Journal of OccupationaE Accidents, 12 (1990) 49-61 Elsevier

49

Safety Control in Design

Experiences from an Offshore Project*

URBAN KJELLBN

Norsk Hydro as, P.O. Box 200, N-1321 Stabekk, Norway

ABSTRACT

Kjellen, U., 1990. Safety control in design. Experiences from an offshore project. Journal of Oc- cupational Accidents, 12: 49-61.

A model for accident prevention in design is outlined. The model is rooted in quality assurance principles and incorporates various safety analysis techniques. It has been applied as a part of the safety program of an offshore development project. Examples of results and experiences from this application are presented. The presentation focuses on activities to establish safety goals and requirements related to design, to secure experience from offshore installations in operation and to control and verify that the safety requirements are met. A certain degree of success has been achieved in the implementation of the model in the project’s safety program. The application of analytic techniques such as black spot analysis and job safety analysis has provided valuable input to decisions in the various phases of the project. Although the model has been developed for offshore applications, it is of a general nature and is applicable to other branches of industry as well.

INTRODUCTION

The basis for the prevention of accidents in an industrial system is estab- lished during the design of the system. The aim of safety control in design is to ensure that the company’s safety goals and requirements as affected by de- sign are implemented in a cost-efficient manner.

The safety control systems also have to ensure that the safety requirements of, for example, regulatory agencies are complied with. The Norwegian off- shore sector represents a special case. According to the regulations concerning safety and the regulations concerning the licensee’s internal control, the licen- see of an offshore block has the total responsibility for safety on the block (Norwegian Petroleum Directorate, 1987). The licensee shall ensure that com-

*Presented at the International Conference on Strategies for Occupational Accident Prevention, Stockholm, Sweden, 21-22 September 1989.

6376-6349/90/$03.50 0 1990-Elsevier Science Publishers B.V.

50

pany and regulatory requirements are met during engineering, fabrication and operation of installations on the block. Safety has a wide definition and in- cludes the protection of people, the environment and economic assets.

The licensees have established internal systems for quality assurance in or- der to satisfy the regulatory requirements. Contractors and vendors are also required to establish quality assurance systems which meet international stan- dards such as IS0 9001 (Norsk Verkstadsindustris Standardiseringssentral, 1988).

The quality assurance principles are of a general nature and it has been necessary to develop these principles and to make them operational in the various applications in safety control such as accident prevention.

This paper is based on experiences from safety control during the design of an offshore installation. It focuses on the parts of the safety control system which are related to accident prevention. In the course of the project, a model for accident prevention has been developed on the basis of experiences from earlier onshore and offshore projects. A number of requirements have been considered as essential in the development of the model: - The model has to satisfy regulatory requirements concerning internal con-

trol during the design phases. - The model has to utilize the project’s basic planning and control system,

including the phase-model for offshore development projects and the system for quality assurance.

- The application of the model shall ensure that the company’s policy and requirements for accident prevention are met.

- The model shall ensure that operational experiences from similar installa- tions are utilized in an efficient way.

- The model shall make use of state-of-the-art technology in safety analysis and management. Experiences from the application of the model have been gained from the

project, which is about 50% complete. The paper outlines the model and pre- sents examples of results and experiences.

INJURY STATISTICS FOR OFFSHORE PRODUCTION INSTALLATIONS

In 1988 a total of 635 reportable injuries were registered at the Norwegian Petroleum Directorate (Norwegian Petroleum Directorate, 1989 ). This cor- responded to an injury frequency rate of 51 per thousand man years.

The injury frequency rate has fluctuated around a mean value of about 60 during the period 1979-1988, and shows no tendency to increase or decrease. However, closer analysis of the injury statistics for this period reveals trends for different groups of personnel, Fig. 1. Whereas the injury frequency rate in drilling has been halved during the period, the frequency rates in catering and in construction/maintenance tend to increase. For administrative personnel

51

INJURIES PR. 1000 MANYEARS

,*o f~--~ --~-.__~_ -\ + I

100 I + -. --- ._.+ I

80 + 0.~ l--.

60 _~ ~. _z_ -._ --c - w-4 __ __~_ _--_b _-

0 * , *

40t T *

y-r----- --&--_

L.p.p_*_-_p_--- *0 ‘;_p_p_--._ __. .

P979 1980 1 1981 1982 IpLmL__ 1983 1984 1985 1986 , 1987 , 1988 i 1

YEAR

- Admhstr./Product. + Drilling

-* Catering + Consir./Maintenance

Fig. 1. Trends for the injury frequency rate for various categories of personnel on fixed offshore

installations during the period 1979-1988 (source: Norwegian Petroleum Directorate, 1989).

TABLE 1

Distribution on injuries in offshore production during 1979-1988 by type of event and category of

personnel (source: Norwegian Petroleum Directorate, 1989)

Type of event Category of personnel

Administr.1 Drilling Catering Production (7% ) (%) (W)

Construct./ Total

Maintenance (%)

(%)

Fall on same level

Fall to lower level

Misstepping, slipping

Struck against stat.

object

Hit by falling object

Contact with moving

object

Hit by fragments/

14

10

14

6

3 17

6 5 3 14 10

12 10 10

3 8 8

8 9 9

8 9 7

2

14 5 5

12 18

splinters

Loss-of-control of 13 14 25 16 16 handled object

Contact with extreme 1 0 10 1 1

temp.

Contact with chemical 5 4 9 6 5 substances

Overexertion of body 9 9 6 8 8 Electric current 0 0 0 1 1

Total number 387 1563 259 3234 5462

52

and operators of production systems (i.e., process and utility systems), the injury frequency rate has been approximately unchanged.

Table 1 shows the distribution of injuries during 1979-1988 by category of personnel and type of event. In spite of the fact that each personnel category is rather heterogeneous, it is possible to identify some typical injury concentrations:

Accidental events associated with walking (fall on the same level; miss- stepping) are more common in administration/production than on the average. Injuries in drilling are typically caused by contact with moving objects, i.e., drilling equipment. Catering personnel differ from other personnel groups by a relatively high share of injuries due to loss-of-control of manual tools and burns. Maintenance personnel frequently experience injuries from fragments and splinters in connection, for example, with sand blasting and painting. A comparison of the injury distributions for 1988 with the distributions for

1979-1988 shows a decrease in the relative number of injuries in drilling due to contact with moving objects. The mechanization of the pipe-handling sys- tem of drilling rigs has contributed to this decrease.

The overall injury statistics for the period 1979-1988 does not support a conclusion that the safety legislation including the regulations concerning in- ternal control has been efficient in reducing the number of accidents. However, injury statistics from one Norwegian offshore field gives indications in this direction, Fig. 2. Installations X, Y and Z have successively been put into op- eration on the same field at an interval of between three and four years. The younger installations have benefitted from experience from the first installa-

FREQUENCY RATE 120,

0 J 0 2 4 6 8 10 12 14

YEARS AFTER START UP

- Installation X --+ Installation Y + Installation 2

Fig. 2. Development of the accident frequency rate (number of accidents per one million hours of work) for three offshore installations as a function of the number of years from start up.

53

tion on the field and from gradual improvements in the licensee’s system for safety control in design.

THE PHASE MODEL FOR OFFSHORE DEVELOPMENT PROJECTS

Each project that is brought to completion goes through nine phases, out of which no. 3-9 involve decisions that directly affect the safety in the design of the installation.

The feasibility study (phase 3) involves evaluations regarding technical and economical feasibility. Different field development concepts and tentative off- shore organizations are outlined and evaluated.

In the concept phase (phase 4) the various concepts are further developed and optimised as a basis for decisions to proceed with the project on the basis of one of the alternatives. A plan for development and operation of the field is presented to the authorities for approval. The plan includes basic safety goals and requirements, results of safety analyses, and an outline of the safety con- trol systems for the subsequent phases.

Design, operation and maintenance philosophies are optimised in basic en- gineering (phase 5). This phase also involves layout development and speci- fication of selected equipment packages.

Detail engineering includes development of all design documents up to the point for delivery to vendors for equipment and contractors for the fabrication of modules (phase 6). Purchase of material and equipment is performed.

In fabrication (phase 7), the design documents are completed by the con- tractors, the modules are fabricated and the equipment is installed. The con- tractors are also responsible for check out that the modules have been me- chanically completed in accordance with the specifications.

The subsea structure and the topside including the various modules are in- stalled at the location in the hook up and take over phase (phase 8). The complete installation is commissioned.

Phase 9 includes start up of production. Phase 3 and 4 are often carried out by a relatively small integrated team

inside the Company’s own organization. Later phases are carried out by var- ious engineering, fabrication and installation contractors under supervision of the Company’s project organization. In these phases, the project organization is considerably larger and less flexible.

This paper draws experiences from a project, which involves the engineering, fabrication and installation of an integrated production, drilling and quarters platform and subsea systems. It spans over a period of five years (phase 3-9) and costs approximately 1500 million US dollars.

54

QUALITY ASSURANCE IN DESIGN

The Company’s basic model for quality assurance in design is shown in Fig. 3. Quality is defined as the ability of a product, service or activity to fulfil speci- fied requirements. The application of quality assurance in accident prevention in design has a number of important implications.

Goals and requirements regarding accident prevention have to be compre- hensive in order to cover the various hazards of the installation. The specifi- cations need to be explicit, such that these are easy to implement, for example by the contractor’s organization. It shall also be possible to verify that the requirements are met. This often means that a particular requirement has to be broken down and specified in detail for the particular technical solution that is selected. It follows that timing is essential, i.e., the detailed require- ments have to be specified at the right point in time when the necessary infor- mation is available but before the design has been frozen. In cases where the requirements are dependent on operational philosophies, input from the op- eration’s organization has to be secured.

Assignment of responsibilities within the project organization, budgeting and scheduling have to consider the planning and implementation of safety requirements. Safety requirements are often of a multi-disciplinary nature. Consequently, it is important to avoid that decision makers brush away the responsibility for safety to other parts of the organization or to later phases of the project.

Systems for control and verification have to be planned for each phase of the project in order to identify deviations from the safety requirements as early as possible. The costs of introducing changes in design in order to correct or com- pensate for deviations are, in general, considerably more expensive in later phases of the project.

In addition to the closed loop for quality control, the Company’s system for quality assurance also includes activities such as system audits. These are planned and systematic examinations of the Company’s and contractors’ proj- ect organization and administrative systems to ensure that these have been established, followed and maintained as specified. For example, a safety audit

Planning Implementation

Fig. 3. Basic model for quality control.

55

may focus on the fabrication contractor’s understanding of the safety require- ments, distribution of responsibility for implementation, and systems for ver- ification that the requirements are met.

A MODEL FOR ACCIDENT PREVENTION IN DESIGN

This section presents the model for accident prevention together with ex- amples from applications in the design of the drilling module. The model rep- resents a systematization and further development within the framework of quality assurance of experiences from earlier onshore and offshore projects. Included in the model are activities to secure operational experience as well as activities to specify safety requirements at the necessary level of detail and control and verification activities, see Fig. 4.

In general, the line organization is responsible for the design of the instal- lation as well as for the implementation of safety requirements in design. The project’s safety management function is responsible for developing the proj- ect’s safety program and for the organization of specific control and verifica- tion activities. The accident prevention model that is presented here is part of this program. The program also covers other working environment factors such as industrial hygiene and ergonomic as well as factors related to technical safety, prevention of fires and explosions and protection of the environment.

Goals and requirements

The basic requirements related to accident prevention that the installation has to satisfy, are laid down in the working environment act and associated regulatory requirements (Norwegian Petroleum Directorate, 1987). In addi- tion, it is the licensee’s responsibility to specify safety requirements for areas which are not satisfactorily covered by detailed regulatory requirements in or- der to meet the intentions of the working environment act.

On the basis of regulatory requirements and the Company’s safety policy, safety goals and general technical specifications have been developed.

An overall goal related to the expected injury frequency rate during opera- tion of each module (living quarters, process, utility and drilling) has been defined during basic engineering. The goal has been based on the overall injury statistics (Fig. 1) and on statistics from individual installation in the North Sea and reflects the Company’s level of ambition concerning injury prevention.

The regulatory requirements and general technical specifications were de- tailed enough to serve as a basis for the design of selected areas, for example, walkways and work platforms and machine guarding. In other cases, especially where the hazards were linked to the methods of work, detailed requirements had to be specified during the course of basic and detail engineering.

The development of safety specifications was, in general, a line responsibil-

56

CONCEPT PHASE

BASIC AND

DETAIL ENG.

CONSTRUCT.

HOOK-UP

‘COMM- ,ISSIONING

Fig. 4. Simplified model for accident prevention in design.

ity within the affected discipline. In order to secure the necessary input from operations and to make the necessary multidisciplinary evaluations, system- atic group reviews were organized by safety management.

The group reviews during basic engineering were performed by representa- tives from different disciplines with operational as well as engineering expe- rience and typically resulted in input to safety requirements regarding layout and drilling equipment, for example: _ requirements aiming at securing the handling of heavy drilling tools - requirements to provide for an efficient cleaning and drainage of work areas

where spillage of drilling mud takes place

51

- requirements to reduce the needs of drilling personnel to stay in the danger zone of mechanized equipment. Job safety analyses were carried out in detail engineering in order to review

design documents (Harms-Ringdahl, 1987). The analyses involved systematic group reviews of areas and activities on the basis of generic checklists of acci- dent types (compare Table 1). At this phase in design, the basic decisions regarding lay out and equipment had been made. As a consequence, the anal- yses typically resulted in safety requirements that were feasible to implement in this phase. Examples are location of fixed lifting equipment; location of work platforms, stairs and ladders; and location of controls and displays.

The various group review techniques proved efficient in generating the nec- essary-input to the detailed safety requirements. The experiences are con- gruent with experiences from the application in design of other safety analysis techniques based on group problem solving, such as HAZOP (Chemical In- dustries Association, 1977). Important characteristics of group problem solv- ing techniques in this context are (Kjellen, 1983): - the synergetic effects of the group setting in solving safety problems of a

multi-disciplinary nature and involving operational philosophy - the potential for conflict resolution in cases were accident prevention re-

quirements are conflicting with other design requirements or with budget or schedule constrains

- the potential for achieving motivation for implementation of the results and for improving the participants’ insight into safety problems. The latter aspect was of special concern, since the groups were only author-

ized to make recommendations for safety requirements. The results of the analyses were distributed to the responsible disciplines within the Company’s project organization for implementation and their decisions were reported to safety management for follow up. In detail engineering, the immediate respon- sible for implementation was the engineering contractor. In cases where the detailed safety requirements were supported by basic requirements in the tech- nical specifications of the contract, this was a rather straightforward process. In other cases, the detailed safety requirements had to be implemented as a change and involved extra costs.

Securing experience from offshore installations in operation

Input to the project concerning operational experience is of vital importance in all project phases. As to the drilling module, this was secured in a number of ways, for example, through: - use of general injury statistics in goal setting and in making priorities - participation of personnel from the operation’s organization in the estab-

lishment of safety goals and requirements and in key control and verifica- tion activities

58

- black-spot analysis of accidents in similar installations _ establishment of checklists on safety problems experienced in existing

installations. General injury statistics, as represented in Table 1 and Fig. 1, proved valu-

able in identifying areas and activities that needed special attention. For ex- ample the injury statistics showed that there were substantial potentials for reduction of the exposure to hazards by improving the drilling systems and methods for surface treatment (Table 1).

The job safety analysis provided input to design concerning operations and maintenance experience in an organized and systematic way. This cleared the path for the decision makers of the project to accept operational experience.

A data base on injuries in drilling that had been reported to NPD was utilized in the black-spot analysis (Price, 1988). The analysis involved 418 injuries in drilling from modern fixed installations during the period 1980-1986. The in- juries were grouped within eight principle areas of the platform as well as two general activities, walking and maintenance/installation (Table 2). For each of these categories, concentrations of injuries around particular activities, equipment or other circumstances were identified.

The black-spot analysis results were systematized and structured into checklists for each area of the platform, see Table 3 for an example. These were used as input to the group reviews in basic engineering.

Experience showed that the black-spot analysis provided valuable input in early design concerning priority areas for follow-up by the project. The results

TABLE 2

Distribution of injuries in the black-spot-analysis of offshore drilling by place of work in total and

for selected activities (source: Price, 1988)

Place of work Distribution of injuries (% )

All

activities Moving Maintenance

Drillfloor 29 I 20 Piperack 13 18 6 BOP Area 12 14 18 Mud-processing 10 16 16 Laydown areas 10 0 13 Well-head area a 10 14 Derrick I 0 5 Stairs 6 25 1 Skid deck 2 4 6 Miscellaneous 3 I 1

Total number 418 11 100

59

TABLE 3

Example of the resulting checklist from the black-spot analysis. Similar checklists were produced as a result of the Job Safety Analysis

Area: Derrick

Operation

Event (hazard)

1. Tripping of drillstring 1.1 1.2

2. Casing operations 2.1

3. Maintenance/repair work 3.1

3.2 3.3

3.4

Injury during manual steering of stands into finger-board. Injury to hand caught during manual operation of elevator. Collision between equipment in derrick and casing stabbing-basket. Collision between crew in ridingbelt and equipment in derrick. Tools/parts dropped during work in derrick. Injury to maintenance/repair-crew from equipment not immobilised before work begins. Equipment failure/damage resulting in parts coming off and falling to the drillfloor.

were dependent on the extent to which the hazards manifested themselves in distinct accident concentrations connected to identified locations of the mod- ule or equipment. This was, for example, the case for handling of tubulus and other heavy drilling equipment on the drill floor. In other cases such as in maintenance, the hazards were more evenly distributed throughout the mod- ule. As a consequence, these hazards were more difficult to remedy.

The general process of analysis and interpretation of raw tables of accident distributions in the black-spot analysis involved expert judgements. The qual- ity of the results were highly dependent on the access to drilling expertise in this process.

Control and verification

The job safety analysis in detail engineering also served as a systematic re- view of design in order to control the compliance with safety requirements.

The main control and verification activities are carried out during fabrica- tion and commissioning. These involve, for example, group inspections of the physical facilities on the basis of detailed checklists covering the various safety requirements. Experience from earlier projects indicate that these types of in- spections typically will result in findings regarding: needs of improved task lighting; relocation of manual valves and instruments for safe access; removal of obstructions at walkways; relocation of work platforms; improved guard rails and safety cages.

The different control and verification activities described here are the re-

60

TABLE 4

The result of an assessment of the effect of mechanization of selected drilling operations on the injury frequency rate of the drilling module. Mechanization has mainly affected the exposure to hazards. This effect is measured on a scale from 0 to 1, where 0 means that the exposure to the hazard has been eliminated in the operation and 1 that the exposure is unchanged. The injury frequency rate of traditional rigs serves as the base case (relative injury frequency rate = 1)

Operation Traditional rig: relative distr.

Mechanized rig

Effect of reduced exposure

Adjusted distr.

Pipe transportation 0.09 1.0 0.09

Casing running 0.05 1.0 0.05 Tripping/drilling 0.35 0.26 0.09 Mud handling 0.05 0.11 0.01 Maintenance 0.15 1.0 0.15 BOP work 0.05 0.31 0.02 Miscellaneous 0.27 0.80 0.22

Total 1.0 0.63

sponsibility of the Company. In addition, the fabrication contractors are obliged to carry out certain verification activities such as inspections concerning me- chanical completion and function tests.

Parallel to the verification of compliance with detailed requirements, a ver- ification of the compliance with the overall safety goals of the project is needed. The verification during design of compliance with the goal for the injury fre- quency rate in operation involves significant theoretical and methodological difficulties. Below is a method outlined, which aims at providing this type of verification.

As an example, a theoretical calculation of the effect of mechanization of selected drilling systems (pipe handling and mud handling) on the number of injuries per year for a fixed drilling rig is presented, see Table 4. The calculation uses injury statistics from traditional rigs as the base case and assesses the effects on the injury frequency rate of the reduced exposure of the personnel to hazards in mechanized drilling operations. The calculation indicates that a reduction of the injury frequency rate by a third is expected. It is assumed that the drilling organization remains the same.

This type of calculation is dependent on injury statistics of a high quality. It is further based on a number of assumptions regarding the impact of mecha- nization on exposure which need to be verified during operational conditions.

CONCLUSIONS

Experiences so far indicate that the model for accident prevention satisfies the various initial requirements.

61

Analytical methods, such as black-spot analysis of injury data and job safety analysis, are valuable components of the model. The methods are possible to adapt to the constrains of the various phases in design regarding available data for the analysis and resources. The output from the analyses serves as useful support to decisions which affect the risk of accidents. The application of the methods involves the utilization of safety analysis expertise as well as experts on operational conditions from offshore installations.

The various analysis activities have to be carefully scheduled in relation to the project’s main plan and have to be implemented as a part of the project’s safety program.

Of basic importance to the results is the Company’s level of ambition con- cerning accident prevention, as this is reflected in the safety policy of the com- pany. The safety policy has to be understood and accepted at the various levels of the project organization. The application of analytic methods and tools in the accident prevention activities is a means of achieving the necessary sup- port and acceptance.

Although the model for accident prevention in design has been developed for offshore applications, it is of a general nature and is applicable to other branches of industry as well.

ACKNOWLEDGEMENT

The author is grateful to Dr. Jan A. Pappas, Norsk Hydro a.s, for valuable support in the work that this paper is based on and for comments on the manuscript.

REFERENCES

Chemical Industries Association, 1977. A Guide to Hazard and Operability Studies. London. Harms-Ringdahl, L., 1987. Slkerhetsanalys i skyddsarbetet - En handledning. Folksam, Stock-

holm (in Swedish ) . Kjellen, U., 1983. Analysis and development of corporate practices for accident control. Doctoral

dissertation, Royal Institute of Technology, Report No. Trita-AVE-00001, Stockholm. Norsk Verkstadsindustris Standardiseringssentral, 1988. NS-IS0 9001, Model for quality assur-

ance in design/development, production, installation and servicing. Oslo. Norwegian Petroleum Directorate, 1987. Acts, regulations and provisions for the petroleum activ-

ity. Stavanger. Norwegian Petroleum Directorate, 1989. Arsberetning 1988. Stavanger. Price, M., 1988. Drilling injury concentrations on modern fixed platforms. Rogalandforskning,

Report No. RF22/88, Stavanger.