Human and organisational factors in well control audit report

North Sea Offshore Authorities Forum

Multi-National Audit

“Human and Organisational Factors in Well Control”

2012 - 2013

CONTENTS

1. Executive Summary

2. Introduction

3. The Importance of Human and Organisational Factors in Well Control

4. The NSOAF Multi-National Audit

5. Control Panel/Engineering Systems – Findings from the Audit

6. Human Factors – Findings from the Audit

7. Organisational Factors and Company Interfaces – Findings from the Audit

Annex 1 – Effective response to well control demands

Annex 2 – Audit questionnaire guideline

1. Executive Summary The Deepwater Horizon blowout at the Macondo well in 2010 was a salutary reminder to the worldwide offshore industry of the need for exemplary standards of well control. Although that disaster happened thousands of miles away from Europe, the lessons from it are just as applicable for operators and drilling contractors in the North Sea.

The North Sea Offshore Authorities Forum 1 (NSOAF), which consists of representatives of authorities responsible for regulating offshore activities in North West Europe, is therefore anxious that any findings from that disaster in the Gulf of Mexico be incorporated into the practises of those working under their jurisdictions. Although it is clear that considerable effort has been paid by the industry to address the operability of blowout preventers and the need for capping stacks for subsea wells, human and organisational factors have been identified as being equally influential in well control.

As a result, members of NSOAF carried out a multi-national audit (MNA) during 2013 to look at how the offshore operators and drilling contractors in the North Sea are incorporating the wide range of necessary human and organisational factors into their well control systems. Eleven separate audits were carried out. This report describes the background to the audit, explains the relevance of the various issues that were considered, and summarises the conditions found from the eleven audits that were undertaken. The results therefore provide a snapshot of well control standards in those topics across the North Sea, with clear identification of good and poor practises. NSOAF hopes that companies will reflect on the findings and use them in their continuous improvement process for these crucial aspects of offshore safety and environmental protection. The good practises recorded in this report should prove to be easily adoptable by others in the industry

The audit results supported the view that the industry was providing key well control personnel with clear and comprehensive ranges of relevant information, and with adequate designs of displays, control panels, alarm and data systems. Although there were some rigs where practises needed improvement, overall the control panel and associated engineering system aspects from the audit were good.

Similarly, those aspects linked to how drilling personnel would be able to make the right judgement and decision on well control issues were good. Encouragingly, the audit received strong assurance of the driller’s authority to shut in wells when necessary. However, there was a broader range of performance here, and hence the need for those on the lower end to emulate the more advanced operators and drilling contractors, in particularly in the wider use of scenario-based training. The audit, though, identified a particular issue caused by the general shortage of experienced drilling personnel - the high activity level of the industry has contributed to accelerated promotions to key drilling positions, and there was widespread acknowledgement that this caused difficulty in securing adequate competence assurance programmes. This problem must not be ignored by industry

Although there was evidence of an industry culture of close monitoring of performance-related KPIs, disappointingly the MNA saw none that were specifically focused on well control. Moreover, with the strong emphasis of penalising underperformance in areas of such rig utilisation, “up –time” etc, the negative influence of such penalties in an environment where the early application of well control measures was ostensibly encouraged was not clear. This potential for perversely (and negatively) influencing sound well control management did not seem to have been sufficiently addressed by the industry.

There was only relatively weak evidence of how companies learn lessons from incidents, an area that has come under particular scrutiny since Macondo. Although most drilling contractors and their clients produced reports to learn from incidents, there was little to convince that those reports were receiving wider circulation or usage outside the constrained boundaries of the rig or platform in question, let alone spread wider within the industry.

Lastly, a potentially major weakness identified by the audit was the quality of the interfacing arrangements. Given the fundamental need for the client operator, the drilling contractor, and the numerous specialist contractors to all operate as a unit, the lack of clarity in the various levels of bridging and interfacing documentation/processes was

1 NSOAF was created in 1987 and its membership is Denmark, Faroe Islands, Germany, Republic of Ireland, Netherlands, Norway, and the United Kingdom. The Forum exists to:  exchange information, examples of best practice and lessons learnt from incidents  develop common positions and joint initiatives  reduce the difficulties due to differences in regulatory regimes and requirements  harmonise standards where possible

a real concern. In particular, the lack of effective gap analysis in the client and drilling contractor systems/documentation that the audit often found was of concern, and needs to be addressed. For instance, any lack of clarity over who has the ultimate responsibility for shutting in the well could lead to unacceptable delays for such a crucial decision.

In conclusion, the audit found a range of approaches - some impressive, others less so - to the human and organisational factors in well control. The most worrying aspects of the audit results were those that covered issues relating to company systems and the way the various operators and their contractors interface. NSOAF therefore commends this report to the North Sea offshore industry, and asks that operators, their drilling contractors and their trade organisations take time to consider the various findings and to seek ways to implement the various good practises wider. NSOAF national regulators will be seeking opportunities to discuss the findings with their own national industry forums to ensure that the lessons learned about these crucial aspects of well control can be taken forward.

2. Introduction

On 20 April 2010, a blowout at the Macondo well in the Gulf of Mexico resulted in an explosion and fire on the Deepwater Horizon drilling rig. Eleven offshore workers lost their lives and another seventeen were injured. Hydrocarbons continued to flow from the reservoir for 87 days, with an estimated 4.9 million barrels of oil causing significant environmental, economic and social damage. The Deepwater Horizon disaster, coupled with the somewhat lower profile Montara blowout a few months earlier in the East Timor Sea north of Australia, gave rise to significant global concerns about the ability of the offshore oil & gas industry to manage its safety and environmental risks effectively, particularly in well control.

The North Sea, with over 500 oil & gas installations, has experienced severe offshore accidents in the past, including the disasters involving Alexander Kielland (1980) and Piper Alpha (1988). Even though European countries have strict safety requirements and regulatory regimes for well design, construction and well control, the North Sea offshore industry is not immune from the concerns arising from the Macondo and Montara blowouts.

The experience of the Deepwater Horizon caused European regulators to reflect on whether their current regulatory frameworks and practices were adequate to control the major hazard risks of blowouts. NSOAF considered the emerging findings from the investigations into both Macondo and Montara as information became available, including holding an extraordinary NSOAF Plenary meeting in December 2010. NSOAF concluded that considerable effort was being paid to address hardware failures such as the operability of blowout preventers (BOPs) and the need for capping stacks for subsea wells. However, NSOAF members were also concerned about the range of human and organisational factors that were being identified from both incidents as crucial aspects of well control 2 .

As a result, NSOAF decided to carry out a multi-national audit (MNA) specifically on human and organisational factors in relation to well control, involving a sample of operators, drilling contractors and service companies on installations in the North Sea during 2012/13. The aim of the MNA was to undertake a coordinated assessment across the North Sea of how the offshore industry was focusing on human and organisational factors associated with well control, in order to identify current good practises and to help both industry and regulators learn lessons.

This report firstly explains the basis for the areas assessed by this MNA, and then describes the outcomes of this initiative.

2 At the time of preparing this NSOAF MNA report, the US Chemical Safety Board has yet to publish their findings of the Deepwater Horizon incident investigation, particularly organizational and human factors. However, when available, that report may also serve as an additional reference in order to underline the key observations of this audit. In the meantime, though, Professor Andrew Hopkins’ book Disastrous Decisions: the human and organizational causes of the Gulf of Mexico blowout, has been published, and he considers the realm of human and organizational factors that contributed to the disaster, going beyond previous commentary on this topic. He acknowledges that it is important to know what people did, but even more important to know why they did it. This book is therefore a good reference in the light of this audit.

3. The Importance of Human and Organisational Factors in Well Control Drilling a well is a complex interaction of man and machine. To ensure the drilling operation is safe and successful, the drilling crew must continuously monitor displays and other information, and make decisions based on how they perceive and interpret that information. This “situational awareness”, of how circumstances are at the time and how they might develop in the future, is a crucial element. In the event of a loss of well control or loss of position of a mobile drilling rig, the most critical human element is the hand of the operator who presses the Blow out preventer (BOP) or emergency riser disconnect controls and the decision to initiate these actions has to be taken in due time to prevent a major accident. No amount of improvements to the BOP capability can overcome the situation in which no one presses the shut-in control until it is too late. Whereas the operation of the BOP can occur shortly after the decision to shut in, a riser disconnect may be even more challenging because it may require a number of tasks to be completed before action can be taken.

Moreover, such activities take place within a complex relationship of client and contractors, both onshore and offshore, and with an intermeshing system of different procedures, objectives, and technical monitoring arrangements as illustrated in the Communication Chart below. The relationship between all the people and organisations involved must be clear so that everyone knows and understands their role and can deliver their contribution competently.

When operations do not progress as expected or planned, these technical and human elements must all function as a single system to prevent a disaster. The challenge for human and organisational factors is to ensure that the final human element (the “hand on the button”) is a reliable component in the emergency control/avoidance system. This process can be represented as four control loops:

Key control loops

Situation recognition Team work Management Peer review Supervision Real time process status Contractors Corporate Real time situation data – well / mud / met- Clients Policy awareness ocean

Perception

Emergency System status

SMS interface agreements Action Shutdown command Procedures Training

Company Organisational Control panel Engineering Systems Human factors interface factors control and display BOP / Riser control loop loop loop interface disconnect

(a) The Engineering System / Control Panel Control Loop.

 The display of data about the well and the reservoir,  Information about the environmental conditions – weather  Status information about the equipment including emergency systems and “time to operate”.  Controls to operate the equipment.  Controls to effect an emergency shutdown or disconnect

(b) The Human Factors Loop.

 A competent person or persons to monitor the control panel with the authorisation to shut down in an emergency  The perception and comprehension of relevant information  The availability and use of prepared procedures and task aids (for example checklists and decision flowcharts) to aid the operator in processing information, reaching decisions and taking appropriate action.  The integration of a number of information flows into real time situational awareness that includes forward prediction of at least the “time to operate” for emergency systems.  Emergency recognition that will result in human action to initiate the correct emergency protection equipment.  Team working and peer-to-peer monitoring and review to support these processes.

(c) The Organisational Factors Loop.

 Management and oversight of the operator to support their activities and provide additional early warning of problems.  The management of competence and training delivery.

 The audit and review of the safety management systems including procedures, checklists and other decision and action support procedures.  Safety leadership that empowers the operator to act when necessary  Systems to gather and disseminate learning opportunities (i.e. near misses)

(d) The Company Interface Loop.

 The safety management systems (SMS) interface documents and other agreements that specify who does what in normal, escalating and emergency situations.  The provision of joint training in emergency scenarios to validate company interface arrangements.  The monitoring and auditing of contractors at both an individual (for example competence) and organisational level (for example contractor safety management systems.  The access to specialist services and advice.  The contractual “environment” (deadlines, penalty clauses) in which the activity takes place that could influence the Human Factors loop.

Further information on the effective response to well control demands is given in Annex 1.

4. The NSOAF Multi-National Audit The NSOAF Health & Safety Working Group, chaired by Tom McLaren, developed the scope for an audit of offshore well control that reflected the four elements of the human and organisational factors control loop described above. To ensure consistency of approach across the NSOAF community, the MNA was based on common interview questionnaires (see Annex 2) used both onshore and offshore.

The MNA was carried out by offshore regulatory authorities from Netherlands, Denmark, Germany, Norway and the United Kingdom. Eleven separate audits were undertaken, across all participating countries in the North Sea. The audits covered a range of operators and drilling contractors and well service companies, covering platform based drilling, jack-up rigs and harsh environment semi-submersibles. Whilst only covering a relatively small number of such installations in the North Sea, the sample was considered reasonably representative of the industry as a whole, so the broad findings from the audit can have a wide relevance.

Audits commenced with an initial contact with the duty holders, operators and drilling contractors to introduce the purpose/scope of the audit. Key documentation was sought (e.g. HSE Safety Case, Rig Safety Management System, Emergency Management procedures, Blow Out Contingency plan, Bridging Documentation, and Organisational/Communication charts etc). This was usually followed by a more detailed Head Office visit, an offshore audit against the question sets and a close-out meeting to present and summarise the audit findings at Head Office. Existing national regulatory intervention powers were applied where appropriate.

Members of the NSOAF working group and the audit teams were:

Authority NSOAF working group Audit team State Supervision of Mines (SSM), Vincent Claessens Joop Klok Netherlands Michael de Vos Michael de Vos Jos Marx Danish Energy Agency (DEA) Gert Neuchs Christensen Gert Neuchs Christensen Mohamed El Halimi Mohamed El Halimi State Authority for Mining, Energy & Kurt Machetanz Thomas Kaminiarz Geology (LBEG), Germany Kurt Machetanz Thomas Rückwald Petroleum Safety Authority (PSA), Oyvind Tuntland Sigve Knudsen Norway Sigve Knudsen Jorunn Elise Tharaldsen Jorunn Elise Tharaldsen Hilde-Karin Østnes Hilde-Karin Østnes Kristen Kjeldstad Øyvind Lauridsen Elisabeth Lootz Health & Safety Executive (HSE), Tom McLaren Rob Miles United Kingdom Rob Miles Martin Anderson Kathryn Mearns Iain Lambie Steve Walker

The following sections outline the findings from the question sets for each of the categories: Control Panel & Engineering System; Human Factors; Organisational Factors; Company Interface. The findings from the MNA are summarised under each category, concluding with examples of good and poor practice.

5. Control Panel & Engineering Systems - Findings from the Audit The Control Panel/Engineering Systems loop of the audit addressed issues of clarity and comprehensiveness of the data available to the drilling personnel, and design and suitability of the controls used during well control.

In general, the audit found that displays and BOP controls were clearly labelled and unambiguous, and the crews reported that they were confident of being able to operate them in an emergency. All functions which were not in use were properly labelled (e.g. in red ‘Not in Use’).

Emergency systems were monitored for availability and functionality, and unlocked but protected, an example being a ‘Think before you hit the button’ notice on Blind Shear Rams. The usual practice was for the Driller to set the alarms on various gauges to pre-warn of unplanned events and alert the crew to key changes in the drilling process.

Data and information regarding the well parameters were available in real time at a number of locations, e.g. driller’s cabin, toolpusher’s office, OIM’s office, company rep’s office, and these could be interrogated for trend history, even to the extent of identifying small changes in parameters. It is important to note that in such cases data on well parameters was sometimes coming from the same source and this could instil a false sense of security that there were two or more independent systems operating at the same time.

Good practice

Overall, many examples of good practise were observed in this element of the MNA, particularly clear displays, logical consistency of colour lights/coding, and clear labelling of emergency controls and changeable equipment such as rams. Other examples included:

 Easy availability of trend data, rather than