Prevention of Major Accidents in the Oil & Gas Industry

TABLE OF CONTENTS

ABSTRACT

ACKNOWLEDGEMENTS

LIST OF FIGURES

LIST OF TABLES

LIST OF ABBREVIATIONS

CHAPTER 1
INTRODUCTION
1.1 BACKGROUND
1.2 PROJECT OBJECTIVES AND SCOPE
1.3 PROJECT METHODOLOGY

CHAPTER 2
ANALYSIS OF HISTORIC MAJOR ACCIDENTS
2.1 SELECTION OF MAJOR ACCIDENTS FOR CASE STUDY REVIEW
2.2 CASE STUDIES ON ACCIDENT DEVELOPMENT, ROOT CAUSES AND RESPONSE STRATEGIES
2.2.1 Loss of Containment
2.2.2 Loss of Well Control
2.2.3 Major Accidents During the Production Phase
2.3 RECURRING PATTERNS IN MAJOR ACCIDENTS
2.3.1 Common Causes for Major Accidents
2.3.2 Common Flaws in Response Strategies

CHAPTER 3
IMPACTS OF MAJOR ACCIDENTS
3.1 CHANGES TO THE LEGAL ENVIRONMENT AFTER MAJOR ACCIDENTS
3.2 INFLUENCE OF PUBLIC PERCEPTION AND MEDIA ATTENTION
3.3 STEP CHANGES IN RISK MANAGEMENT

CHAPTER 4
PREVENTION OF MAJOR ACCIDENT HAZARDS
4.1 PREVENTATIVE MANAGEMENT OF MAJOR ACCIDENT HAZARDS
4.1.1 Scope and System Requirements
4.1.2 Management of Major Accidents Scenarios Model
4.2 REQUIREMENTS FOR RESPONSE PLANNING
4.2.1 Oil Spill Response Planning
4.2.2 Regaining Well Control

CHAPTER 5
ANALYSIS OF CONTRIBUTION TO MAJOR ACCIDENT PREVENTION
5.1 LIMITATIONS TO MAJOR ACCIDENT PREVENTION
5.1.1 Inevitable Limitations
5.1.2 Systemic Limitations
5.1.3 Intra-Organizational Limitations
5.2 PRACTICAL STRESS TEST OF MOMAS MODEL
5.2.1 MOMAS Stress Test Exxon Valdez Incident
5.2.2 MOMAS Stress Test Macondo Blowout
5.2.3 MOMAS Stress Test Texas City Refinery Explosion

CHAPTER 6
CONCLUSIONS AND RECOMMENDATIONS
6.1 CONCLUSIONS
6.1.1 Achievement Of Objectives
6.2 RESEARCH OPPORTUNITIES
6.3 RECOMMENDATIONS

REFERENCES

BIBLIOGRAPHY

APPENDICES

APPENDIX 1: SHORTLIST OF MAJOR ACCIDENTS

ABSTRACT

Despite sophisticated Health, Safety and Environment (HSE) Management Systems and highly developed safety cultures, major accidents in the Oil & Gas industry are reoccurring events. This type of low frequency high impact event puts at stake the health and safety of employees, the viability of the ecosystem, the integrity of the structure, the life and health of populations in neighboring communities and can also massively impact the economic situa- tion of a region. Prevention of major accidents is therefore of utmost impor- tance.

Detailed case studies of nine historic major accidents revealed common features in the accidents, although they represent a wide range of individual accident scenarios. Identified common features and recurring patterns were degradation of safety measures, decrease in attention and awareness towards major accident hazards as well as an increase in complacency and resulting management failures.

These findings served as the basis for a prevention model specific to major accident hazards in the Oil & Gas industry. The Management of Major Acci- dents Scenarios model (MOMAS) was designed with special attention to practical application, information availability over long time periods and avoid- ing degradation of safety systems, in a holistic system approach. The MOMAS model consists of elements fit for application and offers palpa- ble and precise support in performing the individual assessment steps. This was tested by demonstrating the prevention potential of the MOMAS model on three of the case study incidents.

The MOMAS model also integrated the approach of As Low As Reasonably Achievable (ALARA), which is deemed to be more applicable to a major accident scenario setting than the current approach of As Low As Reasonably Practicable (ALARP).

By integrating the MOMAS model into existing HSE Management systems it is going to support prevention of major accidents in the future.

DEDICATION

To all that have been affected by a major accident.

ACKNOWLEDGEMENTS

I wish to thank my boss and colleagues at Wintershall, Guido Schnieders,

Malalay Osmani, Jörn Kahle, Marco Lukassen, Kay Rehberg and Klaus Jantos, for always stepping in for me, when I needed time off work during the project work and the masters course. Special thanks to Henning Gröschke, who volunteered in helping with proof-reading.

I would also like to acknowledge Jo McCafferty, who always had advice and a comforting word for me through the entire length of the Masters course.

My sincere gratitude goes to my supervisor Laurie Power, who guided me through the rough waters of the project work with advice and critical discussion, making sure I can meet the projects demands and still allowing me to develop own ideas and solutions.

LIST OF FIGURES

Figure 2.1: Number of accidents listed in OGP Risk Assessment Data Di- rectory according to accident category

Figure 2.2: Number of spills listed in ITOPF Oil Tanker Spill Statistics ac- cording to spill size

Figure 2.3: Barrier failure diagram Torrey Canyon oil spill

Figure 2.4: Barrier failure diagram Amoco Cadiz oil spill

Figure 2.5: Barrier failure diagram Exxon Valdez oil spill

Figure 2.6: Barrier failure diagram Ixtoc I blowout

Figure 2.7: Barrier failure diagram Gao Qiao blowout

Figure 2.8: Barrier failure diagram Macondo blowout

Figure 2.9: Barrier failure diagram LPG explosion San Juan Ixhuatepec

Figure 2.10: Barrier failure diagram Piper Alpha explosions and fires

Figure 2.11: Barrier failure diagram Texas City refinery explosion

Figure 4.1: Overview of model

Figure 4.2: Overview of MOMAS model including selected methods in red

Figure 5.1: Exxon Valdez failed barriers rectifiable by MOMAS model

Figure 5.2: Macondo blowout failed barriers rectifiable by MOMAS model

Figure 5.3: Texas City failed barriers rectifiable by MOMAS model

LIST OF TABLES

Table 2.1: Major accidents selected for full case study review

Table 2.2: Underlying and contributing causes Macondo blowout

Table 4.1: Main schools of safety theory

Table 4.2: Major accident prevention model conditions

Table 4.3: Method suitability for identification of major accident scenarios

Table 4.4: Method suitability for selection of protective measures

Table 4.5: Method suitability for barrier effectiveness assessment

Table 5.1: Aspects analyzed by MOMAS stress test

Table 5.2: MOMAS stress test Exxon Valdez incident

Table 5.3: MOMAS stress test Macondo blowout

Table 5.4: MOMAS stress test Texas city refinery explosion

Table 6.1: Opportunities for further research

LIST OF ABBREVIATIONS

illustration not visible in this excerpt

CHAPTER 1

INTRODUCTION

The Oil and Gas (O&G) industry is by its nature a high risk industry. The in- dustries’ products, hydrocarbons produced and transported, supply the world market with substantial amounts of fuel and raw product for a number of in- dustrial activities. Therefore the O&G industry handles large quantities of flammable and hazardous substances in the high energy environment en- countered subsurface, with high pressure and temperature scenarios. In some cases the risk situation is complicated by a highly toxic gaseous by- product - hydrogen sulfide (H2S).

These high energy situations and severe forces call for highly developed Health, Safety and Environment (HSE) Management Systems and Cultures. Their effectiveness is proudly proclaimed by the industry and endorsed by significant reductions of personal injuries (OGP 2010a, p.1~3). Despite the high-performance risk control approach the O&G industry has implemented, the industry has seen a number of major accidents with exten- sive consequences. A major accident involving hydrocarbons puts at stake the lives of personnel working at the site, the life and health of populations in neighboring communities, the viability of the ecosystem and can also mas- sively impact the economic situation of a region. Bearing this in mind the pre- vention of major accidents is a task of outmost importance.

1.1 BACKGROUND

Major accidents in the O&G industry are, as in other industries, low frequency high impact events. For the O&G industry major accidents can be assigned to three categories, namely

- Loss of containment for hydrocarbons
- Loss of well control
- Accidents during the production phase

These types of accidents have occurred from the early days of the industry developing, up until very recently. Although risk management systems have been improved over the years, they are still not fully efficient in controlling the hazards encountered.

1.2 PROJECT OBEJECTIVES AND SCOPE

This project aims at investigating why the industries’ efforts in risk control have failed and proposes a practical approach to major accident prevention. The scope of the work performed is limited to major accidents in the O&G industry, where a major accident is defined as an incident with an outcome of

- multiple fatalities
- total loss of or severe damage to the structure
- oil spill of more than 700 metric tons
- oil spill of more than 7 metric tons in sensitive ecological areas, as protected by international conventions or national protection laws

or any combination of these. This definition was derived from merging the definitions used by The International Association of Oil and Gas Producers (OGP) (OGP 2010b) and The International Tanker Owners Pollution Federation (ITOPF) (ITOPF 2009), adding a criterion for environmental sensitivity. The O&G industry includes activities for exploration for and production of hydrocarbons, the transportation and storage of hydrocarbons, as well as processing of these, e.g. in a refinery.

The specific objectives of the project can be laid down as follows:

1. Review of historic major accidents in the O&G industry
2. Review step changes in legislation, approval processes and HSE cul- ture after major accidents
3. Derive recurring patterns in major accidents in the O&G industry
4. Review current status of risk management practices in the O&G indus- try and other high risk industries (chemical, nuclear power, air traffic)
5. Develop a suitable model, specific to risk control strategies, for major accident hazards
6. Develop recommendations for response strategies in different incident scenarios

The project aims at improving the risk control strategies of prudent operators and therefore excludes any discussion on authority oversight.

1.3 PROJECT METHODOLOGY

In order to achieve the objectives of the project, a staged approach is required. A literature review of historic major accidents was performed, in order to derive recurring patterns in major accidents. For this a number of accident data collections were screened. The data collections used are

- OGP: Risk Assessment Data Directory on Major Accidents (OGP 2010b)
- ITOPF: Oil Tanker Spill Statistics (ITOPF 2009)
- SINTEF: Offshore Blowouts (Holand 1997 and 2010)

Incidents for more detailed review were selected from the databases. The selection criteria are laid down in chapter 2.1. The incidents selected were submitted to case studies of incident development, root causes and emer- gency response strategies. For each of the categories loss of containment, loss of well control and production incidents, three selected major accidents were submitted to a full case study assessment. The revealed information forms the basis for the analysis of recurring patterns. Chapter 2 offers an ac- count of the analysis of historic major accidents submitted to case studies. Consecutively chapter 3 summarizes the impact of the major accidents, ana- lyzed in terms of legal changes, changes in public perception and changes in risk management strategies.

The recurring patterns observed are the source for developing a risk man- agement model, which supports the prevention of major accidents. This model is developed in chapter 4 of this report. Initially the requirements for such a model were defined, especially supported by the recurring patterns observed in historic major accidents and the concepts laid down in the de- fense in depth strategies as used in the nuclear power industry (Modarres, Mosleh and Wreathall 1992). The requirements which the model needs to meet, are laid out in more detail in chapter 4.1.1. In order to meet the models demands, an assessment of existing risk management strategies was per- formed. Systems from high risk industries (chemical, nuclear power, O&G and air traffic) were analyzed and combined into a risk management model, that meets the expectations. For this analysis, methods including risk identifi- cation, risk assessment, risk communication, selection of protective meas- ures, efficiency assessment of protective measures and incident analysis were used.

Chapter 4 is concluded by recommendations on emergency response strate- gies.

The developed model for major accident prevention is submitted to a critical discussion in chapter 5. In a first section a discussion of the models limita- tions and systemic limitations to accident prevention is held. In a second section the discussion centers around the contribution of the model and therewith this project, to prevention of major accidents. Due to the long required observation periods needed to prove practical improvements through the developed model, practical implementation was not possible. Alternatively the developed risk management model was submitted to a stress test, through application to three of the case studies. This evaluation highlighted how the risk management model could have prevented the acci- dent paths from escalating.

Finally chapter 6 goes on to conclude this report by summarizing the contri- bution of the work performed towards major accident prevention and assess- ing to what extent the objectives could be met. It also discusses need and opportunities for further research in the field of major accident prevention.

CHAPTER 2

ANALYSIS OF HISTORIC MAJOR ACCIDENTS

2.1 SELECTION OF MAJOR ACCIDENTS FOR CASE STUDY REVIEW

This chapter describes how the major accidents submitted to a case study review were selected from available data.

The OGP Risk Assessment Data Directory on Major Accidents (OGP 2010b) summarizes information on major accidents in the on- and offshore O&G industry for the period between 1970 and 2007. The number and distribution of incidents listed is shown in figure 2.1 below.

illustration not visible in this excerpt

Figure 2.1: Number of accidents listed in OGP Risk Assessment Data Directory according to accident category

The ITOPF Oil Tanker Spill Statistics (ITOPF 2009) gives statistical information on oil spills caused through tanker incidents for the period 1970 through to 2009. It also includes a list of the top 20 tanker oil spills according to spill size. The number and distribution of incidents included in the ITOPF Oil Tanker Spill Statistics is represented in figure 2.2.

illustration not visible in this excerpt

Figure 2.2: Number of spills listed in ITOPF Oil Tanker Spill Statistics according to spill size

The SINTEF database on Offshore Blowouts (Holand 1997 and 2010) reports on a total of 230 offshore blowouts for the period 1980-2007. 18 of these resulted in major pollution.

The data given in the three databases utilized does not adhere to a standard definition for a major accident, especially the definition used for a large oil spill varies considerably.

The large number of incidents reported, makes it necessary to narrow down the number of incidents submitted to a full analysis. Therefore the incidents listed in the different databases were screened according to the following criteria:

- Does the incident meet the definition of major accident as stated in chapter 1.2 ?
- Is sufficient information published regarding the incident (course of in- cident and incident investigation)?
- Does the incident cover a learning point additional to the incidents already listed (varying topic in incident development, root causes or legal environment)?

This resulted in a shortlist of major accidents for the three defined categories. For each of the short listed accidents a brief overview including location, operator, accident development, impacts and consequences is given in Appendix 1 to this report.

These short listed accidents were submitted to another selection step. The aim was to select three accidents for each of the three defined accident categories to be submitted to a detailed case study. The selection criteria used here were: The selected accidents shall

- cover a wide range of operations, in order to ensure a wide scope of learning points derived,
- cover a wide time period, in order to acknowledge improvements or identify remaining problem areas,
- be located in different legal settings, in order to identify influence of le- gal requirements, and
- cover those that caused significant changes in legislation, public per- ception or risk control / HSE management practices.

The incidents selected for full case study assessment are listed in table 2.1, alongside a short description why this specific incident was included.

Table 2.1: Major accidents selected for full case study review

illustration not visible in this excerpt

2.2 CASE STUDIES ON ACCIDENT DEVELOPMENT, ROOT CAUSES AND RESPONSE STRATEGIES

For the major accidents selected and listed in table 2.1 above, a full case study review was performed. This was achieved by critically reviewing pub- lished accounts on accident development, response activities, incident inves- tigations and changes in legislation. For each major accident analyzed the direct causes were detailed in form of a barrier failure diagram. Where infor- mation was available on contributing or underlying causes or where these could be reasonably deducted from the published reports, these are detailed as well.

Direct causes for an accident are those, that are directly involved in the sequence of events leading up to the accident. Underlying or root causes and contributing causes are factors more distant from the actual event, however can be often traced down to systematic flaws in the system. These systematic aspects are very interesting, as they impact a wide range of possible scenarios within the organization.

2.2.1 Loss of Containment

This chapter summarizes the results of the case studies for the major acci- dents selected in the Loss of Containment accident category, namely the Torrey Canyon oil spill, the Amoco Cadiz oil spill and finally the Exxon Valdez oil spill.

The Torrey Canyon oil spill was described in detail by Simpson (1968), Cowan (1969) and Perry (2009). It was the first major oil spill that occurred worldwide. It commenced in March 1967, when the crude tanker Torrey Can- yon ran aground between the Cornish coast and the Scilly isles. The vessel was carrying nearly 120,000 to of crude oil, the entire cargo was spilled into the Atlantic. Vast stretches of British and French coast were af- fected by beaching oil and large numbers of wildlife were collected dead. In the absence of scientific or practical knowledge on effective spill response, the British government opted for drastic response measures, including in situ ignition of the oil and aggressive use of dispersants. Some of the response measures proved detrimental.

The barriers that failed leading to the Torrey Canyon oil spill are displayed in the barrier failure diagram in figure 2.3.

illustration not visible in this excerpt

Figure 2.3: Barrier failure diagram Torrey Canyon oil spill (adapted from Reason 2008 p.98 fig. 5.2)

In all it has to be concluded, that the root cause for these individual failures was gross negligence through the management of the company operating the Torrey Canyon.

The Amoco Cadiz oil spill was described in detail by Hess (1978), Lagadec (1982 pp. 76-104) and Püschel and Spielberg (2005). Unlike the Torrey Can- yon oil spill, the Amoco Cadiz can not be assigned to gross negligence. The Amoco Cadiz was a crude carrier which was transporting 223,000 to of crude oil when on the way from the Persian Gulf to Rotterdam. It ran aground three miles off the coast of Brittany on the 16th of March 1978, after hitting severe weather in the British channel, damaging the vessels rudder. When grounded on the rocks all towing attempts failed due to adverse weather conditions, the Amoco Cadiz broke up and spilled its entire cargo. As a result of the oil spill, 320 km of French coast were affected and 20,000 birds died. Most marine life was mortified in the two months following the spill, however most populations recovered within a year. During the oil spill response, the French government opted for not applying dispersants. The direct causes for the Amoco Cadiz oil spill taking place are displayed in figure 2.4.

illustration not visible in this excerpt

Figure 2.4: Barrier failure diagram Amoco Cadiz oil spill (adapted from Reason 2008 p.98 fig. 5.2)

The Exxon Valdez oil spill was described in detail by the Alaska Oil Spill Commission (1990). It took place in Prince William Sound, Alaska, the night between the 23rd and the 24th of March 1989.

The installed protective measures in Prince William Sound, such as the re- quirement for double-hull tankers, the installation of two single-file-traffic safe tanker-lanes, speed regulations in case ice was encountered, a fully negoti- ated emergency response plan etc. had been lifted due to industry pressure or had degraded over time. As the safe tanker-lanes had ice present the night of the accident, the Exxon Valdez followed a route outside the safe tanker-lanes and deviated further from these at increased speed, despite other regulations. A substantial navigational error finally led the Exxon Valdez to ground on Bligh Reef, which resulted in 37,000 to of crude oil being spilt into Prince William Sound. By far not the largest oil spill in the history of crude product transportation, but one with the most severe environmental effects. Delays in deployment of rescue and spill response equipment, due to lack of maintenance, capable operators and non-adherence to agreed plans, very likely worsened the situation.

The barriers that failed leading to the Exxon Valdez oil spill occurring are displayed in the barrier failure diagram of figure 2.5.

illustration not visible in this excerpt

Figure 2.5: Barrier failure diagram Exxon Valdez oil spill (adapted from Reason 2008 p.98 fig. 5.2)

Contributing factors to the event taking place were:

- a captain impaired through alcohol abuse
- a poorly educated crew on crucial positions
- a fatigued crew and
- an attitude to cut corners in order to save time and money

In all it again has to be concluded, that the root cause for the combination of individual failures was gross negligence through the management of the company operating the Exxon Valdez.

2.2.2 Loss of Well Control

This chapter summarizes the results of the case studies for the major acci- dents selected in the Loss of Well Control accident category, namely the Ix- toc I, the Goa Qioa and the Macondo well control incidents. Loss of well control incidents can usually be described by a sequence of events that worsen from stage to stage. The first stage is characterized through influx of hydrocarbons into the well. This results in mud being pushed up towards the wellhead and being replaced by hydrocarbons. Which de- creases the weight exerted by the mud on the reservoir and enables more hydrocarbons to enter the well, this is called a kick. If the kick goes unnoticed or no sufficient control actions are taken, the hydrocarbons rise up through the well and eventually result in first mud and then hydrocarbons flowing from the wellhead, this is termed a blowout. For the transition from one phase to the next to occur a number of barriers have to be breached or become unavailable. However, blowouts and consecutive major accidents are the most common and hazardous unwanted events in the O&G industry.

Despite the Ixtoc I blowout resulting in one of the worlds largest oil spills with an estimated amount of 475,000 to 810,000 to of oil spilt, the incident was never fully analyzed or at least the results of the investigation have not been published. The main knowledge on the incident and its aftermath are based on an United Nations Environment Program (UNEP) mission chaired by Arne Jernelöv (Jernelöv and Linden 1981, Jernelöv 2010). Some additional infor- mation on the impacts of the accident were described by Farrington (1980) and Hill (1979).

The Ixtoc I blowout occurred in June 1979 in the Gulf of Mexico, about 80 km north-west of Ciudad del Carmen. While drilling at a water depth of 50 m, the well hit a section of soft strata and drilling mud was lost to the formation. All attempts to reestablish mud circulation failed. In an attempt to seal the well with a plug, the drillpipe was removed from the well, resulting in an underbal- anced well status and finally a blowout. The shear rams of the Blowout Pre- venter (BOP) could not seal the well, as they were not able to penetrate the thicker steel of the drill collars, which had been aligned with the BOP during the pulling of the drillpipe.

When the well blew out and the hydrocarbons ignited on contact with an ignition source, the explosion and fire badly damaged the drilling structure, the derrick and the wellhead with the underlying well structure. The oil and gas hence exited the well at the seafloor at increasing flow levels. Despite a series of control attempts the flow from the well could only be stopped through pumping mud down the relief wells Ixtoc IA and IB in March 1980, some 9½ months after the blowout occurred.

Massive and aggressive response efforts were launched, including mechani- cal and chemical response activities. Unfortunately, little is known of the envi- ronmental impacts and effects the spill and the applied spill measures have had, due to lacking scientific research. Especially the chance to investigate new phenomena related to subsea release of oil and subsea application of dispersants were missed (Schrope 2010).

There is no published information on the results of an incident investigation, therefore only indirect conclusions on causes can be drawn. A representation of the failed barriers is given in figure 2.6 below.

Abbildung in dieser Leseprobe nicht enthalten

Figure 2.6: Barrier failure diagram Ixtoc I blowout (adapted from Reason 2008 p.98 fig. 5.2)

The Gao Qiao blowout occurred in a Chinese onshore gas exploration well being drilled in December 2003 and was described in detail by Jianfeng et al (2009). After reaching the productive zone and entering the horizontal section of the well, a series of pulling drillpipe out-of-hole activities took place for a number of reasons. The resulting surging and swabbing in the well finally led to hydrocarbons entering the well, followed by an overflow of more than 1 m³ of mud and eventually the blowout of gas with a substantial percentage of H2S (≈ 9%). H2S is a highly toxic gas, that generates severe health problems (skin and mucosa irritation, coughing and nausea) at concentrations as low as 150 ppm (0.015 %) with the lethal dose rate being 700 ppm (0.07 %).

As the BOP did not include shear rams, activation of the BOP could not seal the well. About 2 ½ hours after the start of the blowout the drilling manager asked permission to ignite the well. Ignition of the well would have resulted in the hydrogen sulfide being burnt off to sulfur dioxide, a much less toxic gas. It took another 15 ½ hours until the well was finally ignited, after this the ob- served H2S concentrations decreased rapidly. Unfortunately too late to pre- vent the health impacts on the neighboring communities. The blowout re- sulted in 243 deaths, 1242 hospitalizations and 65,000 evacuations. The lo- cation of the closest village was only 300 m from the wellsite.

The barriers failing or being breached in the Gao Qiao incident are represented in figure 2.7.

illustration not visible in this excerpt

Figure 2.7: Barrier failure diagram Gao Qiao blowout (adapted from Reason 2008 p.98 fig. 5.2)

Underlying and supporting causes for the incident can be summarized as:

- there was no risk assessment conducted,
- there was no emergency plan derived for the neighboring residents,
- there was no information given to the local residents on the risks in- volved in the activities or adequate response in emergency situations,
- the drilling crew had little to none emergency response or blowout prevention training, where it had taken place it was ineffective and
- surveillance over operation was insufficient, breaching of safety pro- cedures was known and widely accepted.

The Macondo well blowout has been described by an internal investigation report of British Petroleum (2010), the National Academy of Engineering and National Research Council (2010), the National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling (2011) and Parsons (2010). The Macondo well was being drilled about 80 km from shore in the Gulf of Mexico in a water depth of 1500 m, by the rig Deepwater Horizon, owned by Transocean, and under the contract of BP. At the time of the incident the well was being prepared to be left by the drilling rig. The cementation of the annu- lus had taken place and would have been finalized by a cement plug at the top of the wellbore. At a later point in time a production platform would have completed the well in order to take up production.

On 20th of April 2010, during the process of finalizing the cementing job a blowout occurred, which resulted in an explosion, the loss of eleven lives and the drilling platform to sea. Despite the explosion and severe fire on the drilling platform, 115 of the 126 people on board could be evacuated, 17 of which were injured. The loss of well control resulted in a massive oil spill of 0.5 to 1 million tons of crude oil, rivaling the Ixtoc I blowout in size.

The environmental, public health and economic consequences of the incident are yet to be fully investigated. The direct causes in form of failed or breached barriers in the Macondo well incident are graphically represented in figure 2.8 below.

illustration not visible in this excerpt

Figure 2.8: Barrier failure diagram Macondo blowout

(adapted from Reason 2008 p.98 fig. 5.2 and BP 2010 p. 32 fig. 1)

Underlying and contributing causes to the incident were inferred from the findings of the published reports and are summarized in table 2.2.

illustration not visible in this excerpt

Table 2.2: Underlying and contributing causes Macondo blowout

Summarizing the information in table 2.2, it has to be concluded, that a num- ber of faulty decisions by the management of the companies involved in the well activities supported an atmosphere of complacency rather than aware- ness. It is not surprising, that this set of values and beliefs transferred to the personnel on site.

2.2.3 Major Accidents During the Production Phase

This chapter summarizes the results of the case studies for the major accidents selected in the Production Phase category, namely the San Juan Ixhuatepec Liquefied Petroleum Gas (LPG) explosion, the Piper Alpha explosion and fire and the Texas City refinery explosion.

The LPG explosion in San Juan Ixhuatepec liquefied gas storage and distri- bution plant, close to Mexico City was described in detail by Pietersen (1988), Florido (2003) and the Risk Research Institute of the University of Zaragoza (2011).

The LPG explosion took place in November 1984, when filling of a tank re- sulted in a pipeline rupture due to a number of safety system failures. This formed a leak, from where LPG bled into the walled-in about 1 m high section of the storage facility. The vapor cloud, that had heavy gas properties, spread and reached an ignition source. This resulted in a vapor cloud explosion, damaging other storage equipment. A total of 10 major vapor cloud explo- sions were recorded, which resulted in total destruction of the plant. In addi- tion to the main explosions, a number of smaller fires and explosions took place in houses in the nearby settlement. The housing been built, after the plant had been erected.

At the LPG site five people were killed and two injured. The impact on the neighboring community was devastating, 500-600 people lost their lives, 5000-7000 people were seriously injured mainly with burning injuries, the majority of the settlement was destroyed and about 200,000 people had to be relocated to temporary accommodation.

The direct causes for the LPG explosion are graphically represented in figure 2.9 as breached or missing barriers. Unfortunately there is no information available on underlying and contributing factors.

illustration not visible in this excerpt

Figure 2.9: Barrier failure diagram LPG explosion San Juan Ixhuatepec (adapted from Reason 2008 p.98 fig. 5.2)

The Piper Alpha explosion and fire is to date seen as the worst offshore incident. It was described in detail by Cullen (1990), Drysdale and SylvesterEvans (1998), Ross (2008) and many other authors.

The Piper Alpha platform, located in the North Sea northeast of Aberdeen, was at the centre of a platform production net and was therefore connected via gas risers to two other platforms. When on the 6th of July 1988, a conden- sate pump was started, this resulted in the first of a series of condensate, gas and oil explosions and fires. These eventually destroyed the platform and resulted in the loss of 167 lives.