part of an existing organization has freed COS from the costs of setting up and paying for administrative functions and allowed it to focus its resources on safety.

Currently, COS membership⁴ represents about 60 percent of OCS production, and all of its products and reports are available to companies operating on the OCS. Moreover, COS has dropped its previously significant annual membership fee to a nominal amount, which has brought in new members, particularly smaller independent companies, who are actively participating in COS safety committees, safety forums, and safety summits. COS has been enhancing safety management by defining measures of safety practice, sharing and discussing leading indicator data among companies, monitoring trends, preparing guidance documents, and publishing an annual report summarizing the safety measures collected and shared by its members.

Revised and Improved Industry Standards

In the aftermath of Macondo, API adopted or updated more than 250 safety-related industry standards, including RP 75 (the standard on which SEMS are based) and many technical standards related to the safety of drilling and production (API, 2020). It also extended API RP 754 (Process Safety Performance Indicators) to apply to upstream operators. Independently, the International Association of Oil & Gas Producers issued Report 456 on Process Safety—Recommended Practice on Key Performance Indicators (IOGP, 2018). BSEE typically includes API standards by reference in its regulations, thereby making them mandatory. Because of the slow pace of the regulatory process, however, BSEE is often not current with the latest standard updates and revisions, including API’s latest update to RP 75 (Fourth Edition).

Deepwater Well Capping Capability

Since the weeks-long effort to cap the Macondo Well, the industry has formed two independent, nonprofit well containment organizations: the Marine Well Containment Company (MWCC) and the Helix Well Containment Group (HWCG). In 2016, HWCG dropped the reference to Helix and is now simply HWCG. Through a considerable capital investment by

___________________

⁴ See https://www.centerforoffshoresafety.org/Membership/Member-Organizations.

industry, both the MWCC and HWCG have developed well capping and well containment technologies and have improved industry spill response plans and spill exercises and drills. Both organizations have developed the capability to cap wells up to 20,000 PSI shut in pressures, and both are recognized by BSEE as providing the necessary response capabilities for a permit to drill.

Decommissioning of Shallow-Water Platforms

As described in more detail in the next chapter, over the past 11 years more than 1,800 low-pressure, shallow-water platforms that were no longer producing oil and gas have been decommissioned. These older platforms and their associated wells were at less risk of major blowouts and spills because of their low pressures, but the wells and facilities were old and more prone to occupational incidents and small but concerning equipment failures. In addition, operators of these old wells and platforms in shallow water have twice as many SEMS deficiencies as operators in deepwater (BSEE, 2020). Older, shallow-water wells and platforms still in operation do present occupational hazards and possible blowouts and spills, but generally their low pressures and depleted reservoirs do not risk incidents of national significance.

Other Safety Improvements

In addition to the broad reforms discussed above, several proactive initiatives by the Society of Petroleum Engineers (SPE) and other industry associations illustrate the increased willingness of individuals in industry since Macondo to work across organizational and association lines to focus on and enhance systemic risk awareness and management through data collection and sharing, R&D, and technology development for training. Outside of formal API standards-setting processes and cross-company collaborations in specific R&D projects, the degree of collaboration and openness about issues that should be addressed after Macondo was unprecedented. Similarly, whereas MMS tended to limit public access to data findings of noncompliance or incidents, BSEE has committed to much greater transparency. Illustrative examples of this growing maturity of industry and regulator are provided below.

• Industry Support for SafeOCS. Over a 2-year period, SPE and BSEE worked with offshore industry experts, as well as experts from other industries, to develop best practices for collecting and sharing incidents and key learnings from them that were not being captured by the offshore industry (Moreau and Collia, 2020). This

• culminated in a 2016 SPE Summit that developed industry agreement and support for SafeOCS.
• Industry Priorities for Safety R&D. SPE subsequently partnered with the Gulf Research Program (GRP) to organize and hold an SPE summit in 2018 that also brought together a broad cross section of industry experts to identify safety R&D priorities for GRP on a wide variety of topics (SPE, 2018). Illustrating an awareness of the breadth of issues to be addressed in improving systemic risk management, the topics spanned automation; crew resource management; leadership training; individual competency in barrier management; development and application of key performance indicators; personal engagement and accountability; safety data collection and analytics; equipment performance and reliability assessment and predictive indicators; improved reliability of pore pressure and fracture gradient sensors and estimates; improved hazard assessment and kick detection; reliability of maintenance and testing activities, and many others. (Other relevant GRP R&D initiatives related to systemic risk are described in Chapter 6.)
• Enhanced Well-Control Training. In 2017, the International Association of Drilling Contractors (IADC), building on the efforts of IOGP, API, SPE, and OESI, developed advanced well control testing, training, and certifications, including training for drilling teams to train crews in detecting, communicating, and responding as a team to well events to avoid loss of control (Smith, 2017). The training is specifically designed to account for human factors and nontechnical skills, drawing from best practices used by the military and other safety-critical industries. Enhanced training in nontechnical skills was recommended by the CSB in its report. This kind of training for drilling teams has been enhanced with sophisticated well operations simulators used by some drilling contractors.
• BSEE Safety Information Sharing. BSEE’s commitments to making public more of its safety information is mentioned above. Sharing of safety alerts provides another example. BSEE has long prepared safety alerts to safety managers in industry in response to significant safety events or trends. As part of the agency’s general efforts to make its safety data and information more transparent, in 2019 BSEE began sharing its alerts via text messages, including directly to offshore workers. This effort supplemented the ability of anyone interested to sign up to receive the alerts by e-mail as they are released.

Summary

The reforms and activities discussed above should be reducing overall systemic risk. However, as reviewed in the next chapter, (a) BSEE’s lagging indicators of safety incidents, though generally showing a low and positive trend, are not sufficient to determine risk trends over the last decade, and (b) insufficient longitudinal data are available from more recent leading indicators produced by COS and SafeOCS to identify trends. The reduction in the number of low-volume active wells on the GoM OCS has reduced overall risk of occupational injury and minor spills, but this is a function of economics and demand and not the result of safety policies and practices.

MAJOR REPORT RECOMMENDATIONS NOT BROADLY ADOPTED

As described in the text that follows, several of the most important, commonly recommended actions have not been adopted, some have been adopted in part, and others already existed in part. Some of the recommendations that have not been adopted may not be feasible or the best approaches given the U.S. political and legal circumstances and those recommending them may not have been aware of aspects of their recommendations that already existed in practice. We point out such details in the text that follows.

Funding for Regulators from Leasing Revenues

The National Commission and others recommended that federal offshore regulators, including BSEE, the U.S. Coast Guard (USCG), the U.S. Environmental Protection Agency, and the National Oceanic and Atmospheric Administration, be funded adequately from lease revenues generated from the oil and gas industry. Whether these regulators are currently adequately funded for their safety and environmental regulatory responsibilities is unclear, but Congress has not acted on this recommendation. However, BSEE has received significant funding increases from Congress since 2012, including funding to nearly double its inspector workforce in the GoM (NASEM, 2021).

Culture That Supports Safety

Multiple investigations of the Macondo well blowout and explosion lament the weak culture of safety that existed on the Deepwater Horizon. Some of these reports acknowledge that the companies involved had strong safety programs addressing occupational safety with very good results, but they

lacked focus on major accident risk. Indeed, BP had previously experienced major disasters in its refining (Texas City explosion of 2005) and other operations (major pipeline spills onto the Alaskan tundra in 2006).

TRB’s 2016 report on U.S. offshore industry safety culture addressed what industry and regulators could do together to raise the companies with cultures unsupportive of safety to that of the industry’s exemplary companies with cultures that support safety (NASEM, 2016). The committee urged industry leaders and associations representing the different industry segments to visibly adopt the safety culture principles that BSEE espoused beginning in 2012 and to work collaboratively to affect change in attitudes and practices across the fragmented industry, to embrace the need for organizational change, and to develop guidance on establishing and assessing safety culture for companies that had not begun on the safety culture journey. It also encouraged industry to work with regulators to define the optimal mix of regulation and voluntary action to foster an industry-wide commitment to safety culture and establish an independent entity devoted to improving industry culture modeled on the one used in the nuclear power industry. The committee also called on BSEE to assist industry by creating a clearinghouse of information, guidance, and best practices on safety culture and for BSEE and other regulators to seek out and support industry champions to visibly encourage industry commitment to a culture that supports safety.

TRB’s 2021 report on BSEE’s inspection program found that 10 years after the Macondo incident, BSEE’s inspection program remained too focused on physical equipment and components and not enough on regulatory and oversight activities that could enhance industry safety culture. The committee recommended that BSEE

Similar recommendations were made years earlier by the National Commission and others.

All of the reports that have addressed industry culture have recognized that an organization’s culture is based on its values, which in turn determine its motivations. Without appropriate motivation regarding safety, progress in addressing the organizational, management, and behavioral influences on major accident risk, devoting resources for doing so, and carrying out SEMS in the spirit in which it is intended—progress in improving safety culture—will remain slow and potentially halting.

Have Safety Culture Recommendations Been Adopted?

The short answer is that, aside from creating COS, there is little visible evidence that industry is working together to collectively enhance its safety culture; and whereas BSEE did adopt the SEMS regulations after Macondo, BSEE has been slow to reform its inspections program to focus more of its efforts on high-risk activities and operators and does not appear to have encouraged industry leadership to champion or improve industry-wide safety culture. The long answer explains why change is difficult, but does not alter the outcome.

As the TRB 2016 report notes, changing the culture of an organization, or even an industry, is a long and uncertain process that requires vigilant and sustained corporate leadership and considerable allocation of resources (NASEM, 2016). Even if multiple companies had embarked on this path since Macondo, it would be challenging to measure how this has changed the industry risk profile over the last decade. Moreover, the fragmented nature and interests of the offshore industry, including its multiple segments represented by different competing associations, makes collaboration across industry challenging. The COS has been formed, but its membership remains low even though it represents 60 percent or more of U.S. offshore production. COS is not serving as a forum for industry top executives to gather and provide leadership for other companies to follow, or apply peer pressure on them to do so, as seen in the nuclear power industry. However, COS issued a safety culture guidance document, has committed significant resources to supplement the ongoing safety culture research being supported by GRP, and its many collaborative industry safety efforts can foster company cultures that support safety.

Although the offshore industry does have operators and contractors with deep commitments to safety and exemplary occupational safety programs, apparently the industry’s concerns about litigiousness and potential liability preclude the kind of information sharing, collaboration, and leadership seen in aviation, nuclear power, and other sectors that have achieved positive results through strong and abiding industry-wide commitments to a culture that supports safety. We return to the role of liability concerns in shaping regulatory behavior and industry response in Chapter 5.

It is possible that more offshore companies have begun to address their cultures individually since Macondo, but if they have, the committee lacks evidence of it. Even so, many companies, including contractors, are known to be working on aspects of culture with real commitment. They do not call it working on safety culture and it is not based on an organized industry dialogue or industry good practices. Also, it needs to be realized that a company can have excellent and fully committed leaders at many levels, but good results are still not ensured. So much depends on the local culture

where the activities are executed. The challenge is to know when and where these pockets of weak culture are and determine how best to improve them.

BSEE’s potential supporting role in enhancing industry culture also remains unrealized. Its culture is heavily influenced by its history and legislation that have emphasized engineering and technology-oriented safety measures and inspections focused on compliance with regulation and standards for physical barriers. This approach has greatly reduced risk of technology failures, but it has not adequately addressed organizational and management lapses that are root causes of most major accidents.

Other Major Report Recommendations Not Broadly Adopted

A number of post-Macondo reports point out failures of organizational management and cultures unsupportive of safety as root causes of the Deepwater Horizon disaster and that are at the nexus of systemic risk as the committee has defined it. Indeed, most industrial disasters trace to failures of organizational culture and human management of, or interaction with, technology rather than the technology itself.

Several post-Macondo reports make recommendations regarding interrelated or overlapping concepts to address organizational risks such as

• Adoption of the safety case used in other nations (further defined and discussed in the following section);⁵
• A specific goal for SEMS to reduce risk to the “as low as reasonably practicable” (ALARP) level;
• Making greater use of “best available and safest technologies” (BAST);
• Enhancing SEMS to increase its focus on organizational and management causes of major accidents; and
• Balancing regulatory oversight from a prescriptive rule-based approach with heavy focus on physical barriers and technology to greater attention to organizational behavior, safety culture, and greater BSEE collaboration with industry aimed at assisting companies with weaker safety programs to improve their safety management efforts.

___________________

⁵ The safety-case approach to managing activities places the onus of responsibility for managing hazards on the company (“duty holder”) that proposes to undertake an activity that involves major hazards. The approach varies across regulators and activities, but shares the common practice of requiring a highly detailed description by the duty holder of how hazards will be identified and managed. This description must be reviewed by the relevant regulator before any activity can begin and the duty holder is inspected by the regulator for conformance with its safety case.

As examples of the major report crosscutting recommendations:

• The National Commission recommended the creation of a single safety regulator with enhanced staff capability, which ultimately became BSEE, but with less unification than envisioned by the National Commission;⁶ adoption of the safety case; greatly improved incident reporting; whistleblower protection; and several other reforms.
• The NAE and NRC (2012) report noted that the operator and principal contractor on the Deepwater Horizon lacked a systems approach to safety and strong cultures of safety, as witnessed by improper planning and assessment of the Macondo well and multiple flawed decisions during the temporary abandonment process. To address these failures, the committee recommended that “Industry, BSEE, and other regulators should foster an effective safety culture through consistent training, adherence to principles of human factors, system safety, and continued measurement through leading indicators” and that “The United States should fully implement a hybrid regulatory system that incorporates a limited number of prescriptive elements into a proactive, goal-oriented risk management system for health, safety, and the environment.” The committee endorsed the ALARP principle in the body of the report to address both technical and organizational risks of deepwater drilling.
• The CSB investigative report summary (CSB, 2016, Vol. 3) notes the complexities and interdependencies of offshore drilling; the variabilities in human performance; the tendency toward organizational drift or normalization of deviance that can, over time, move away from the originally intended safety process, behaviors, and goals; and the important role of management in reducing the errors that contribute to most major accidents. CSB refers to process safety as the preferred approach to reducing major accident risk and notes the lack and importance of having key performance indicators (KPIs) that would identify weaknesses in this process. Among the recommendations made for addressing these organizational hazards, CSB recommends strengthening SEMS to include principles such as ALARP. The CSB report also makes several other

___________________

⁶ The U.S. Coast Guard retains regulatory authority over floating rigs and specific safety items such as gas and fire detection, alarms, and emergency evacuations; the Pipeline and Hazardous Materials Safety Administration retains regulatory authority over pipelines serving fixed and floating offshore platforms; and the Bureau of Ocean Energy Management has approval authority over exploration and development plans.

• recommendations to reduce the human errors associated with disasters in terms of improving corporate governance, development of KPIs for process safety, measures to enhance industry culture that support safety, and others. (Many organizations and companies have programs and are making progress in these areas. This is not universal, nor is every company addressing all these facets. Most of this work is in early stages and has yet to achieve its goals.)
• ABS Consulting was commissioned by BSEE to evaluate process safety gaps in SEMS and made several recommendations that parallel and preceded those of the CSB. It issued a report on this topic in 2015 that examined potentially useful process safety concepts and guidance from the United Kingdom’s Health and Safety Executive (HSE), the Occupational Safety and Health Administration, and from those contained in relevant API standards and guidance documents. Among other recommendations, ABS also recommended incorporating the ALARP concept into SEMS, developing KPIs for process safety, and providing barrier performance management guidance in SEMS regulations or RP 75.

The following sections describe the recommendations not adopted that are designed to address these risks and the implications this has for the industry systemic risk profile. Though discussed individually, many of these recommendations are interrelated, particularly regarding the safety-case approach, the ALARP concept, BAST, and human factors and process safety enhancements to SEMS.

Adoption of Safety-Case Principles

The National Commission and the NAE and NRC (2012) reports on the Macondo Well blowout and explosion recommended adoption of approaches similar to the safety case used by the UK HSE and other nations with offshore industries. In the immediate post-Macondo period, voices from industry concurred with these recommendations, including a senior Shell executive who testified before the Commission and the IADC, both of which advocated use of the safety case worldwide as preferable to SEMS (National Commission, 2011, p. 233).

The National Commission recommendation reads as follows: “The Department of the Interior should develop a proactive, risk-based performance approach specific to individual facilities, operations and environments, similar to the ‘safety case’ approach in the North Sea.” In making this recommendation, the National Commission (2011, p. 69 and the following pages) argued that the pre-Macondo prescriptive regulatory approach, combined with checklist-like inspections, was reactive rather than proactive as in the

safety case. Moreover, the pre-Macondo regulatory approach in the United States was perceived as unable to keep up with advances in technology, practices, and shifts to drilling at ever-increasing depths. The pre-SEMS U.S. approach also created a compliance mentality that leads industry to act on the principle that conformance with regulations equates with safety, which shifts responsibility for safety to the regulator rather than to the creator of the risk. In contrast, the safety case puts the onus on the creator of the risk to assess the risk and how it will be managed to the ALARP level.

The NAE and NRC recommendation reads as follows: “Summary Recommendation 6.1: The United States should fully implement a hybrid regulatory system that incorporates a limited number of prescriptive elements into a proactive, goal-oriented risk management system for health, safety, and the environment” (2012, p. 117). That report commends BSEE for its intent to implement SEMS, but saw it as only a first step in a major revision of BSEE’s regulatory approach. The committee did not explicitly endorse the safety case by name but speaks approvingly of its use in the North Sea (NAE and NRC, 2012).

Safety-Case Approach

The UK safety-case approach relies on a requirement that the entity responsible for safety, which is usually the operator but can be the drilling contractor, prepare a site-specific analysis of the anticipated hazards of drilling and how the risk of a major accident will be controlled to reduce risks to the ALARP level. In the United Kingdom, there are relatively few prescriptive requirements that require adherence, such as legal requirements to protect against fires. Instead, the responsible entity, or duty holder, must describe the good practices that will be followed. The regulator’s role is to assess whether the safety case is thorough and complete and to challenge the duty holder if it comes up short. In the spirit of keeping the responsibility for safety on the duty holder, the regulator “accepts” but does not “approve” the safety case and subsequently inspects the facility to ensure that the duty holder is adhering to its plan. In contrast to U.S. inspections, which are usually carried out in a few hours or a single day and focus on equipment, HSE inspections last several days and include multiple professionals to assess multiple aspects of the physical plant as well as operations.

The CSB report (2016, Vol. 4, pp. 29-35) argues that the SEMS regulations put in place following Macondo fall short of the safety levels that could be achieved, because SEMS can devolve to focusing on completing activities rather than on the goal of reducing risk to the lowest practicable level. When SEMS II was a proposed rule, IADC argued that it prescribed activities that risked losing sight of the intended goal (CSB, 2016, Vol. 4, p. 41). Moreover, CSB (2016, pp. 37-38) argues that the U.S. regulatory

process is very slow and cumbersome, which means that new understanding about risk cannot be enforced by BSEE until regulations change, which can take many years. Indeed, it is common for BSEE’s incorporation of industry standards by reference in regulation to be versions behind the current standard in use by industry. Interim steps that BSEE uses, such as “Notice to Lessees” and “Information to Lessees” do not carry the force of law. In contrast, HSE, using the safety-case approach, can change its definition of “good practice” through administrative action in a much timelier way, although it may not be possible for a U.S. regulatory agency to act in such a streamlined fashion because of the public notice-and-comment periods required by the Administrative Procedures Act. CSB therefore characterizes the safety-case process as proactive and the SEMS process as reactive. As discussed next, however, whether SEMS devolves to focusing on activities rather than goals partly depends on how BSEE exercises its responsibilities and how industry responds to BSEE’s actions.

Approach to Deepwater Risk Management

DOI’s primary response to Macondo was to require industry to adhere to RP 75 rather than to adopt the safety case. Whether this was a better or worse decision for safety depends heavily on what is interpreted as feasible in the U.S. political, regulatory, and legal context.

Some analysts argue that the safety case would not be possible in the United States, given the traditional approach of enforcing safety through compliance inspections and citations, the many prescriptive standards and regulations in place, and the lack of technical breadth of BSEE’s inspection staff beyond well design and engineering, as mentioned below. In practice, however, BSEE has used a safety-case approach for Deepwater Operations Plans (DWOPs) (30 CFR, Subpart B, §§ 250.285-250.295) for many years with great success. DWOPs were employed by MMS beginning in 1995 because of an absence of regulations and standards for producing hydrocarbons from deepwater wells (NASEM, 2016, pp. 105-106). The DWOP process is akin to a safety-case approach in which the operator proposes a system for producing oil and/or gas in deepwater (depths of 1,000 feet or greater) and explains production design and operation based on comprehensive risk and barrier assessments. BSEE has to approve the plan, generally to meet ALARP as described below. Over the period 1995-2013, 1,271 DWOPs had been approved for 410 deepwater projects with only a single fatality (from a crane incident) and no significant spills, while producing 6 billion barrels of oil and 17 billion cubic feet of natural gas (NASEM, 2016, p. 105).

An argument can be made that, in practice, BSEE’s full approach to offshore safety is more similar to the safety case than it might first appear.

The safety case requires duty holders to prepare highly technical documents that describe in considerable detail the good practices that the duty holder intends to use in its design and approach, which includes listing all of the standards the duty holder intends to follow. If all the processes that BSEE requires operators to carry out before drilling, including lease application, hazards analysis, drilling plan and permits to drill, and SEMS programs are considered together, the scrutiny that BSEE gives to industry proposals regarding physical barriers is similar to that of regulators in other nations using the safety case. Although SEMS are carried out by some companies as a compliance exercise (as the third round of SEMS audits implies), if the principles and processes behind SEMS are adopted by operators in the proper spirit, combined with BSEE’s review of technical plans and collaboration with industry to identify better approaches, it could drive down the risk of major accidents. Even so, a significant difference exists between HSE’s implementation of the safety case and BSEE’s review and approval of drilling plans. HSE investigation of a safety case can involve at least 12 highly trained professionals from multiple disciplines in a review process that can take several months, which is both more intensive and extensive than BSEE’s reviews. Shortfalls in the expertise of BSEE’s workforce outside of well engineering and equipment testing limit its ability to undertake such reviews (CSB, 2016, pp. 101-103).

An important distinction between BSEE and HSE is that BSEE usually acts within a strict legalistic interpretation of what its authority allows. Rather than work collaboratively with industry to focus on root causes and sources of risk, as is more characteristic of HSE, BSEE often prefers to act as an enforcer of existing prescriptive regulations. Moreover, BSEE’s heavy emphasis in its outlook and enforcement on engineering and physical plant, including the issuance of Incidents of Noncompliance, makes it more difficult for BSEE to facilitate an industry focus on risks that trace to culture, management, and human performance, where little regulation, standards, or guidance exist (see NASEM, 2021). We return to the ways that the existing regulatory structure encourages and discourages innovation in technology and collaborative problem solving in Chapter 5.

ALARP Concept

The ALARP concept and language trace to the United Kingdom’s Health and Safety at Work etc. Act of 1974. The concept implies that risks should be reduced to a level where additional expenditure or effort would be grossly disproportionate to the health and safety benefits gained. The ALARP concept has been adopted by other nations with offshore industries, such as Norway, Canada, and Australia. The ALARP concept is a

central component of the UK safety-case regulatory approach as discussed in the following subsection. Separate subsections below address individual recommendations to address organizational management and process safety. This section focuses on recommendations regarding use of ALARP in the context of addressing failures of organizational performance and management.

ABS (2015) assesses HSE’s safety-case approach and use of the ALARP risk level and recommends that this goal be added to SEMS by observing that performance-based regulations work best when they have specific goals. That said, the ABS report (2015, p. 19) notes that HSE views ALARP as being achieved by implementing current good practice, which includes compliance with consensus industry standards, as discussed below. Also, the HSE uses a collaborative discussion and analysis approach with the company to determine when industry standards are not applicable or sufficient. Thus, the goal is using a process—including compliance with industry standards and accepted good practices—to determine that ALARP is being achieved. ALARP is not a specific “number.”

Have the ALARP Recommendations Been Adopted?

Explaining the partial ALARP adoption by BSEE since Macondo is not straightforward for a variety of reasons:

1. ALARP-like language was added to BSEE’s regulations in 2016, although it does not seem that the reason at the time included enhancing SEMS but, instead, was to strengthen well control regulation;
2. Regardless of the use of the ALARP terminology, BSEE and industry have long striven to reduce risk to a minimal level through oversight and technical standards, albeit mostly focused on technology and physical barriers, but also for DWOPs as discussed above; and
3. There is a risk of adding elements to SEMS that could change it from a performance-based to a prescriptive regulatory approach, depending on how any new elements are enforced in practice.

ALARP in BSEE Regulation

Language similar to ALARP was incorporated in 2016 into Subpart A of BSEE’s regulations as part of the WCR.⁷ In the proposed rule of 2015, BSEE gives this explanation:

___________________

⁷ See https://www.ecfr.gov/current/title-30/chapter-II/subchapter-B/part-250.

BSEE also added text to Subpart G (Well Operations and Equipment):

Thus, it seems the specific intent of the ALARP-like text of the WCR was for well control, but by putting the text in Subpart A (General) the requirement applies to all BSEE oversight and regulations, including SEMS, even though it is not called out in Subpart S where the SEMS regulations appear. BSEE has not indicated whether or how it might apply section 250.107 to SEMS.

Use in Practice If Not in Name

An argument can be made that, even without use of the specific name, the ALARP concept has long pervaded API standards and BSEE safety regulatory oversight. HSE guidance on ALARP simply says that acceptable risk should always be achieved and that it can usually be determined, qualitatively, based on whether the company in question is proposing to follow accepted good practice.⁸

HSE describes good practice as follows:

___________________

⁸ HSE also acknowledges that when good practice does not exist, such as when a new technology is introduced, more quantitative estimates of risk reduction may be required.

⁹ See https://www.hse.gov.uk/managing/theory/index.htm.

Note that in BSEE’s incorporation of ALARP-like language in the proposed rule, it states that “Recognized engineering practices may be drawn from established codes, industry standards, published peer-reviewed technical reports or industry recommended practices, and similar documents applicable to engineering, design, fabrication, installation, operation, inspection, repair, and maintenance activities.” Although HSE, ABS, and CSB refer to ALARP as a “goal,” it is better considered as a process of determining and ensuring that good practice is followed. (Unless good practice does not already exist, no effort is made to quantify the level of risk that ALARP represents.) In general, BSEE is following HSE’s approach of equating adherence to existing good practice to that of achieving ALARP. Indeed, independent of referring to ALARP, BSEE and its predecessor, MMS, have long relied on this same approach in its oversight of offshore industry drilling and production, albeit focused heavily on equipment.

Prior to the 2016 revisions to 30 CFR § 250.107, BSEE (and MMS before it) had long had extensive requirements for hazard analysis that are based on API standards, recommended practices, and other guidance that achieve the lowest practicable risk when followed. The offshore industry has been carrying out hazard analysis and avoiding major accidents for many years, albeit with the significant and entirely preventable example of Macondo. Industry hazard analyses and operating plans for drilling and production based on them have been closely reviewed and approved by BSEE before it approves a drilling plan and issues permits to drill. Both BSEE and industry have traditionally focused heavily on technology and physical barriers for reducing risk, but their success has been remarkable. Fatalities from offshore blowouts due to failures of technology or physical

___________________

¹⁰ See https://www.hse.gov.uk/managing/theory/alarpglance.htm.

barriers alone have become exceedingly rare. When failures of physical barriers do occur, they are usually associated with poor human decisions and management, including operating equipment beyond its design capabilities and deferring maintenance, whose root causes trace to organizational failures in training, resource allocation to maintenance, and organizational values and priorities.

Some observers point to the requirement in OCSLA regarding use of BAST as a U.S. variation on the ALARP concept. OCSLA directs DOI to “require, on all new drilling and production operations and, wherever practicable, on existing operations, the use of the best available and safest technologies which the Secretary determines to be economically feasible.”¹¹ Indeed, there are similarities between ALARP and BAST regarding how they have influenced safer technologies as well as in how they are usually determined. Regarding determination of BAST, BSEE’s official guidance is that “compliance with existing regulations is presumed to be use of BAST until (and unless) the Director makes a specific BAST determination that other technology is required” (BSEE, 2016, p. 61839). The offshore industry view of BSEE’s BAST program seems more expansive, being described as including consistency with regulations, oversight, enforcement, training, and the safety alert program.¹²

However, there are two important differences between ALARP and BAST. First, BAST is based on a benefit–cost calculation wherein marginal benefits have to exceed marginal costs, whereas ALARP is justified in the United Kingdom if a benefit does not require disproportionate costs. Second, the BAST requirement has helped ensure that the offshore industry has very robust safety technologies, but BAST is also limited to failures of technology rather than those associated with human factors, organizational management, or culture. BSEE has emphasized that “The relevant language [for BAST] is drawn directly from OCSLA, which states that BAST must be used [w]herever failure of equipment [emphasis added] would have a significant effect on safety, health, or the environment” (BSEE, 2016, p. 61852). Although use of ALARP in the North Sea has also been oriented around technology, use of the ALARP concept also covers operations, policies, processes, and any technology that would reduce risk without imposing disproportionate costs.

In addition, the process of implementing BAST in the United States is more difficult and protracted than for implementing ALARP in the North Sea. The CSB observes that the BSEE director may invoke use of BAST, but

___________________

¹¹ See https://www.bsee.gov/what-we-do/offshore-regulatory-programs/emerging-technologies/BAST.

¹² See industry letter to BSEE Director Brian Salerno on proposed regulatory changes to BAST (Milito et al., 2013, p. 2).

indicates that, “the cost-benefit analysis needed to meet this requirement results in a high burden of proof on the regulator to require operators to do something not specifically stated in the regulations” (CSB, 2016, p. 36). The U.S. regulatory process is indeed slow and cumbersome and made more so by the challenges of monetizing and estimating prospective benefits and costs. CSB also points out that the BAST process “differs from the continual improvement mechanism of the North Sea and Australian regimes, which require companies to monitor new developments and continually drive risks to ALARP” (CSB, 2016, p. 36). Moreover, efforts to extend BAST interpretations by BSEE, absent amending BAST through regulation, is likely to result in industry pushback through litigation. The cumbersomeness and litigiousness of the U.S. regulatory process does slow requirements for new technology applications compared with the administrative processes used for ALARP, but one must also consider whether the continuous improvement requirement in SEMS, combined with industry standards and BSEE’s other regulations, drives down risk the way that ALARP does. The CSB clearly believes that SEMS need a specific stated ALARP goal, along with a greater process-safety focus, but whether it does depends on whether U.S. offshore regulators and industry use the ALARP concept in practice but not in name.

Is the Recommended Use of ALARP Targeted to Root Causes of Catastrophes?

Arguably, ABS’s and CSB’s recommendations to incorporate the ALARP concept are intended to address human factors and organizational and management failures that contribute to the causes of major accidents. One possible way the ALARP concept could be used would be to give BSEE more leverage in assessing whether industry is following good practice in addressing these issues. Regarding human performance, ABS recommends amending SEMS based on API 770, A Managers Guide to Reducing Human Errors and Improving Human Performance in the Process Industries (Lorenzo, 2001). ABS notes the following:

The ABS report also recommends adding guidance on barrier management and measurement of barrier performance to SEMS or RP 75, as discussed further below in the subsection on process safety. Barrier management includes equipment, procedures, human factors and organizational dimensions of safety management (PSA, 2017). Beyond the proximate causes of errors, CSB (2016, Vol. 3, pp. 66-109) discusses organizational safety management lapses at Macondo attributable to weaknesses in worker communications and training and flawed execution of the temporary abandonment plan. BSEE could use the ALARP concept to argue that “good practice” in SEMS implementation ought to include the ABS recommendation to amend RP 75 to incorporate guidance on human factors and barrier management in order to reduce risks to the ALARP level and could require inspectors and SEMS auditors to ensure that it is being followed.

Both ABS (2015) and CSB (2016) find that industry and regulation lack guidance and standards that cover the human and organizational aspects of barrier management and actively assessing human performance in barrier management.¹⁴ Some operators are using such practices, though not required, which suggests that they are good practice that ought to be standardized and officially recognized as such by operators and contractors that are not using them. In addition, inadequate training and worker competence are also frequently cited as contributing to serious offshore incidents (note discussion of nontechnical skills in CSB, Vol. 3, 2016), and BSEE could use the ALARP concept to encourage industry to place much greater emphasis on training and certification of worker competence in both technical and nontechnical skills in order to reduce human error.

___________________

¹³ Note that these quotations apply to RP 75 (Third Edition), which remains the version incorporated by reference into legislation, but this same language does not appear in the Fourth Edition (2019). However, the Fourth Edition is also vague regarding following recognized human factors standards.

¹⁴ For example, see CSB (2016, Vol. 4, p. 38): “Just as described in Section 3.1.1, few standards exist for assessing [emphasis added] well conditions and operational activities that form the basis of organizational and operational barriers intended to prevent a major accident.”

Risk of Making SEMS Prescriptive

Recommendations to amend SEMS to incorporate the ALARP concept, as well as other recommendations regarding SEMS discussed in separate sections, run the risk of turning a performance-based regulation into a prescriptive one. As written, SEMS and RP 75 are flexible approaches that give industry the ability to assess and manage risks that are suited to the specific context in which they propose to operate. Indeed, as written, SEMS permit operators to do all of the things espoused by separate report recommendations discussed here to enhance SEMS.

One open question, however, is whether more incorporation of guidance on human factors standards and international offshore guidance and standards into SEMS—covering organizational and human performance related to barrier management—is needed for operators and drillers with underresourced HSE programs and/or a commitment to safety that falls short of reducing risk to the ALARP level. A second open question is how BSEE might choose to enforce ALARP. If the goal is to encourage consistent use of existing good practices and to develop them into consensus standards, this could be beneficial. However, if BSEE chooses to inspect and enforce use of ALARP in SEMS or other good practices with citations of noncompliance, it risks reinforcing industry’s perspective that compliance equates with safety and turning SEMS practices into rote procedures rather than a process of continuous improvement.

Process Safety and SEMS

Three major post-Macondo reports make recommendations about increasing the offshore industry’s focus on reducing the risk of major accidents. The NAE and NRC (2012) report notes the lack of attention by BP and Transocean on “system safety” despite their notable successes with occupational safety.¹⁵

As noted, CSB makes recommendations to enhance the process safety dimensions of SEMS. ABS Consulting, at BSEE’s request, recommended similar actions to address process safety gaps in SEMS. The NAE and NRC report found that “The actions, policies, and procedures of the corporations involved did not provide an effective system safety approach commensurate with the risks of the Macondo well” (2012, p. 6). The NAE and NRC committee made a number of recommendations that, collectively, would enhance industry focus on system safety and safety culture.

The CSB 2016 report (Vol. 4, p. 16) concludes that

___________________

¹⁵ System safety, a concept used in military aerospace and defense weaponry, has different origins, but the controls used are similar in practice to process safety barriers, the term more commonly used in private industry.

CSB makes a number of recommendations to fill these gaps that are covered in this and other sections of this chapter. As described below, SEMS provides an appropriate framework, but its wording is fairly general, and it lacks the specific emphasis of process safety of identification and maintenance of barriers,¹⁶ both in the physical and organizational sense, to control hazards that could lead to major accidents. Many of BSEE’s regulations and offshore industry standards were developed before the modern concepts of process safety management (PSM) were recognized and began to be adopted by the upstream oil and gas industry. Implementation of these practices by both industry and regulator remains uneven.

The ABS (2015, pp. ii-iii) report was commissioned by BSEE to identify process safety gaps in SEMS. It offers nine well-considered summary recommendations:

1. Establish a framework for reporting leading and lagging indicators.
2. Provide guidance on implementation of barrier management strategies to improve the overall barrier management approach.
3. Adopt a comprehensive human factors standard and require qualitative or quantitative Human Reliability Analysis for each process or operation.
4. Incorporate components of the ALARP concept and risk tolerability into the SEMS regulations or API RP 75.
5. Incorporate barrier performance measurement guidance into the SEMS regulations or API RP 75.
6. Establish SEMS guidance for MODU [mobile offshore drilling unit] owners and contractors.
7. Incorporate the risk management framework, process, and best practices described in ISO 31000:2009 into the current risk management approach.

___________________

¹⁶ API SEMS Fourth Edition does refer to “controls” rather than “barriers.”

8. Incorporate guidance on the selection and application of risk assessment techniques.
9. Provide additional guidance on active barrier management, measurement, and maintenance.

Recommended SEMS Enhancements

Note that six of the ABS recommendations would not add prescriptive requirements to SEMS but, rather, would amend RP 75 or SEMS to enhance guidance, particularly on the organizational and human factors interface with safety technologies and provide a framework for reporting process safety indicators. Progress regarding the latter is described in the next chapter. Recommended new requirements would include use of human factors reliability analysis for each process, incorporation of components of the ALARP concept, and adoption of best practices from ISO 13000 (a family of generic standards for risk analysis and management).

Have Process Safety Recommendations Been Adopted?

SEMS has not been amended as recommended by CSB and ABS, but it is important to recognize that the focus of process safety on avoiding major accidents can and should be an important component of any SEMS plan, which is meant to cover both occupational and major accident (process safety) risk. In addition, the industry has key process safety standards around well control. In general, PSM is but another version of a safety management system that is based on the same basic principles of all management systems: an iterative process of Plan, Do, Check, Act. As written, SEMS have a fairly general set of basic elements that an operator can apply to any specific local context in which the operator proposes to drill or produce hydrocarbons, including focusing on PSM, which several major U.S. operators embrace as standard practice.

Although bowtie analysis is not a standard, much of the offshore industry now relies on it to manage risk; it is based on the barriers concept that is central to process safety and is close to being recognized as “good practice” in the U.S. offshore industry. Also important is that BSEE has incorporated many API and other process-safety–related technical standards addressing drilling and production technologies by reference in its regulations. The oil and gas industry has 17 standards and guidance documents that incorporate process safety in design and maintenance of well integrity (IOGP, 2021). Industry adherence to standards that BSEE has adopted in regulations is therefore required, albeit, as noted above, the U.S. regulatory process slows BSEE’s incorporation of standards revisions and updates.

Offshore standards and guidance on the human factors and organizational aspects of PSM, however, are far less developed by comparison, but exist in the chemical processing and refining industries (CSB, 2016, Vol. 3, pp. 110-118). The key question is whether the guidance on the human factors and organizational aspects of process safety should be enhanced within SEMS for those operators and their contractors who are not recognizing or adhering to these concepts.

Contractor Regulatory Oversight

One of the key elements of the safety-case approach is to place the responsibility for managing risk on the company responsible for creating it. In the U.S. offshore regulatory environment, BSEE deals directly with leaseholders, who in turn hire contractors to do most of the work.¹⁷ The CSB 2016 report emphasizes a gap in BSEE’s authority that precludes it from regulating contractors directly. When offshore exploration and production began, many operators (leaseholders) were more vertically integrated than they are today and mostly relied on their own workforces for drilling and production. Currently, most deepwater operators contract for drilling rigs that are operated by contractor staff and other subcontractors. Operators also rely on specialty contractors for well monitoring technologies, cementing, and other tasks. Roughly 80 to 85 percent of work hours offshore are conducted by contractors.¹⁸ For some operators, the share is even higher. CSB specifically recommended that SEMS language be expanded to require contractor compliance. At present, SEMS only require that operators keep records on how they select and evaluate their contractors and ensure that contractor workers are trained for the task at hand and can carry out their tasks safely, but otherwise does not extend SEMS obligations to contractors. BSEE evaluations of operator SEMS compliance, however, does include review of the work that contractors are carrying out on their behalf.

Many contractors have their own safety policies and practices, including SEMS, and most operators have bridging documents that align their SEMS with the safety policies and practices of their contractors. Even so, given that the most hazardous tasks being undertaken offshore are being

___________________

¹⁷ BSEE’s lack of authority requiring contractors to implement SEMS is supported by the following two court cases: (1) Western District of Louisiana’s decision in Island Operating Co. v. Jewell et al., Case No. 16-145 (W.D. La. Dec. 23, 2016) held that BSEE does not have authority to issue civil penalties to non-leaseholder/non-operator offshore contractors pursuant to 43 U.S.C. § 1350 (OCSLA); and (2) in United States v. Moss, No. 16-30561, BSEE has no criminal jurisdiction under its current regulations over offshore contractors (http://www.ca5.uscourts.gov/opinions/pub/16/16-30561-CR0.pdf).

¹⁸ See https://www.bsee.gov/sites/bsee.gov/files/performance-data-table-2010-2020-12-162021.pdf.

carried out by contractors, as well as most of the labor hours, BSEE’s lack of direct oversight authority over contractors and lack of requirements for contractors to have SEMS programs consistent with those of operators remain important gaps.

CONCLUSIONS

Conclusion 2-1: A number of strong, positive improvements have been made offshore since Macondo, such as the creation of BSEE with a singular focus on safety; the mandate for and implementation of SEMS; issuance of new rules for well control, and oil and gas production safety systems; adoption of risk-based inspections by BSEE; industry creation of COS, MWCC, HWCG, and updating of more than 250 API standards and recommended practices; well-control training; and improved and enhanced incident data reporting and sharing. Collectively these changes have had a positive impact on the industry risk profile, even though implementation is incomplete and further improvements are needed as described in the following conclusions. Although there are more high-pressure/high-temperature wells in deeper water, more than 1,800 older wells in shallow water have been decommissioned since 2010.

Conclusion 2-2: Some major post-Macondo reports reviewed in this chapter have recommended greater focus on and improvement in a culture that supports safety. Some operators and contractors have long paid close attention to nurturing and improving their cultures regarding safety, but an industry-wide emphasis on strengthening a culture that supports safety and guidance for all operators and contractors in this regard is not apparent. The industry is thereby missing a collaborative approach of knowledge and resource sharing among companies with well-developed cultures that support safety and companies less experienced in this area. After providing significant leadership on this issue in the 2012-2016 period by developing and publishing a set of safety culture principles and encouraging industry adoption of them, it’s not apparent that BSEE has focused on this area since then.

Conclusion 2-3: The National Commission, among others, recommended that the United States adopt the safety-case approach in use by North Sea nations as well as Australia and Canada. The U.S. response to Macondo was to adopt SEMS instead. However, DOI, acting through BSEE and MMS before it, has long used a process quite similar to the safety case in review and approval of DWOPs, and has done so with notable success. From an engineering standpoint, this process has

worked. BSEE could expand this approach further, but BSEE would need a considerable expansion in technical expertise beyond well design and production engineering as well as regulatory capacity. It would require using much more extensive, multiday inspections compared to current practice to replicate application of the safety-case approach as practiced in the North Sea. The DWOP process introduced BAST and ALARP principles into deepwater operations, and this could be further extended to the entire regulatory remit of BSEE.

Conclusion 2-4: Several reports recommended that the SEMS regulations be enhanced, including adding the use of the ALARP principle as a specific goal. As noted above, ALARP is a process of following recognized good practice rather than setting a quantitative target, except new technologies or practices for which a quantitative estimate is required. There are two important dimensions in assessing the degree to which the ALARP concept is applied on the OCS: (a) its use, as a practical matter, in existing offshore engineering design and equipment standards and (b) adoption of ALARP-like language in BSEE regulation as an element of the WCR in 2016. Offshore designs and engineering standards developed in recent decades are based on best practices and elimination of risks consistent with ALARP. However, the ALARP concept has not been explicitly followed for operational practices, nor is it explicitly referenced in official SEMS guidance.

Conclusion 2-5: In general, the development and execution of technology offshore for oil and gas exploration and production on the OCS have been exceptional. However, offshore process safety practice has lagged behind other high-hazard industries and has lagged behind offshore technology development and implementation in some cases. Process safety concepts have been adopted in offshore design and hardware standards, but less so in operational practice. RP 75, Third Edition, for example, makes no mention of barrier management (for those controls that depend on human action). Nor have BSEE or the industry offered guidance on contingent barrier management as a part of process safety. Indeed, RP 75, Third Edition, merely indicates that application of human factors standards to the design and execution of procedures “may” rather than “should” be considered. API RP 75, Fourth Edition, attempted to be more expansive about human factors, but ultimately was still vague about the use of existing human factors standards in design and operations and the Fourth Edition has not yet been included in regulation. There has been limited attempts by the industry to adopt human-systems integration methodologies and approaches to improve the efficacy of contingent barriers and human-systems interfaces. Nor have

industry or SEMS regulations emphasized the importance of training in nontechnical skills among drilling teams and managers. (Such training is available through IADC.) SEMS, of course, is general enough that process safety, barrier management, and application of human-systems integration methodologies (including human factors standards) can be folded into it. Some companies incorporate human-systems integration and human factors into safety management, but many do not. Neither industry nor BSEE has provided sufficient guidance to assist companies in these areas. Although design and construction of physical controls generally have been good, the performance of these controls during operations requires that they are understood by operational staff and are continually monitored, verified, and maintained. The safety benefits of RP 75, SEMS, and associated recommended practices and regulation would be enhanced by incorporating process safety principles and human-systems integration principles and methodologies.

Conclusion 2-6: Another significant remaining gap in SEMS is that BSEE can only require SEMS of operators and not the contractors, who carry out 80 percent or more of the work done offshore. BSEE does require that operators ensure that their contractors’ employees are “knowledgeable and experienced in the work practices necessary to perform their job in a safe and environmentally sound manner.” (30 CFR § 250.1914(b)). BSEE cannot enforce SEMS for contractors but can evaluate the effectiveness of operators’ SEMS based on contractor performance (30 CFR § 250.1924(a)). In contrast, North Sea offshore regulators are able to regulate contractors directly and require that they have effective SEMS. The operator–contractor interface that failed at Macondo remains a concern for the U.S. offshore industry.

Conclusion 2-7: Whereas the collaboration among major operators, service providers, and contractors representing most of production and BSEE on SafeOCS is beginning to bear fruit, not all operators and contractors are participating in SafeOCS.

The next chapter provides additional background information on improvements in safety data adopted since Macondo.

REFERENCES