Managing Major Incident Risks
Content
SPE 96250
Managing Major Incident Risks
Don Smith, SPE, International Association of Oil and Gas Producers (OGP), Volkert Zijlker, Shell International Exploration
and Production, BV. (Chairman of the OGP Safety Committee)
Copyright 2005, Society of Petroleum Engineers
This paper was prepared for presentation at the SPE Asia Pacific Health, Safety and Environment
Conference and Exhibition held in Kuala Lumpur, Malaysia, 19–20 September 2005.
This paper was selected for presentation by an SPE Program Committee following review of
information contained in a proposal submitted by the author(s). Contents of the paper, as
presented, have not been reviewed by the Society of Petroleum Engineers and are subject to
correction by the author(s). The material, as presented, does not necessarily reflect any
position of the Society of Petroleum Engineers, its officers, or members. Papers presented at
SPE meetings are subject to publication review by Editorial Committees of the Society of
Petroleum Engineers. Electronic reproduction, distribution, or storage of any part of this paper
for commercial purposes without the written consent of the Society of Petroleum Engineers is
prohibited. Permission to reproduce in print is restricted to a proposal of not more than 300
words; illustrations may not be copied. The proposal must contain conspicuous
acknowledgment of where and by whom the paper was presented. Write Librarian, SPE, P.O.
Box 833836, Richardson, TX 75083-3836, U.S.A., fax 01-972-952-9435.
Abstract
Alexander Keilland (1980), Ocean Ranger (1982), Piper Alpha
(1988), P36 in Brazil (2001) and a recent major blowout (H2S
release) in China (2003) are all well-known examples of
incidents that have resulted in major loss of life.
The Safety Management Systems the industry utilises
should be equally applicable to the management of all types of
risk: from the high frequency, low consequence ‘slips, trips
and falls’ to the rare, high consequence incidents. However,
the review of past major incidents has shown that the
complexity of the failure path is such that questions arise as to
how adequate a traditional SMS based approach is to
managing these types of incident.
This paper presents some of the major challenges
associated with managing major incident risks. It draws upon
the findings of a recent workshop organised by the
International Association of Oil and Gas Producers (OGP) that
specifically addressed key challenges in this area, and
identified issues that warrant further review and development.
Introduction
Alexander Keilland (1980), Ocean Ranger (1982), Piper Alpha
(1988), P36 in Brazil (2001) and a recent major blowout (H2S
release) in China (2003) are all well-known examples of
upstream related incidents that have resulted in major loss of
life. They form a class of incidents that are often referred to as
low frequency, high consequence; as opposed to the high
frequency, (relatively) low consequence incidents that
dominate in the E&P industry’s safety statistics [1].
The Safety Management Systems (SMS) the industry
utilize, and the risk assessment and management process
within them, should be equally applicable to all forms of risk:
from ‘slips, trips and falls’ to the rare, high consequence
events. However, the frequency with which major incidents
and near misses occur suggests that more can be done to
improve the assessment and management of such events.
Investigations into major incidents show complex events
paths, typically incorporating the failure of many safety
barriers. The question that arises is: how adequate are the
traditional SMS based approaches at identifying, assessing
and managing these complex scenarios?
Clearly what differentiates a minor incident from a major
incident may be as simple as the failure of a single, additional
safety barrier.
Further, within the Exploration and Production (E&P)
industry the risk profile is continually changing. Increasingly
deepwater and hostile environments, more challenging wells,
ageing facilities and general advances in drilling and
production technology and systems, all have associated risks
that organisations need to be able to assess and manage.
Managing any process is simplified if performance
(output) can be measured. In the safety arena, the number of
recordable injuries, lost time injuries and certain classes of
fatalities (eg vehicle related) is such that the need for, and to a
lesser extent the influence of any change can be measured.
Not surprisingly, organisations will often focus effort in areas
where improvement can be demonstrated. The nature of major
incidents risk is such that performance data are difficult to
measure, and as such the precursors to these types of incidents
may not be identified in advance of an incident occurring.
This paper reviews a range of issues associated with
understanding and managing major incident risks. Initially,
major incidents are separated into two classes in order to help
recognise the different processes needed to manage different
types of major incident hazards. The paper then considers
some of the challenges associated with identifying key
performance indicators relevant to managing major incident
risks. Finally, the paper reviews the outcomes of an industry
workshop aimed at identifying the key challenges faced by the
industry in improving its approach to managing major incident
risks.
Major incident definition
Within this paper a major incident is defined as an event that
results, or has a significant potential to result in large numbers
of fatalities (to company or contractor personnel, or third
parties). Within the upstream industry the most obvious
examples of major incidents include hydrocarbon related fires
and explosions, structural failures and H2S emissions.
Incidents that result in few fatalities with little or no
escalation potential, are not the focus of this paper; albeit that
2
96250
Class 1 Major Incidents.
These are incidents in which (typically) a series of safety
barriers have failed. They may include:
•
•
•
•
•
Failures in the permit to work system
Failures in the control of change procedures
Failures in the system of supervision
Human factors related failures
Hardware failures
Investigation into such incidents will often highlight
failures in the organisations SMS (and/or that of its contractor)
lack of visible leadership commitment, a poor safety culture
within the worksite, and human factor failures. In fact, many
of these issues define the conditions necessary for this class of
incident to occur.
Incidents such as Piper Alpha, Alexandra Keilland and the
P36 incident fall within this class.
Class 1 incidents generally occur during operational or
maintenance activities, where there is likely to be a strong
human factor element present.
Class 2 Major Incidents.
These relate to failures that are, in effect, designed into the
system or are related to external influences. Examples of such
failures include the failure of an offshore installation exposed
to extreme weather conditions or seismic activities outside of
its original design envelope, the failure of a pressure vessel
(and subsequent hydrocarbon release) due to material
imperfections (of certain types) or a passing vessel collision.
There are many examples of these types of failure.
Recently within the Gulf of Mexico a number of offshore
structures failed as a result of the passage of Hurricane Ivan
[4]. However, a policy of evacuating platforms prior to the
arrival of a hurricane reduced the direct impact of these
particular incidents to financial losses.
It is important to recognise that for this class of failures,
the primary risk control measures are built into the system at
the concept selection, design, fabrication and installation
phases. Typically, the safety factors associated with, for
example, the design of a particular piece of equipment,
structure or mitigation measure (eg the deluge system) is
incorporated into design codes and industry guidelines.
This class of major incidents is not driven by operational
considerations (ie they do not necessarily require operational
failures to be realised, and may occur even if a system is
operated in accordance with the design requirements).
Further, the ‘real time’ human factor element is unlikely to
play a major element in such failures; although due account
needs to be taken of human factor issues that arise from the
concept selection to installation phase.
The risks associated with Class 2 hazards can never be
reduced to zero; the variability in the strength of the
components (eg due to material imperfections) and the
uncertainty in the load to which the component is subjected,
results in a residual risk of failure (Ref: Figure 1). For
example, for a typical modern fixed jacket structure, the risk
of structural failure due to environmental overload is expected
to be around 1e-5 to 1e-6 per annum.
0.16
Probability
many of the issues and tools needed to manage risks
associated with such incidents are similar to those used to
manage major incident risks. Equally, while both aviation and
vehicle related incidents may result in multiple fatalities, they
are not considered here; the industry has dedicated efforts
relating to both these areas of risk [2], [3].
In order to better understand major incident risks and how
they can be managed, it is of value to further classify major
incidents. Within this paper two classes of major incident are
defined:
0.14
Load
Distribution
Strength
Distribution
0.12
0.1
Failure Zone,
where load
exceeds strength
0.08
0.06
0.04
0.02
0
0
50
100
Load/Strength
150
Figure 1: Load and Strength Distributions and Residual Risk
Hence, while the risk of a major incident occurring can be
reduced to an extremely low level, it can never be eliminated.
Further, while it is clear that the probability of any individual
installation failing is extremely low, the risk of any one in a
population of structures failing increases as a function of the
number of installations.
This concept is readily (and relevantly) extended to
individual hardware components within a system, and as such
to certain aspects of the Class 1 incidents. However, while it
is difficult to mitigate the failure of a large structural
component (such as an offshore installation) the failure of subcomponents (eg a valve) can usually be effectively managed
such that a major incident does not arise.
A further extension of the concept is to human factors
issues; when exposed to a range of stimuli, different
individuals will respond differently, and on occasion in a
manner that will initiate a failure.
Combined failures
Clearly, on occasion an incident will fall within both
classes. For example a problem introduced at the design phase
may be the initiating event or a major contributor to a major
incident.
96250
3
Managing Major Incident Hazards
The key stages in managing risks associated with E&P
activities are shown in Figure 2.
Hazard Identification
Risk Assessment
Identify Risk
Reduction Options
Set Functional
Requirements
Figure 4: Key Stages in Risk Management
A range of tools is available for addressing each of these
stages [5].
It is of value to consider how the two different classes of
major incident risks make use of the above process, and the
challenges that arise.
Managing Class 1 Major Incident Risks
While identifying the hazards is relatively straight forward,
identifying and assessing all the scenarios with the potential to
result in a Class 1 major incident is, in practice, impossible. In
a complex workplace, if sufficient safety barriers are allowed
to fail, there are too many scenarios to consider. As such, the
primary focus of Managing Class 1 risks needs to be on
managing the individual safety barriers that, if they fail,
contribute to the likelihood of an incident occurring.
The individual safety barriers fail relatively frequently; an
estimate of this frequency of failure being the number of
‘minor’ incidents an operation is recording. Most of the
incidents indicate some form of failure within the Safety
Management System; whether it relates to, for example, poor
supervision or inadequacies in the permit to work
requirements.
For a Class 1 major incident to occur, not only do a
number of safety barriers need to fail, they need to fail in a
manner that will lead to an escalation in the severity of the
incident. While individual safety barriers fail relatively
regularly (as manifest by the number of minor incidents
reported) the combination of failures necessary to result in a
major incident occur extremely rarely.
In fact, the SMS
should be capable of recognising and addressing the failure of
individual safety barriers.
A large human factor influence complicates the assessment
of the Class 1 risks. Not only do individuals need to be
considered as an influencing factor at any stage of the
development of an incident (ie contributing to the escalation of
an incident) they play a key role in preventing the escalation
and mitigating the impact of an incident. Incorporating human
factor issues into risk assessments, where the focus is on
reducing the risk to a level that can be demonstrated to be
acceptable, is extremely challenging and warrants further
consideration.
The functional requirements related to managing Class 1
risks in practice have to focus on high-level aspects of the
SMS: for example, having in place adequate operational and
maintenance procedures, supervision of activities, ensuring the
permit-to-work system is correctly operated, etc..
Managing Class 2 Major Incident Risk
The Class 2 risks are managed primarily by ensuring that
the reliability of the component or structure is such that in all
but the most onerous of loading conditions, or the least
favourable strength conditions, the structure will survive. For
many Class 2 risks, the hazard cannot be controlled or
substituted (eg a fixed offshore installation will need to
survive whatever environment it is exposed to). Some Class 2
risks are controlled by a combination of design and
operational requirements; an offshore structure will be
designed to survive a certain level of ship impact, however
operational controls will be used to attempt to ward off
approaching vessels.
The Class 2 risks will be controlled initially at the concept
selection and design phase. The concept chosen to exploit the
reservoir will drive many of the subsequent Class 2 risks. At
one extreme, the choice of an unmanned facility has potential
to reduce greatly the risk to personnel, at the other extreme, a
complex, manned, offshore facility will require a
comprehensive range of tools to be used to manage the arising
risks.
During the design phase various tools will be used to
deliver a safe solution, with codes and standards forming the
basis of many aspects of system design. Through their use the
designer attempts to ensure that acceptable levels of reliability
(and safety) are achieved. However, in applying these codes
and standards, and undertaking the detailed design, the
potential for errors to be introduced needs to be managed.
For more complicated systems detailed modelling may be
undertaken to arrive at a design that satisfies both safety and
operational requirements. Usually a direct approach will be
taken to managing each hazard; for example the structure will
be specifically designed to withstand an extreme environment
and a passing vessel of a given speed and mass.
Other risks need to be managed during the design phase.
Limitations in the underlying data or knowledge of the
environment, human error, software/modelling issues, all have
the potential to result in a design that does not satisfy the
original requirements. In this respect, the Class 2 risks differ
from Class 1 risks insofar as there is time to address these
issues before the facility, system or component becomes
operational. A primary risk control measure is to use
independent competent organisations (eg Certifying
Authorities) to the verify the design details.
Once the facility is operational, many of the Class 2 risks
are managed through procedures such as planned maintenance,
inspection (eg of fatigue) and change control. Lifetime
extension and ageing facility issues are areas that require most
of the same risk management tools as applied to other Class 2
risks.
4
96250
The Incident P yra mid - Nu m ber of L TIs per Fatality - v aries per Business Activ ity
ref: U S - B ureau of Lab our S tatistics - year 2001 data (exclusiv e S ept 11 ev ents)
LTIs/Fat
100000
13046
10000
2773
777
1000
496
261
137
138
173
100
19
20
27
10
1
A ssault and
violent acts
Fires and Transportation E xposure to Fall to lower
explosions
incidents
harm ful
level
substances
(elec, tem p,
chem icals, O2
def)
Caught in
equipm ent,
object or
collapsing
m aterial
Total
S truck by Other contact S lips, Trips
Others
falling or flying w ith objects and Fall on ove re xercion,
and equipm ent sam e level rep m otion etc
object
Figure 3: Incident R atios
Key Performance Indicators
The E&P industry has long recognised that in order to
effectively manage safety, different types of key performance
indicators (KPIs) need to be measured, and corrective actions
taken based on these indicators. Traditionally the industry has
relied on lagging indicators such as fatal accident rate (FAR)
lost time injury frequency (LTIF) and total recordable incident
rate (TRIR). These indicators are extremely valuable in
managing the types of incidents to which they relate. Hence, a
measure of the number of medical treatment cases an
organisation has experienced in the previous years should
assist the organisation to identify whether more needs to be
done to avoid these types of injuries. Where the value of
lagging indicators becomes less clear is where one type of
indicator is used to infer safety performance in an unrelated
area.
Lagging indicators work well in an environment where
‘large’ volumes of incident data are produced that can be
attributed to specific causes. Within any single organisation it
is unlikely that significant number of incidents (particularly
LTIs or fatalities) will occur such that problem areas and
trends are identified and addressed quickly. However by the
sharing of incident data through initiatives such as the OGP
safety report, organisations can improve the volume of
relevant data on which to plan their safety initiatives.
Low frequency, high consequence incidents are, by
definition, unlikely to provide much lagging indicator data that
can be used to focus management effort. This lack of data
forces alternative approaches to be used to provide the
relevant KPIs.
Use of FAR, LTIF, TRIR as a Major Incident Indicator
The Class 1 incidents are typically associated with the
failure of a number of safety barriers, associated with which
there is a strong human factors element. The same safety
barriers, when they fail in isolation, may result in a minor
injuries or individual fatalities. For example, a safety barrier
defined as ‘a good safety culture’ if failing, may be expected
to increase the likelihood of ‘minor’ injuries, and contribute to
the possibility of a major incident occurring.
Hence,
theoretically at least, there should be a relationship between
KPIs such as FAR, LTIF and TRIR and the potential for a
major incident. However, when detailed incident data are
available, it appears that the relationship between different
levels of incident, specifically LTIs and fatalities, is difficult
to quantify.
Figure 3, taken from a report by the US Bureau of Labour
Statistics shows the number of lost time incidents per fatality,
in the US, in 2001. The incidents are separated into ten
categories ranging from assault and violent attacks, to a
category including repetitive strain injuries and over exertion.
On the right of the figure are the low consequence incidents
that form the bulk of the data. The likelihood of a fatality
occurring associated with these types of incident is remote
(typically greater than 1: 1000). On the left of the figure are
incidents that have a higher potential to result in a fatality
(around 1:20). These include violent attacks, fires and
explosions and vehicle related incident.
If all the LTIs shown in the figure were combined to give a
single (leading) KPI related to the potential for a fatality, it
96250
would represent a poor indicator. The large number of high
frequency, low consequence incidents, would dominate its
value1. Figure 3 suggests that by factoring LTIs based on their
categories, a more accurate indicator of the potential for a
fatality could be produced. An obvious factoring is based on
the ratio of fatalities to LTIs. This concept could be extended
to a KPI relevant to major incident risk; albeit that further
work would be required to establish the appropriate factors to
apply.
Each year OGP collects, analyses and reports safety data
on behalf of its members. The 2004 report [1] was based on
approximately 2.3 billion workhours of data, submitted by 37
companies, from their operations in 78 countries. Included in
the data were 2371 lost time injuries. If the distribution of
LTIs in the OGP data is similar to that in Figure 3, it is clear
that few, if any of the OGP data are likely to be related to
events that have any significant potential to result in a major
incident. Hence, while it is important to manage the hazards
that lead to LTIs, the number and rate of LTIs in themselves
represents a poor indicator of the likelihood of a fatality, let
alone a major incident.
Class 2 Lagging Indicators
Implicitly, lagging indicator data represent an important
input to the management of the Class 2 risks. Design codes
and standards are, on the whole, based on operational
experience. A good example is the API series of fixed
structure Recommended Practices (currently in its 21st Edition)
[6]. The failure of Gulf of Mexico structures (designed on the
basis of early editions of the Recommended Practice) has
driven the inclusion of more stringent provisions with the
updated editions, and on occasion the need to revisit earlier
designs.
Similarly, the failure of systems and components has
driven changes in related design practices, inspection and
maintenance regimes.
However, while this type of approach works well in an
environment where the consequence of failure is considered
acceptable (eg limited to financial loss) where fatalities or
environmental damage may occur a more proactive risk
indicator is desirable.
Leading Indicators
Ideally, what is required is a leading indicator of the
potential for a major incident to occur. While combining
lagging incident data as outlined above may provide a general
indication, of more value would be an indicator that more
closely measured the adequacy of the safety barriers that, if
they fail, could cause or contribute to a major incident
occurring.
For the Class 1 incidents, the performance of individual
barriers can be measured (either proactively or reactively) and
a model developed to provide a leading KPI for the worksite.
This type of approach has been promoted within Norway [7].
Indicators considered include:
• Non-ignited hydrocarbon leaks
• Ignited hydrocarbon leaks
1
While the figure shows only ratios of fatalities to LTI, the categories to the
right of the figure traditionally form the majority of incident datasets.
5
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Well kicks/loss of well control
Fire/explosion in other areas, flammable liquids
Ships on a collision course
Drifting objects
Collision with field-related vessel/installation/shuttle
tanker
Damage to platform
structure/stability/mooring/positioning errors
Leaks from subsea production facilities/
pipelines/risers/flowlines/loading buoys and hoses
Damage caused by fishing gear to subsea production
equipment/pipeline systems/diving equipment
Evacuation (precautionary/emergency)
Helicopter crashes/emergency landings on/near an
installation
Man overboard
Personal injuries
Occupational illness
Total power failure
Control room out of operation
Diver accident
Hydrogen sulphide leak
Loss of control with radioactive source
Dropped objects
The applicability of this type of approach to other regions
and operations is currently being considered within OGP.
Class 2 Leading Indicators
The nature of the Class 2 hazards is such that risk
assessment can be consistently applied at any time to provide
an up-to-date leading indicator of the potential for a major
incident to occur. For example, at the design stage structural
reliability analysis can be used to estimate the probability of
failure of the structure due to environmental overload. Then,
using up-to-date structural and environmental data, the
analysis can be repeated and an updated risk indicator
estimated.
The limitation of this approach is that it assumes a certain
level of knowledge of both the loading environment, and the
ability of the structure or component to withstand the loading.
If a loading scenario is not adequately recognised or
considered (eg a seismic event occurring in a region not
considered to be active, or limited knowledge of the metocean
environment is available) then the resulting risk indicator will
be of limited value.
Near-miss (significant incident) data
Of course, potentially the greatest source of information
that will assist E&P organisations to manage their major
incident risks is relevant near miss data. Through initiatives
such as the OGP Safety Zone (incident alerts) and a dedicated
OGP Task Force addressing safety data issues, it is expected
that improvements in the quality and quantity of significant
incident data will be realised.
6
In conclusion, it appears clear that further work is required
to identify KPIs that give a reliable indication of the potential
of a major incident occurring.
Preventing the Next Major Incident. Review of OGP
Safety Workshop, Helsingor, Nov, 2004
In order to focus the industry’s attention on managing major
incidents, in November 2004, OGP organised a workshop to
review the issue and identify the actions required to improve
the industry’s abilities to manage these types of hazard [8].
Over 80 individuals representing around 50 different E&P
organisations, regulators and service providers from around
the world, attended the workshop. Organisations shared their
experiences in managing major incidents, with the overall
intent of identifying how the industry could improve its ability
to address this important issue.
Presented below are the key issues arising out of the
workshop.
Senior Management Commitment
In order to influence both the culture within the workforce,
and to make available the resources necessary to address
major incident issues, it is important to ensure that senior
management understand the specific challenges associated
with managing major incident risks.
Technical Integrity
Increased complexity in the installations and systems used
to exploit hydrocarbon reserves (particularly in the offshore
environment) and ageing and life extension issues associated
with existing facilities, lead to the need to improve our ability
to assess the adequacy of the facilities we use.
Human Factors
The role of individuals in the initiation and prevention of a
major incident was discussed at length. It was recognised that
managing human factors was a key element in managing
major incident risks. In particular, good supervision was
viewed as an important means of reducing the likelihood of an
individual carrying out an incorrect operation. However, it
was also recognised that on occasions, the administrative
burden placed on supervisors was such that it severely
impacted the time they had available to spend directly
supervising activities. While it is clear that some level of
administration is inevitable, further work is necessary to
ensure that an appropriate balance is achieved.
The culture of the workforce is strongly influenced by the
direction given by senior management with respects to safety.
A need existed to provide tools to assist senior managers to
communicate their safety requirements to the workforce.
Finally, improving the means by which human factors are
addressed within risk assessments was recognised as an area
requiring further work.
Risk Management
It was agreed that the risk management tools currently
employed to identify and manage major incident risks should
be reviewed. The ability of such tools to identify and manage
the complex paths associated with of many (Class 1) major
incidents should be considered.
96250
It was felt that the development and availability of hazard
registers and incident descriptions could aid organisations in
ensuring that all the key major incident risks have been
identified and assessed.
Key Performance Indicators
In recognising the limited ability of the existing safety
KPIs to indicate the likelihood of a major incident occurring,
the workshop called for work to be undertaken in identifying
relevant leading indicators. A particular focus area should be
ageing assets and dealing with increasingly complicated
facilities and systems.
Other Issues:
A range of other issues were identified by the workshop
attendees:
• Sharing and learning from ‘high potential’
incidents
• Development of auditing guidelines specific to
major incident management
• Revisiting the roles and responsibilities between
E&P companies and their contractors
• Use of complex technology in remote areas
• Managing the balance between risk of non-fatal,
potentially costly incidents and the need to
maintain production
• Competence issues (ageing workforce, loss of
staff, training issues, etc)
OGP 2006 Safety Theme
In order to bring global focus to this important area of risk
management, Managing Major Incident Risks will be the OGP
safety theme for 2006. During the remainder of 2005, and
throughout 2006, effort will be given to addressing the issues
identified through the workshop, in particular in the areas of
Human Factors, Risk Management and Key Performance
Indicators.
Through the production of a range of products, which may
include recommended practices, guidelines, international
standards, workshops and conferences, the industry will
provide the information that should allow E&P companies and
their contractors to further improve their management of major
incident risks.
Conclusions
This paper has reviewed a range of issues related to managing
major incident risks. Through the identification of two classes
of major incident, the different risk management challenges
have been presented.
It is recognised that throughout the global E&P industry
major incidents and near misses continue to occur. Whether
the rate at which they occur is greater of less than in the past is
difficult to estimate. Clearly there is value in attempting to
establish an indicator that will allow the industry to measure
its performance in this area.
The predictive value of much of the data used by industry
to measure its safety performance is recognised to be of
limited value in measuring the potential for a major incident to
96250
7
occur. New indicators (lagging or leading) are required that
specifically target those elements that are relevant to managing
the major accident risks.
Through OGP and other forums, the industry will continue
to improve its understanding of major incident risk and
develop the tools necessary to manage them.
References
1.
2.
3.
4.
5.
6.
7.
8.
OGP Safety Performance Indicators 2004. OGP Report No.
367, May 2005, available via http://www.ogp.org.uk
Land Transportation Safety Recommended Practice. OGP
Report No. 365, April 2005, available via
http://www.ogp.org.uk.
Aircraft Management Guidelines. OGP Report No. 239,
Feb 1998, available via http://www.ogp.org.uk.
Ivan the Terrible. Technical Session, Offshore Technology
Conference, 2-5th May 2005, Houston, USA.
OGP Risk Management Website. http://www.ogp.org.uk/
Recommended Practice for Planning, Designing and
Constructing Fixed Offshore Platforms—Working Stress
Design.” Recommended Practice 2A (API RP 2A-WSD),
API WSD 21st Edition, API publications, 2003.
Risk. Petroleum Safety Authority Publication, 2005,
available via http://www.ptil.no
Preventing the next major incident. OGP Safety Workshop
4th November 2004, Helsingor, Denmark. Workshop
presentations, available via OGP Safety Zone,
http://www.ogp.org.uk
Managing Major Incident Risks
Don Smith, SPE, International Association of Oil and Gas Producers (OGP), Volkert Zijlker, Shell International Exploration
and Production, BV. (Chairman of the OGP Safety Committee)
Copyright 2005, Society of Petroleum Engineers
This paper was prepared for presentation at the SPE Asia Pacific Health, Safety and Environment
Conference and Exhibition held in Kuala Lumpur, Malaysia, 19–20 September 2005.
This paper was selected for presentation by an SPE Program Committee following review of
information contained in a proposal submitted by the author(s). Contents of the paper, as
presented, have not been reviewed by the Society of Petroleum Engineers and are subject to
correction by the author(s). The material, as presented, does not necessarily reflect any
position of the Society of Petroleum Engineers, its officers, or members. Papers presented at
SPE meetings are subject to publication review by Editorial Committees of the Society of
Petroleum Engineers. Electronic reproduction, distribution, or storage of any part of this paper
for commercial purposes without the written consent of the Society of Petroleum Engineers is
prohibited. Permission to reproduce in print is restricted to a proposal of not more than 300
words; illustrations may not be copied. The proposal must contain conspicuous
acknowledgment of where and by whom the paper was presented. Write Librarian, SPE, P.O.
Box 833836, Richardson, TX 75083-3836, U.S.A., fax 01-972-952-9435.
Abstract
Alexander Keilland (1980), Ocean Ranger (1982), Piper Alpha
(1988), P36 in Brazil (2001) and a recent major blowout (H2S
release) in China (2003) are all well-known examples of
incidents that have resulted in major loss of life.
The Safety Management Systems the industry utilises
should be equally applicable to the management of all types of
risk: from the high frequency, low consequence ‘slips, trips
and falls’ to the rare, high consequence incidents. However,
the review of past major incidents has shown that the
complexity of the failure path is such that questions arise as to
how adequate a traditional SMS based approach is to
managing these types of incident.
This paper presents some of the major challenges
associated with managing major incident risks. It draws upon
the findings of a recent workshop organised by the
International Association of Oil and Gas Producers (OGP) that
specifically addressed key challenges in this area, and
identified issues that warrant further review and development.
Introduction
Alexander Keilland (1980), Ocean Ranger (1982), Piper Alpha
(1988), P36 in Brazil (2001) and a recent major blowout (H2S
release) in China (2003) are all well-known examples of
upstream related incidents that have resulted in major loss of
life. They form a class of incidents that are often referred to as
low frequency, high consequence; as opposed to the high
frequency, (relatively) low consequence incidents that
dominate in the E&P industry’s safety statistics [1].
The Safety Management Systems (SMS) the industry
utilize, and the risk assessment and management process
within them, should be equally applicable to all forms of risk:
from ‘slips, trips and falls’ to the rare, high consequence
events. However, the frequency with which major incidents
and near misses occur suggests that more can be done to
improve the assessment and management of such events.
Investigations into major incidents show complex events
paths, typically incorporating the failure of many safety
barriers. The question that arises is: how adequate are the
traditional SMS based approaches at identifying, assessing
and managing these complex scenarios?
Clearly what differentiates a minor incident from a major
incident may be as simple as the failure of a single, additional
safety barrier.
Further, within the Exploration and Production (E&P)
industry the risk profile is continually changing. Increasingly
deepwater and hostile environments, more challenging wells,
ageing facilities and general advances in drilling and
production technology and systems, all have associated risks
that organisations need to be able to assess and manage.
Managing any process is simplified if performance
(output) can be measured. In the safety arena, the number of
recordable injuries, lost time injuries and certain classes of
fatalities (eg vehicle related) is such that the need for, and to a
lesser extent the influence of any change can be measured.
Not surprisingly, organisations will often focus effort in areas
where improvement can be demonstrated. The nature of major
incidents risk is such that performance data are difficult to
measure, and as such the precursors to these types of incidents
may not be identified in advance of an incident occurring.
This paper reviews a range of issues associated with
understanding and managing major incident risks. Initially,
major incidents are separated into two classes in order to help
recognise the different processes needed to manage different
types of major incident hazards. The paper then considers
some of the challenges associated with identifying key
performance indicators relevant to managing major incident
risks. Finally, the paper reviews the outcomes of an industry
workshop aimed at identifying the key challenges faced by the
industry in improving its approach to managing major incident
risks.
Major incident definition
Within this paper a major incident is defined as an event that
results, or has a significant potential to result in large numbers
of fatalities (to company or contractor personnel, or third
parties). Within the upstream industry the most obvious
examples of major incidents include hydrocarbon related fires
and explosions, structural failures and H2S emissions.
Incidents that result in few fatalities with little or no
escalation potential, are not the focus of this paper; albeit that
2
96250
Class 1 Major Incidents.
These are incidents in which (typically) a series of safety
barriers have failed. They may include:
•
•
•
•
•
Failures in the permit to work system
Failures in the control of change procedures
Failures in the system of supervision
Human factors related failures
Hardware failures
Investigation into such incidents will often highlight
failures in the organisations SMS (and/or that of its contractor)
lack of visible leadership commitment, a poor safety culture
within the worksite, and human factor failures. In fact, many
of these issues define the conditions necessary for this class of
incident to occur.
Incidents such as Piper Alpha, Alexandra Keilland and the
P36 incident fall within this class.
Class 1 incidents generally occur during operational or
maintenance activities, where there is likely to be a strong
human factor element present.
Class 2 Major Incidents.
These relate to failures that are, in effect, designed into the
system or are related to external influences. Examples of such
failures include the failure of an offshore installation exposed
to extreme weather conditions or seismic activities outside of
its original design envelope, the failure of a pressure vessel
(and subsequent hydrocarbon release) due to material
imperfections (of certain types) or a passing vessel collision.
There are many examples of these types of failure.
Recently within the Gulf of Mexico a number of offshore
structures failed as a result of the passage of Hurricane Ivan
[4]. However, a policy of evacuating platforms prior to the
arrival of a hurricane reduced the direct impact of these
particular incidents to financial losses.
It is important to recognise that for this class of failures,
the primary risk control measures are built into the system at
the concept selection, design, fabrication and installation
phases. Typically, the safety factors associated with, for
example, the design of a particular piece of equipment,
structure or mitigation measure (eg the deluge system) is
incorporated into design codes and industry guidelines.
This class of major incidents is not driven by operational
considerations (ie they do not necessarily require operational
failures to be realised, and may occur even if a system is
operated in accordance with the design requirements).
Further, the ‘real time’ human factor element is unlikely to
play a major element in such failures; although due account
needs to be taken of human factor issues that arise from the
concept selection to installation phase.
The risks associated with Class 2 hazards can never be
reduced to zero; the variability in the strength of the
components (eg due to material imperfections) and the
uncertainty in the load to which the component is subjected,
results in a residual risk of failure (Ref: Figure 1). For
example, for a typical modern fixed jacket structure, the risk
of structural failure due to environmental overload is expected
to be around 1e-5 to 1e-6 per annum.
0.16
Probability
many of the issues and tools needed to manage risks
associated with such incidents are similar to those used to
manage major incident risks. Equally, while both aviation and
vehicle related incidents may result in multiple fatalities, they
are not considered here; the industry has dedicated efforts
relating to both these areas of risk [2], [3].
In order to better understand major incident risks and how
they can be managed, it is of value to further classify major
incidents. Within this paper two classes of major incident are
defined:
0.14
Load
Distribution
Strength
Distribution
0.12
0.1
Failure Zone,
where load
exceeds strength
0.08
0.06
0.04
0.02
0
0
50
100
Load/Strength
150
Figure 1: Load and Strength Distributions and Residual Risk
Hence, while the risk of a major incident occurring can be
reduced to an extremely low level, it can never be eliminated.
Further, while it is clear that the probability of any individual
installation failing is extremely low, the risk of any one in a
population of structures failing increases as a function of the
number of installations.
This concept is readily (and relevantly) extended to
individual hardware components within a system, and as such
to certain aspects of the Class 1 incidents. However, while it
is difficult to mitigate the failure of a large structural
component (such as an offshore installation) the failure of subcomponents (eg a valve) can usually be effectively managed
such that a major incident does not arise.
A further extension of the concept is to human factors
issues; when exposed to a range of stimuli, different
individuals will respond differently, and on occasion in a
manner that will initiate a failure.
Combined failures
Clearly, on occasion an incident will fall within both
classes. For example a problem introduced at the design phase
may be the initiating event or a major contributor to a major
incident.
96250
3
Managing Major Incident Hazards
The key stages in managing risks associated with E&P
activities are shown in Figure 2.
Hazard Identification
Risk Assessment
Identify Risk
Reduction Options
Set Functional
Requirements
Figure 4: Key Stages in Risk Management
A range of tools is available for addressing each of these
stages [5].
It is of value to consider how the two different classes of
major incident risks make use of the above process, and the
challenges that arise.
Managing Class 1 Major Incident Risks
While identifying the hazards is relatively straight forward,
identifying and assessing all the scenarios with the potential to
result in a Class 1 major incident is, in practice, impossible. In
a complex workplace, if sufficient safety barriers are allowed
to fail, there are too many scenarios to consider. As such, the
primary focus of Managing Class 1 risks needs to be on
managing the individual safety barriers that, if they fail,
contribute to the likelihood of an incident occurring.
The individual safety barriers fail relatively frequently; an
estimate of this frequency of failure being the number of
‘minor’ incidents an operation is recording. Most of the
incidents indicate some form of failure within the Safety
Management System; whether it relates to, for example, poor
supervision or inadequacies in the permit to work
requirements.
For a Class 1 major incident to occur, not only do a
number of safety barriers need to fail, they need to fail in a
manner that will lead to an escalation in the severity of the
incident. While individual safety barriers fail relatively
regularly (as manifest by the number of minor incidents
reported) the combination of failures necessary to result in a
major incident occur extremely rarely.
In fact, the SMS
should be capable of recognising and addressing the failure of
individual safety barriers.
A large human factor influence complicates the assessment
of the Class 1 risks. Not only do individuals need to be
considered as an influencing factor at any stage of the
development of an incident (ie contributing to the escalation of
an incident) they play a key role in preventing the escalation
and mitigating the impact of an incident. Incorporating human
factor issues into risk assessments, where the focus is on
reducing the risk to a level that can be demonstrated to be
acceptable, is extremely challenging and warrants further
consideration.
The functional requirements related to managing Class 1
risks in practice have to focus on high-level aspects of the
SMS: for example, having in place adequate operational and
maintenance procedures, supervision of activities, ensuring the
permit-to-work system is correctly operated, etc..
Managing Class 2 Major Incident Risk
The Class 2 risks are managed primarily by ensuring that
the reliability of the component or structure is such that in all
but the most onerous of loading conditions, or the least
favourable strength conditions, the structure will survive. For
many Class 2 risks, the hazard cannot be controlled or
substituted (eg a fixed offshore installation will need to
survive whatever environment it is exposed to). Some Class 2
risks are controlled by a combination of design and
operational requirements; an offshore structure will be
designed to survive a certain level of ship impact, however
operational controls will be used to attempt to ward off
approaching vessels.
The Class 2 risks will be controlled initially at the concept
selection and design phase. The concept chosen to exploit the
reservoir will drive many of the subsequent Class 2 risks. At
one extreme, the choice of an unmanned facility has potential
to reduce greatly the risk to personnel, at the other extreme, a
complex, manned, offshore facility will require a
comprehensive range of tools to be used to manage the arising
risks.
During the design phase various tools will be used to
deliver a safe solution, with codes and standards forming the
basis of many aspects of system design. Through their use the
designer attempts to ensure that acceptable levels of reliability
(and safety) are achieved. However, in applying these codes
and standards, and undertaking the detailed design, the
potential for errors to be introduced needs to be managed.
For more complicated systems detailed modelling may be
undertaken to arrive at a design that satisfies both safety and
operational requirements. Usually a direct approach will be
taken to managing each hazard; for example the structure will
be specifically designed to withstand an extreme environment
and a passing vessel of a given speed and mass.
Other risks need to be managed during the design phase.
Limitations in the underlying data or knowledge of the
environment, human error, software/modelling issues, all have
the potential to result in a design that does not satisfy the
original requirements. In this respect, the Class 2 risks differ
from Class 1 risks insofar as there is time to address these
issues before the facility, system or component becomes
operational. A primary risk control measure is to use
independent competent organisations (eg Certifying
Authorities) to the verify the design details.
Once the facility is operational, many of the Class 2 risks
are managed through procedures such as planned maintenance,
inspection (eg of fatigue) and change control. Lifetime
extension and ageing facility issues are areas that require most
of the same risk management tools as applied to other Class 2
risks.
4
96250
The Incident P yra mid - Nu m ber of L TIs per Fatality - v aries per Business Activ ity
ref: U S - B ureau of Lab our S tatistics - year 2001 data (exclusiv e S ept 11 ev ents)
LTIs/Fat
100000
13046
10000
2773
777
1000
496
261
137
138
173
100
19
20
27
10
1
A ssault and
violent acts
Fires and Transportation E xposure to Fall to lower
explosions
incidents
harm ful
level
substances
(elec, tem p,
chem icals, O2
def)
Caught in
equipm ent,
object or
collapsing
m aterial
Total
S truck by Other contact S lips, Trips
Others
falling or flying w ith objects and Fall on ove re xercion,
and equipm ent sam e level rep m otion etc
object
Figure 3: Incident R atios
Key Performance Indicators
The E&P industry has long recognised that in order to
effectively manage safety, different types of key performance
indicators (KPIs) need to be measured, and corrective actions
taken based on these indicators. Traditionally the industry has
relied on lagging indicators such as fatal accident rate (FAR)
lost time injury frequency (LTIF) and total recordable incident
rate (TRIR). These indicators are extremely valuable in
managing the types of incidents to which they relate. Hence, a
measure of the number of medical treatment cases an
organisation has experienced in the previous years should
assist the organisation to identify whether more needs to be
done to avoid these types of injuries. Where the value of
lagging indicators becomes less clear is where one type of
indicator is used to infer safety performance in an unrelated
area.
Lagging indicators work well in an environment where
‘large’ volumes of incident data are produced that can be
attributed to specific causes. Within any single organisation it
is unlikely that significant number of incidents (particularly
LTIs or fatalities) will occur such that problem areas and
trends are identified and addressed quickly. However by the
sharing of incident data through initiatives such as the OGP
safety report, organisations can improve the volume of
relevant data on which to plan their safety initiatives.
Low frequency, high consequence incidents are, by
definition, unlikely to provide much lagging indicator data that
can be used to focus management effort. This lack of data
forces alternative approaches to be used to provide the
relevant KPIs.
Use of FAR, LTIF, TRIR as a Major Incident Indicator
The Class 1 incidents are typically associated with the
failure of a number of safety barriers, associated with which
there is a strong human factors element. The same safety
barriers, when they fail in isolation, may result in a minor
injuries or individual fatalities. For example, a safety barrier
defined as ‘a good safety culture’ if failing, may be expected
to increase the likelihood of ‘minor’ injuries, and contribute to
the possibility of a major incident occurring.
Hence,
theoretically at least, there should be a relationship between
KPIs such as FAR, LTIF and TRIR and the potential for a
major incident. However, when detailed incident data are
available, it appears that the relationship between different
levels of incident, specifically LTIs and fatalities, is difficult
to quantify.
Figure 3, taken from a report by the US Bureau of Labour
Statistics shows the number of lost time incidents per fatality,
in the US, in 2001. The incidents are separated into ten
categories ranging from assault and violent attacks, to a
category including repetitive strain injuries and over exertion.
On the right of the figure are the low consequence incidents
that form the bulk of the data. The likelihood of a fatality
occurring associated with these types of incident is remote
(typically greater than 1: 1000). On the left of the figure are
incidents that have a higher potential to result in a fatality
(around 1:20). These include violent attacks, fires and
explosions and vehicle related incident.
If all the LTIs shown in the figure were combined to give a
single (leading) KPI related to the potential for a fatality, it
96250
would represent a poor indicator. The large number of high
frequency, low consequence incidents, would dominate its
value1. Figure 3 suggests that by factoring LTIs based on their
categories, a more accurate indicator of the potential for a
fatality could be produced. An obvious factoring is based on
the ratio of fatalities to LTIs. This concept could be extended
to a KPI relevant to major incident risk; albeit that further
work would be required to establish the appropriate factors to
apply.
Each year OGP collects, analyses and reports safety data
on behalf of its members. The 2004 report [1] was based on
approximately 2.3 billion workhours of data, submitted by 37
companies, from their operations in 78 countries. Included in
the data were 2371 lost time injuries. If the distribution of
LTIs in the OGP data is similar to that in Figure 3, it is clear
that few, if any of the OGP data are likely to be related to
events that have any significant potential to result in a major
incident. Hence, while it is important to manage the hazards
that lead to LTIs, the number and rate of LTIs in themselves
represents a poor indicator of the likelihood of a fatality, let
alone a major incident.
Class 2 Lagging Indicators
Implicitly, lagging indicator data represent an important
input to the management of the Class 2 risks. Design codes
and standards are, on the whole, based on operational
experience. A good example is the API series of fixed
structure Recommended Practices (currently in its 21st Edition)
[6]. The failure of Gulf of Mexico structures (designed on the
basis of early editions of the Recommended Practice) has
driven the inclusion of more stringent provisions with the
updated editions, and on occasion the need to revisit earlier
designs.
Similarly, the failure of systems and components has
driven changes in related design practices, inspection and
maintenance regimes.
However, while this type of approach works well in an
environment where the consequence of failure is considered
acceptable (eg limited to financial loss) where fatalities or
environmental damage may occur a more proactive risk
indicator is desirable.
Leading Indicators
Ideally, what is required is a leading indicator of the
potential for a major incident to occur. While combining
lagging incident data as outlined above may provide a general
indication, of more value would be an indicator that more
closely measured the adequacy of the safety barriers that, if
they fail, could cause or contribute to a major incident
occurring.
For the Class 1 incidents, the performance of individual
barriers can be measured (either proactively or reactively) and
a model developed to provide a leading KPI for the worksite.
This type of approach has been promoted within Norway [7].
Indicators considered include:
• Non-ignited hydrocarbon leaks
• Ignited hydrocarbon leaks
1
While the figure shows only ratios of fatalities to LTI, the categories to the
right of the figure traditionally form the majority of incident datasets.
5
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Well kicks/loss of well control
Fire/explosion in other areas, flammable liquids
Ships on a collision course
Drifting objects
Collision with field-related vessel/installation/shuttle
tanker
Damage to platform
structure/stability/mooring/positioning errors
Leaks from subsea production facilities/
pipelines/risers/flowlines/loading buoys and hoses
Damage caused by fishing gear to subsea production
equipment/pipeline systems/diving equipment
Evacuation (precautionary/emergency)
Helicopter crashes/emergency landings on/near an
installation
Man overboard
Personal injuries
Occupational illness
Total power failure
Control room out of operation
Diver accident
Hydrogen sulphide leak
Loss of control with radioactive source
Dropped objects
The applicability of this type of approach to other regions
and operations is currently being considered within OGP.
Class 2 Leading Indicators
The nature of the Class 2 hazards is such that risk
assessment can be consistently applied at any time to provide
an up-to-date leading indicator of the potential for a major
incident to occur. For example, at the design stage structural
reliability analysis can be used to estimate the probability of
failure of the structure due to environmental overload. Then,
using up-to-date structural and environmental data, the
analysis can be repeated and an updated risk indicator
estimated.
The limitation of this approach is that it assumes a certain
level of knowledge of both the loading environment, and the
ability of the structure or component to withstand the loading.
If a loading scenario is not adequately recognised or
considered (eg a seismic event occurring in a region not
considered to be active, or limited knowledge of the metocean
environment is available) then the resulting risk indicator will
be of limited value.
Near-miss (significant incident) data
Of course, potentially the greatest source of information
that will assist E&P organisations to manage their major
incident risks is relevant near miss data. Through initiatives
such as the OGP Safety Zone (incident alerts) and a dedicated
OGP Task Force addressing safety data issues, it is expected
that improvements in the quality and quantity of significant
incident data will be realised.
6
In conclusion, it appears clear that further work is required
to identify KPIs that give a reliable indication of the potential
of a major incident occurring.
Preventing the Next Major Incident. Review of OGP
Safety Workshop, Helsingor, Nov, 2004
In order to focus the industry’s attention on managing major
incidents, in November 2004, OGP organised a workshop to
review the issue and identify the actions required to improve
the industry’s abilities to manage these types of hazard [8].
Over 80 individuals representing around 50 different E&P
organisations, regulators and service providers from around
the world, attended the workshop. Organisations shared their
experiences in managing major incidents, with the overall
intent of identifying how the industry could improve its ability
to address this important issue.
Presented below are the key issues arising out of the
workshop.
Senior Management Commitment
In order to influence both the culture within the workforce,
and to make available the resources necessary to address
major incident issues, it is important to ensure that senior
management understand the specific challenges associated
with managing major incident risks.
Technical Integrity
Increased complexity in the installations and systems used
to exploit hydrocarbon reserves (particularly in the offshore
environment) and ageing and life extension issues associated
with existing facilities, lead to the need to improve our ability
to assess the adequacy of the facilities we use.
Human Factors
The role of individuals in the initiation and prevention of a
major incident was discussed at length. It was recognised that
managing human factors was a key element in managing
major incident risks. In particular, good supervision was
viewed as an important means of reducing the likelihood of an
individual carrying out an incorrect operation. However, it
was also recognised that on occasions, the administrative
burden placed on supervisors was such that it severely
impacted the time they had available to spend directly
supervising activities. While it is clear that some level of
administration is inevitable, further work is necessary to
ensure that an appropriate balance is achieved.
The culture of the workforce is strongly influenced by the
direction given by senior management with respects to safety.
A need existed to provide tools to assist senior managers to
communicate their safety requirements to the workforce.
Finally, improving the means by which human factors are
addressed within risk assessments was recognised as an area
requiring further work.
Risk Management
It was agreed that the risk management tools currently
employed to identify and manage major incident risks should
be reviewed. The ability of such tools to identify and manage
the complex paths associated with of many (Class 1) major
incidents should be considered.
96250
It was felt that the development and availability of hazard
registers and incident descriptions could aid organisations in
ensuring that all the key major incident risks have been
identified and assessed.
Key Performance Indicators
In recognising the limited ability of the existing safety
KPIs to indicate the likelihood of a major incident occurring,
the workshop called for work to be undertaken in identifying
relevant leading indicators. A particular focus area should be
ageing assets and dealing with increasingly complicated
facilities and systems.
Other Issues:
A range of other issues were identified by the workshop
attendees:
• Sharing and learning from ‘high potential’
incidents
• Development of auditing guidelines specific to
major incident management
• Revisiting the roles and responsibilities between
E&P companies and their contractors
• Use of complex technology in remote areas
• Managing the balance between risk of non-fatal,
potentially costly incidents and the need to
maintain production
• Competence issues (ageing workforce, loss of
staff, training issues, etc)
OGP 2006 Safety Theme
In order to bring global focus to this important area of risk
management, Managing Major Incident Risks will be the OGP
safety theme for 2006. During the remainder of 2005, and
throughout 2006, effort will be given to addressing the issues
identified through the workshop, in particular in the areas of
Human Factors, Risk Management and Key Performance
Indicators.
Through the production of a range of products, which may
include recommended practices, guidelines, international
standards, workshops and conferences, the industry will
provide the information that should allow E&P companies and
their contractors to further improve their management of major
incident risks.
Conclusions
This paper has reviewed a range of issues related to managing
major incident risks. Through the identification of two classes
of major incident, the different risk management challenges
have been presented.
It is recognised that throughout the global E&P industry
major incidents and near misses continue to occur. Whether
the rate at which they occur is greater of less than in the past is
difficult to estimate. Clearly there is value in attempting to
establish an indicator that will allow the industry to measure
its performance in this area.
The predictive value of much of the data used by industry
to measure its safety performance is recognised to be of
limited value in measuring the potential for a major incident to
96250
7
occur. New indicators (lagging or leading) are required that
specifically target those elements that are relevant to managing
the major accident risks.
Through OGP and other forums, the industry will continue
to improve its understanding of major incident risk and
develop the tools necessary to manage them.
References
1.
2.
3.
4.
5.
6.
7.
8.
OGP Safety Performance Indicators 2004. OGP Report No.
367, May 2005, available via http://www.ogp.org.uk
Land Transportation Safety Recommended Practice. OGP
Report No. 365, April 2005, available via
http://www.ogp.org.uk.
Aircraft Management Guidelines. OGP Report No. 239,
Feb 1998, available via http://www.ogp.org.uk.
Ivan the Terrible. Technical Session, Offshore Technology
Conference, 2-5th May 2005, Houston, USA.
OGP Risk Management Website. http://www.ogp.org.uk/
Recommended Practice for Planning, Designing and
Constructing Fixed Offshore Platforms—Working Stress
Design.” Recommended Practice 2A (API RP 2A-WSD),
API WSD 21st Edition, API publications, 2003.
Risk. Petroleum Safety Authority Publication, 2005,
available via http://www.ptil.no
Preventing the next major incident. OGP Safety Workshop
4th November 2004, Helsingor, Denmark. Workshop
presentations, available via OGP Safety Zone,
http://www.ogp.org.uk
