What Role Now for Risk Assessment?

A new generation of engineers and operators have entered the Oil & Gas industry since 6 July 1988, when the Piper Alpha platform disaster claimed 167 lives.  Those of us who worked through that period and were part of the implementation of the safety case regime that arose from it have a rare opportunity to pause and take stock.  Perhaps “pause” is the wrong word – in our busy world, who ever gets the chance to pause?  But making the effort to take stock is likely to be worthwhile and could even be well rewarded.

To this new generation of engineers and operators, the safety case and risk assessment are part of the way we do business – or at least we would like to think so.  How far have we come in the management of major hazard risks since that fateful night?  To what extent is the language and practice of risk assessment now part of our every day working lives?  Perhaps the bigger question is:   Is it all worth it?

Change in the wind.

The opportunity to take stock is being presented to us in the Australian offshore industry by the transition from the individual state regulatory bodies to the new National Offshore Petroleum Safety Authority.  The formation of this new body is the culmination of an exercise that started with the Independent Review of the safety case regime in 1999/2000¹.  The Independent Review Team concluded that the legal and administrative framework for regulation of HSE in the offshore petroleum industry in Australia was effectively holding back the industry from achieving world class safety performance.  They stated that “much would require improvement for the regime to deliver world class performance”.  However, underlying this conclusion was the basic observation that the implementation of the safety case regime had nevertheless moved the Australian offshore sector ahead significantly.  Indeed, when viewed in the context of major hazard industry regulation worldwide, a goal-setting safety case regime was determined to be the most appropriate form of regulation for the Australian offshore industry.

The “Future Arrangements” paper¹, unsurprisingly, concentrated on the legal and administrative framework of HSE offshore and had little of detail to say about the technical performance and role of risk assessment.  The National Offshore Petroleum Safety Improvement: Issues Paper² that followed it in 2002 also concentrated on the bigger picture.  There was recognition, however, that the consistency in application that the new national body would bring would address detail areas such as risk assessment.  A new draft of Safety Case Guidelines are currently being circulated for comment by the transition team for NOPSA, who have already indicated that this is one of the areas that will receive attention.

It is worth noting that the UK HSE are also currently engaged in a public consultation exercise on the performance of the safety case regime in the UK North Sea.  Their proposals for change³ conclude that the rationale for the application of the safety case regime to offshore installations remains valid.  They state that:

“While offshore safety standards have greatly improved since Piper Alpha, the potential for a major incident remains.  This is evident from other offshore provinces; for example, the sinking of the Petrobras P36 production platform off Brazil in 2001 in which 11 people died.”

The UK Proposals³ suggest that the number of safety cases required under the UK regulations will be reduced (for example, the UK require a Design Safety Case – a requirement that was dropped in Australia in the 1996 regulations⁴).  Overall, their approach is to simplify the UK regulations.  In particular, the proposed new regulations will have all references to “quantitative risk assessment” removed.  The Proposals³ note:

“QRA is one (or one range) of a number pf available risk assessment tools and not always the most appropriate.  These references implemented a specific Lord Cullen Report recommendation, but experience has shown them to be too prescriptive.  The objective should be that duty holders use effective risk assessment techniques, selected to be appropriate to the circumstances.  Advice on what is appropriate would be covered in the guidance.”

The HSE have clearly concluded that it is necessary to re-focus the risk assessment effort within the UK North Sea.  Our experience in dealing with many operators and engineering companies in Australia and around the Asia Pacific region is that for many “QRA” is synonymous with “risk assessment”.  Yet there is a growing realisation that this is, as the HSE observes, not always appropriate.  This is examined further below.

Risk Assessment or Number Engineering?

One quote that has always stayed with me from the Cullen Report⁵ is the observation regarding the approach taken by Occidental’s management to the identification of a potentially major risk.  Lord Cullen stated that their “reliance on merely a qualitative opinion showed, in my view, a dangerously superficial approach to a major hazard”.  Taken with his recommendations for quantitative risk assessment to lie at the heart of the safety case, it would seem at the least imprudent not to employ QRA as the key risk assessment tool in any safety case.

Yet stating that quantitative risk assessment is not always appropriate and therefore should not be prescriptively required does not mean that it can be done away with entirely.  As with most things, the answer lies somewhere between the extremes.

The safety case concept arose from the Seveso Directive in the European Union⁶, which, as Richard Gowland⁷ observed is not applied uniformly across the EU member states for onshore major hazard facilities.  Differences in emphasis arise from differing legal systems and planning controls between the member states.  Gowland notes that risk assessment is a key activity for major hazards in satisfying the requirements of the directive (i.e. preparing a safety case), but that conflicting messages abound between EU states about the need for quantification.

The demonstration that risks have been reduced to as low as reasonably practicable (ALARP) requires duty holders to “conduct a suitable and sufficient risk assessment for the purpose of identifying the measures to take to comply with the relevant statutory provisions”, according to Carter et al, in their 2003 paper, “Appropriate Risk Assessment Methods for Major Accident Establishments”⁸.  They go on to observe:

“Quantified Risk Assessment (QRA) is only appropriate where it is both reasonable and practicable, reasonable in that the cost of doing it is not high compared with the cost of solving the problem, and practicable in terms of the availability of information and data.“

They go on to discuss the use of risk assessment to support cost-benefit analysis as part of decision-making when assessing the need for further protective measures:

“For simple issues this need not be quantitative but can in many cases be based on performance standards, codes of practice, etc., where all that is needed is to show ‘fitness for purpose’.”

In short, their message is that the nature and extent of the assessment should be proportionate to the scale of the risks.  This should not be surprising, because the use of cost-benefit analysis should ensure that the nature of the measures taken to control the risk are in proportion to the level of the risk – which is simply a re-statement of the ALARP principle.

An appropriate level of assessment.

Other industries find the approach more difficult to reconcile with their traditional practices.  Perhaps the most pertinent example for the oil and gas industry is that of the marine industry.  The Floating Production Storage and Offloading facility (FPSO) is an uncomfortable marriage of the offshore engineering and marine cultures, as anyone who has struggled with the interfaces on such a project would observe!  A 2001 paper for the UK HSE⁹ notes that whilst offshore operators are utilising risk assessment, few marine operations have been reviewed using risk assessment methods.  The paper goes on to provide guidance on the application of qualitative, semi-quantitative and quantitative approaches to risk assessment in the context of marine operations.  In particular, the paper shows how each of these approaches can be used to give a suitable and sufficient demonstration of ALARP.

The international standard ISO 177776, “Guidelines on tools and techniques for hazard identification and risk assessment”¹⁰ is clear on this.  It states that selecting the appropriate risk assessment tool is dependent on the nature and scale of the offshore installation, the stage in the life cycle and the experience of similar installations.  It goes on:

“The level of effort devoted to hazard identification and risk assessment should be based on the anticipated level of risk, the novelty of the undertaking and any limitations in knowledge.”

It concludes the following with regards to quantitative risk assessment:

“The application of QRA is not necessarily limited to large, complex and expensive studies.  It is a technique which can be used quickly and cheaply to help structure a solution to problems for which the solution is not intuitively obvious.  Without the quantification of risk there may, in some situations, be a danger of allocating scarce resources for little benefit.  Because risk is a product of probability and consequence, inappropriate investment on risk-reducing measures may occur if the probability of occurrence of high-consequence events is not adequately estimated.”

So, the considered view from all of these sources appears to be as follows:

• Risk assessment need not always be quantitative;
• Qualitative assessment can still make a suitable and sufficient demonstration of ALARP, in some applications; and
• QRA is an appropriate and effective tool that need not be expensive.

Conclusions from 12 years of offshore safety cases.

From my own experience, there remains in some areas of the industry a lack of clear understanding about the applicability of risk assessment, in all its forms, and the best means of achieving a satisfactory outcome.  The outcome in question could be simple change management or a complete safety case.  Yet it would appear from the above discussion that there are a growing number of resources available to assist in improving that understanding.

At one extreme, however, the experience of the designated authorities in Australia has included the rejection of a number of safety cases, where the risk assessments were based on expensive “black box” models which did not allow simple interrogation and validation.

Thankfully, we have moved on from the days where the outcome from the risk assessment was a number and the focus of the risk analyst, driven by the project demands, was to reduce that number to as low as mathematically possible!  Now the safety and risk engineer is allowed to interpret the results of the QRA and, by placing them in the context of the facility operation, develop pragmatic inputs to system designs and operating procedures.  The realisation that the risk assessment is but a step on the road to demonstrating adequate management of the risks is one that most project managers now grasp.  The use of barrier analysis brings the safety case closer to Lord Cullen’s hope that it would become “a well-thumbed document with notes in the margin”⁵.  Some remain concerned, however, that the safety case is something that is “simply produced by consultants”¹¹.

Overall, it is reasonable to conclude that the safety case, including QRA, has delivered a recognised improvement in risk management.  This has occurred partly because the safety case process has brought significant improvement in risk identification, assessment and, importantly, awareness.

Where will NOPSA take us?

The transition team for NOPSA have been busy spreading their message in recent times.  Overall NOPSA’s aim is to lift the bar for performance as a regulator and, in so doing, the bar will be raised on the quality and strength required of the safety cases submitted.  NOPSA will not be a huge bureaucracy.  The transition team have indicated that it will be a small organisation but a robust regulator.

Some of the key points from recent presentations to note are as follows:

• New Safety Case Guidelines will be issued shortly, with an effort made to reduce the potential for their interpretation as requirements!
• Risk assessments need to be transparent;
• There is likely to be a stronger focus on organisational and cultural issues, since at the heart of all disasters, invariably the root cause is organisational failure;
• Change management and the assessment of its impact on risks will be a focus;
• Clear definition of performance measures will be required of Operators;
• NOPSA recognises that risk assessment is necessary to identify barriers and the need for barriers;
• NOPSA is likely to tie back monitoring and auditing to performance measures and barriers; and
• Whatever an Operator says it will do, NOPSA will have the resources to check that it does so!

The NOPSA transition team are keen to emphasise that the industry should not be fearful of these aims, as their intention is that this will provide – for all – a more efficient process.

Within that process, there will be a key role for risk assessment in all its forms.  It is likely that with better resourcing, improved guidance and more focussed review, the risk assessments performed by industry will need to be efficient, effective and of a high quality.  I am sure that, with their experience gained in the age of the safety case, the new generation of engineers are equipped better than most to meet this challenge.

References:

1. “Future Arrangements for the Regulation of Offshore Petroleum Safety – Australian Offshore Petroleum Safety Case Review”, Department of Industry Science & Resources. Commonwealth of Australia, 2000.
2. “National Offshore Petroleum Safety Improvement: Issues Paper”, Ministerial Council on Minerals and Petroleum Resources: Steering Committee, Commonwealth of Australia, 2 May 2002.
3. ”Proposals to replace the Offshore Installations (Safety Case) Regulations 1992”, Consultative Document, Health & Safety Commission, London, UK, June 2004.
4. “Petroleum (Submerged Lands) (Management of Safety on Offshore Facilities) Regulations 1996”, Statutory Rules 1996 298 as amended made under the Petroleum (Submerged Lands) Act 1967.
5. “The Public Inquiry into the Piper Alpha Disaster”, The Hon. Lord Cullen, Department of Energy, London, UK, November 1990, ISBN 0 10 113102.
6. “Seveso Directive”, 82/501/EEC on the control of industrial major accident hazards involving dangerous goods, 1982 (Seveso 1).
7. “Risk assessment harmonisation: is it fair?” by Richard Gowland, The Chemical Engineer, December 2003/January 2004.
8. “Appropriate Risk Assessment Methods for Major Accident Establishments”, by D.A. Carter, I.L Hirst, T.E. Maddison & S.R. Porter, Trans. IChemE, Vol 81, Part B, January 2003.
9. “Marine Risk Assessment”, Offshore Technology Report 2001/063, Health & Safety Executive, London, UK, 2002, ISBN 0 7176 2231 2
10. ISO 17776:2000, “Petroleum & Natural Gas Industries – Offshore Production Installations – Guidelines on tools and techniques for hazard identification and risk assessment.” International Standards Organisation, 2000.
11. “Tearing up the safety rulebook”, by C. Hopson, “Upstream” newspaper, 5 December 2003.

Brendan Fitzgerald reviews experiences in the use of risk assessment in the oil and gas industry since the introduction of the offshore safety case regime. The impact of the transition to the new National Offshore Petroleum Safety Authority on the future role for risk assessment is also considered.

Brendan is a Director of Vanguard Solutions Pty Ltd, an independent consultancy based in Perth, Western Australia, specialising in Safety, Risk and Environment engineering.  He attended much of the Piper Alpha Inquiry in 1989 and has worked in the development and implementation of the offshore safety case since that time.

Acknowledgement: I wish to acknowledge the input of all the team members at Vanguard Solutions, who provided valuable ideas and assistance in the writing of this paper.