Probability Analysis and Prevention of Offshore Oil and Gas Accidents: Fire as a Cause and a Consequence

Abstract

Failures during the drilling and exploitation of hydrocarbons that result in catastrophic offshore oil and gas accidents are relatively rare but if they occur the consequences can be catastrophic in terms of loss of life and environmental damage. Therefore, to gain insight into their prevention, the largest major offshore oil and gas accidents, those with more than 10 fatalities or with a large environmental impact, are analyzed in this article. Special attention is placed on fire as a cause and a consequence. Relevant technological and legislative changes and updates regarding safety that have followed such accidents and that can prevent potential future similar misfortunes are evaluated. Two main approaches to safety are compared: (1) the American prescriptive vs. (2) the European goal-oriented approach. The main causes of accidents are tested statistically in respect of failure probability, where the exact confidence limits for the estimated probabilities are computed. The results of the statistical test based on exact confidence intervals show that there is no significant difference between the analysed factors, which describe the main causes of offshore oil and gas accidents. Based on the small but carefully chosen group of 24 of the largest accidents, it can be concluded that there is no evidence of a difference between the categories of the main causes of accidents.

1. Introduction

The drilling and exploitation of oil and gas comes with many hazards both to life and the environment [1]. Fire and explosions can have an immediate effect on an offshore facility together with the personnel working on it (offshore rigs can be destroyed or damaged together with the installed equipment by fire and/or explosions while staff can be injured or killed) [2], while hydrocarbon releases can have tremendous and long-lasting effects on the environment, including on wildlife and humans in a large perimeter around the area directly affected by such offshore accidents [3]. Following this reasoning, the main hazards include:

(1) fire and explosions after the release of hydrocarbons (a mixture of gases or liquid drops dispersed in a cloud together with air can be ignited);

(2) oil release on the subsea and on sea surfaces.

There have been many accidents in the oil and gas industry that have caused many fatalities with loss of assets and/or with a huge impact on the environment [4]. Major causes of an accident can include material, structural and mechanical failures and malfunction, human and procedural errors associated with poor training, natural causes, etc. [5]. Personnel can be injured by falling objects, slips and falls or chemical exposure, etc. [6,7,8].

To prevent accidents, all potential causes should be thoroughly examined (here the focus is on fire in offshore accidents [9]). This article provides an overview of the main causes and the loss of control in major accidents from 1956 to 2010 that have resulted in the largest number of fatalities or the greatest environmental damage, including the response to each major accident with its corresponding improvements, updates and the implementation of regulations, guidelines, etc. [10]. The accidents were chosen if they resulted in more than 10 fatalities or if not, if they had a large environmental impact. Several types of facilities are addressed (drilling ships, production platforms, etc.) [11], and in many described accidents, a fire occurred in a chain of events [12].

In addition to Brkić and Praks [13], who examined the proper use of technical standards in the offshore oil and gas industry, and Brkić and Stajić [14], who focused on the prevention of explosions on offshore oil and gas facilities, this article will give a historical overview of offshore accidents with a focus on fire as a cause and a consequence and on the examination of uncertainty around the main causes of accidents [15]. To analyse the uncertainty of the accident rate, we will provide statistical analyses by the exact confidence limits of binomial data. The tested hypothesis (denoted by H₀) is that the proportion between the number of “hits” (i.e., reported failures) and the number of trials (i.e., the total number of installations) is the same in all analysed categories.

This article is focused on the classical approach to offshore drilling and on the exploitation of oil and gas on the seas [16,17] and not on the pollution of inner onshore water (rivers, lakes, etc.) [18] and further problems that can occur onshore.

2. Technical Aspects of Offshore Drilling and Production with the Protection of the Well and the Facilities

2.1. Offshore Drilling and Production

The process of offshore oil drilling starts with locating offshore reservoirs and using mobile drilling units for the drilling process (usually referred to as Mobile Offshore Drilling Units; MODU). In general, once the temporary job of drilling units is over, a permanent offshore platform for the exploitation of oil is installed. Additional phases are well intervention (intervention in the well during drilling or production phase) and abandonment (plug-in of the well when production is permanently finished).

Two typical phases to obtain oil offshore will be shortly described:

• The first phase of the drilling process is carried out in an open hole in which a casing needs to be installed to serve as the backbone of a future production well. This process is followed by drilling to deeper depths, and by continuously adding smaller bore casings until the desired drilling depth is reached. Once the first and the largest casing is put in place and secured with concrete, a marine riser is lowered to provide a link from a well head and a drilling deck on the mobile drilling unit to allow further drilling processes. Below the drilling deck, as soon as it is possible, a blowout preventer (BOP), a mechanical device in the form of a specialized valve used to seal a well to prevent blowouts, should be installed. A mud circulating system is used to remove cuttings from the well, and to assure sufficient pressure to stop the uncontrolled influx of crude oil and gas in the system during drilling, as pressure can be adjusted to the specific conditions by a variation in the drilling fluid density (a typical water-based drilling mud contains a clay, usually bentonite, to give it enough density and viscosity to carry cutting chips to the surface, as well as a mineral such as barite, i.e., barium sulfate, to increase the weight of the column enough to stabilize the borehole. While drilling fluid, mud travels from the surface all the way downhole and back to its initial point). In case of primary control loss resulting from a sudden increase in the formation pressure or a loss of circulation, it is necessary to seal off the well by some other means to prevent an uncontrollable flow or blowout of fluids using a blowout preventer (BOP) [19], which can create a seal around the drillpipe, or in emergencies, cut the drillpipe and seal off the hole. The two most used types of blowout preventer are Ram or Annular, depending on their design.
• The oil, water and gas sometimes travel from the reservoir to the surface through the production pipe under their own pressure (natural drive when a nozzle can be used to control pressure in the well) or if reservoir pressures are low, artificial lift is employed using in-well or seafloor pumps and is sometimes accompanied with in-well heating and/or gas lift systems. When the drilling phase is over, production starts when a production pipe is installed into the well and when the drilling fluid is removed. This phase is performed from a permanent production (exploitation) platform.

The most common types of offshore drilling units are Jack-up rigs (standing on legs secured to the ocean floor, they are used for the drilling of shallow wells in shallow water), Semisubmersible platforms (massive floating vessels for drilling with massive columns that are secured to large pontoons) and Drillships (an alternative to semisubmersibles which can change their drilling location more easily).

Aside from the problems caused by wells with inadequate blowout prevention measures, further problems that can result in an accident can be caused by the stability of the platform [20,21,22,23] or the leakage of flammable fluids.

2.2. Protection

2.2.1. Well Protection and Control

In the offshore oil and gas industry, barriers, in the sense of the Norwegian technical standard NORSOK D-010: “Well integrity in drilling and well operations”, are usually used to protect a well against blowout. Blowout, the uncontrolled release of crude oil or natural gas from a well, is the most frequent cause of accidents in the offshore oil and gas industry. The majority of blowouts have occurred during the drilling phase (also during well operations such as wireline or workover) but a smaller number of accidents have also occurred in the production phase. Usually, two independent barriers with hydraulic and mechanical elements should be placed, according to the NORSOK D-010, to prevent blowouts [24]. In the final instance, most of the blowouts can be prevented using specific pressure control equipment or locating the blowout preventer on the seabed or between the riser pipe and the drilling platform. The blowout preventers contain hydraulic-powered cut-off mechanisms to stop the flow of hydrocarbons in the event of a loss of well control. Basically, a blowout preventer is a specialized valve or a similar mechanical device used to seal, control and monitor oil and gas wells to prevent blowouts and the uncontrolled release of crude oil or natural gas from a well. The blowout preventer generally consists of three sets of rams, two of which are blind rams to contain the well fluid from flowing out, the third being a shear ram that can sever the drill string. A shear ram is deployed only in extreme cases when the blind rams are unable to stop the flow.

The common types of blowouts are:

• Shallow gas blowouts during drilling: Shallow gas is the accumulation of natural gas at an abnormal pressure, which may exist in shallow sediments below the seabed. Gas can blow out unexpectedly during well drilling and can pose a great hazard to drilling safety, especially in the early phase when a blowout preventer has not yet been installed.
• Surface blowouts during drilling: Blowouts can eject the drill string from the well and the force of the escaping fluid can be strong enough to damage the drilling rig. In addition to oil and gas, the output of a well blowout might include water, drill fluids, mud, sand, rocks and other substances. It should be prevented in the final instance by using the blowout preventer.
• Subsea blowouts during drilling: the two main causes of a subsea blowout are failures of the equipment that form barriers and well underbalance with reservoir pressure; the blowout preventers can be used in such cases to contain the blowout but not always.
• Producing well blowouts during well interventions: Well interventions using wirelines or workover equipment are necessary for servicing the subsurface isolation valves or the subsurface equipment such as pumps, well flow management, wax deposits removal, use of diagnostic tools, etc. Loss of well balance may result in an uncontrolled flow of hydrocarbons through the well and their release to the surface. In most cases, such blowouts can also be contained using blowout preventers.
• Underground Blowouts: An underground blowout is a special situation where fluids from high-pressure zones flow uncontrolled to lower pressure zones within the wellbore. Usually, this is from deeper, higher pressure zones to shallower, lower pressure formations. There may be no escaping fluid flow at the wellhead. Such types of accidents cannot be contained using blowout preventers. The formation(s) receiving the influx can become over-pressured and fractured, potentially jeapordizing future drilling plans in the vicinity being reconsidered.

The general philosophy to control blowouts is that there must be a minimum of two independent barriers preventing the release of well fluids to the atmosphere (this idea is further developed in NORSOK D-010) [25]. Basically, the overbalance from the drilling fluid is the primary barrier and the blowout preventer with the casing string comprises the secondary barrier during well construction but many variations exist. The focus of the standard is well integrity, where this term is defined as the “application of technical, operational and organizational solutions to reduce risk of uncontrolled release of formation fluids throughout the life cycle of a well”. If an element from the primary or secondary barrier fails, the other barrier should be intact and must be completely independent to prevent blowout. Typically, these two barriers, primary and secondary, do not share elements. A possible typical scheme is given in Figure 1, while some practical examples are shown in

Table 1. Typical examples of well protection using primary and secondary barriers.

Life Cycle Phase	Primary Barrier	Secondary Barrier
Drilling	Overbalanced drilling fluid (mud)	Casing cement, casing, wellhead, blowout preventer
Production	Casing cement, casing, packer, tubing, Downhole Safety Valve (DHSV)	Casing cement, casing, wellhead, tubing hangar and Christmas Tree
Intervention	Casing cement, casing, deep-set plug and overbalanced mud	Casing cement, casing, wellhead, BOP
Plug and abandonment 1	Casing cement, casing and cement plug

¹ Permanently sealed (for example, when abandoning a well, for a well with poor casing cement or no access to the last open-hole section, section milling; removal of casing is an alternative method for placing cement in contact with formation to form the permanent well barrier.).

.

In the case of drilling, the primary mechanism of well control is the recognition of pressure fluctuations (‘kick’) due to the presence of gas and an attempt to circulate the mud and remove the gas through the mud degassing system. Other measures come in only if a kick cannot be circulated out and the pressures are stabilized.

If a blowout or leakage of gas occurs, immediate ignition usually results in a pool or jet fire, depending on the type of release. A gas leak or flash-off from a condensate leak, if not ignited immediately, may form a flammable cloud, the ignition of which can lead to an explosion, depending on the level of congestion in the area, causing flame acceleration.

Additional innovative techniques such as a bow-tie analysis can be used to highlight the barriers that will most probably fail [26], similar to the identification of critical safety elements in gas pipelines [27,28]. In the oil and gas sector, risk assessment and management have always been critical due to the possibility of significant accidents associated with the presence of large amounts of flammable hydrocarbons [29,30].

2.2.2. Fire Protection

Significant progress has been made in the last 20 years in the area of fire protection. There are two methods available for determining the design of accidental loads for fires: Consequence-Based (the worst credible event) and Risk-Based [31]:

• The Consequence-Based (worst credible event) approach takes account only of the impact of the maximum credible event for each target, irrespective of its frequency. A thermal load and a blast overpressure are selected for the target protection design (e.g., fire wall and/or blast wall, equipment support, structural protection). The Consequence-Based approach can lead to blast loads that are far too large to be accommodated by by the protective structures.
• The Risk-Based approach considers both the consequences and the frequencies of all the potential fire scenarios that impact on a specific target. It enables the design of structures to resist reasonable thermal loading values and lower explosion loading values, accepting explicitly a certain residual risk of exceeding the thermal or explosion loadings design value.

Protection against fire can be active, passive or a combination of the two. Active fire protection by a firewater system will have, depending on the applied firewater rate, one or more of the risk-reducing effects, such as reducing the probability of ignition, reducing the fire intensity (loading), cooling of the object which it is applied to, extinguishment of fire, etc. Passive fire protection coatings will slow down the heating-up of structural steel, thus preventing event escalation. The effects of active and passive protection can be combined, resulting in optimized fire protection and depressurization with improved safety and reduced costs.

In many cases of offshore oil and gas accidents, fire is caused by the leakage of flammable gases. For example, a boiling liquid expanding vapour explosion is a fireball or explosion caused by the rupture of a vessel containing a pressurized liquid at temperatures above its boiling point and is subject to an external fire. As long as there is liquid present in the vessel, and the liquid space is exposed to fire, the liquid is brought to the boil with a corresponding increase in the vessel pressure. The process safety valve may operate but it can only hold the vessel pressure at the process safety valve set value by chattering. Meanwhile, the liquid level begins to drop as the material is lost through the process safety valve. When the vapour space of the vessel becomes exposed to fire, the ultimate yield stress drops to a level below the applied stress in the vessel resulting in vessel rupture. Since the remaining liquid is at its boiling point at the process safety valve set pressure, it rapidly expands into a fire ball with intense surface heat flux. Further damage can also be caused by vessel rupture with a fuel-air explosion, fragmentation of the vessel and ejected fragments. In general, processes in a pressure vessel system affected by fire can include:

• Heat transfer by thermal radiation and convection from the fire onto the vessel shell, the surface of fire protective coating, the thermal insulation or the protective shield (if applied);
• Heat transfer through the fire protective coating, the thermal insulation or the protective shield;
• Heat conduction through the vessel shell resulting in time-dependent temperature distribution;
• The reduction in the material strength with rising temperatures;
• Heat transfer by thermal radiation and convection from the inner vessel surface to the vessel contents;
• The thermodynamic equilibrium of the liquid and vapour in the vessel constantly adjusting to changing temperature;
• Variation of the pressure in the vessel due to depressurization counter-acted by the increase in the pressure due to heat input, and the boiling and expansion of the vessel contents;
• A progressive reduction in the yield stress of the vessel wall due to the steadily increasing temperature as long the external heat input persists;
• A progressive increase in the applied stress in the vessel due to the increase in pressure;
• Loss of the material strength of the vessel and vessel rupture with the release of a large mass of flammable vapour at its boiling point and ignited by the fire into a rising fireball;
• Structural effects on the vessel from a sudden release of stored energy at high pressure.

The potential consequences of a boiling liquid expanding vapour explosion event are the over-pressure blast wave that is generated as a result of the rapid expansion of the superheated liquid, a fireball and the thermal effects generated as a result of the rapid combustion of the released flammable material, the potential vessel fragments that may be propelled (projectiles), which may puncture walls, pipes, structures and equipment and further consequences thereof, such as the loss of containment of process components resulting in additional fires and explosions (“domino” effects) as the above consequences may be both near and far afield; injuries and fatalities of plant personnel; and injuries and fatalities of personnel on another facility close to the rig.

Though the risk of a boiling liquid expanding vapour explosion is not tolerable, it is practically impossible to design a vessel rapid depressurization system whose activation could prevent it, as it places a significant load on the flare as well as generating cryogenic temperatures in the pipework that cause embrittlement failures. The vessel and also in some cases the connected pipework carrying flammable fluids, require protection with passive fire protection coatings to prevent boiling liquid from expanding vapour explosions.

The initiating scenarios for fire and explosions to be considered in hazard identification include ignited leaks from pressure vessel failures, atmospheric tank failures, pipework ruptures, flange leaks, valve leaks, instrument fitting failures and leaks from rotating equipment (pumps, compressors, turbines), etc. The root causes of the above may be the corrosion or erosion of material, material fatigue, material failure, process overloads (pressure, temperature), structural overloads, fabrication/installation errors, seismic effects resulting in leaks, dropped objects, ship collisions and extreme weather such as hurricanes, tsunami, etc.

Three aspects of fires are to be considered during offshore accidents:

• The loss of containment, resulting in a fire and the thermal effects on people, equipment and structures;
• Escalation of an initial event resulting in a fire, where the escalating event needs to be prevented and/or vulnerable structures and equipment need to be protected;
• The impact of smoke and toxic combustion products in fires.

The failure of pipework, vessels, equipment and structures exposed to fire depends on the fire load on the target. The parameters affecting the fire loadings include fire intensity (firewater system effectiveness, obstructions to flame), flame spread (flame dimensions, unobstructed/obstructed flame), flame orientation and fire duration (by the effects of depressurization).

Traditionally, pressure vessel protection in designs is provided by the American Petroleum Institute (API) technical standard RP 521, which simplistically states that the vessel and its depressurization system needs to be designed to survive and remain functional for the duration of a fire to a set level of pressure for a set duration, which may be inadequate [32] due to the short estimated time from the start of a fire to the point in time when the applied stress exceeds the vessel strength and the vessel ruptures. The vessel requires a fire protection coating in order to carry out all actions required on the rig to save the lives of personnel working on it.

It should be noted that the scope of the European pressure equipment Directive and the ATEX Directive for protection against explosions does not extend to offshore oil activities [14]. Instead of the ATEX Directive for protection against explosions, the International Electrotechnical Commission System for Certification to Standards Relating to Equipment for Use in Explosive Atmospheres (IECeX) should be used in Europe.

3. Analysis of the Largest Offshore Oil and Gas Accidents

Operational conditions of industrial systems are usually close to steady-state conditions. When an accident happens as a result of a process or operational deviations, it very often escalates quickly, and the control systems have to respond to the transient condition promptly with corresponding supporting actions from operating personnel.

This section provides an overview of the largest offshore oil and gas accidents together with analyses of their causes.

3.1. Overview of the Largest Accidents

This section lists the most severe accidents in the history of the offshore oil and gas industry in terms of the number of fatalities or their impact on the environment [33]. It describes them and explains what lessons have been learned from them [34,35,36]. The accidents are listed by the date of occurrence and the list is far from definitive. The described accidents resulted in more than 10 fatalities or if not, the accident caused large environmental damage. The accidents are from 1956 to 2010 and they occurred all around the world.

3.1.1. Qatar 1 Jack-Up Rig

The Qatar 1 jack-up rig incident occurred in the Arabian Gulf in December 1956 with 20 fatalities [37]. The rig collapsed during towing due to the pontoons supporting the platform breaking loose causing the rig to sink.

3.1.2. C. P. Baker Drilling Barge

The C. P. Baker catamaran-type drilling barge accident occurred in the USA’s waters in June 1964 with 21 fatalities [38]. There were two cranes onboard, located on the outboard edge of each hull and eight anchors were used to keep the vessel in position; on the night of the accident, two support vessels were moored next to the C. P. Baker. A shallow gas blowout between the hulls followed by flooding of the drilling barge and by a rapid explosion (the explosion occurred about five minutes after the blowout was first noticed) caused the accident. Water entered the vessel through open doors on the main deck and electric power was lost shortly after. An explosion and fire engulfed the whole vessel, which sank stern-first. Gas continued to erupt and burn for the following 13 h, with limited gas release continuing for the following month. Most survivors evacuated the vessel by jumping from the port bow, after which the two support vessels pulled away from the burning C. P. Baker and began picking up survivors from the water.

The lack of geotechnical information on shallow gas and the lack of regulatory requirements for blowout protection for shallow gas depths were established as the causes of the accident.

3.1.3. Sea Gem Jack-Up Rig

The Sea Gem jack-up rig accident occurred in British waters in December 1965 with 19 fatalities [39]. Material failure caused by corrosion, temperature changes and cyclic loading on the legs was the main cause of this accident. Before the accident, the crew were in the process of relocating the rig to another site approximately 3.7 km away. This process involved lowering the rig onto the surface of the water to allow the platform to be towed to the new site. When the rig was lowered, two of the legs crumpled and broke, causing the rig to capsize (two of the rig’s ten legs failed), with equipment and people sliding off into the sea.

As the radio hut was among the equipment that fell into the sea, the rig never sent out an emergency signal. A nearby ship observed the rig capsizing, and the crew from that ship sent out emergency signals and proceeded to help rescue the crew together with military and civilian helicopters.

3.1.4. Gemini Jack-Up Rig

The Gemini jack-up rig incident occurred in the Gulf of Suez in October 1974 with 18 fatalities [35]. Leg failure caused this accident.

3.1.5. Ocean Express Jack-Up Rig

The Ocean Express jack-up rig incident occurred in Mexican waters in April 1976 with 13 fatalities [40]. A lack of knowledge of vessel stability and severe weather conditions caused the accident. The drilling derrick and an inadequately supported pipe on the deck moved to cause a deck list while the rig was under tow. Partial flooding followed, tow lines were lost and finally, the evacuation capsule sank.

3.1.6. Ekofisk Bravo Production Platform Blowout

The Ekofisk Bravo production platform blowout occurred in Norwegian waters in April 1977 with no fatalities [41,42,43]. The cause of the accident was a blowout that occurred due to human error during maintenance operations (an incorrectly installed downhole safety valve). The accident occurred during a workover on the production well, when production tubing was being pulled while the blowout preventer had not yet been installed. The blowout did not cause fire or loss of life or injuries but it did result in a major oil spill.

3.1.7. Ixtoc I Semisubmersible Drilling Rig

The Ixtoc I semisubmersible drilling rig accident occurred in Mexican waters in June 1979 with no fatalities [44]. Mud circulation was lost during the drilling operation, causing a blowout followed by a fire and an explosion. When circulation stopped, the decision was made to pull the drill string and plug the well. Without the hydrostatic pressure of the mud column, oil and gas were able to flow unrestricted to the surface. The blowout preventer was closed on the pipe but could not cut the thicker drill collars, causing a blowout followed by gas ignition and flames that engulfed the rig, which subsequently collapsed and sank.

3.1.8. Bohai 2 Jack-Up Rig

The Bohai 2 Jack-Up Rig event occurred in Chinese waters in November 1979 with 72 fatalities [36]. The main cause of this accident was the incorrect stowing of deck equipment during severe weather followed by damage to the deck and flooding. Standard tow procedures for adverse weather conditions were not followed (training of the crew on the use of lifesaving equipment and emergency evacuation procedures were insufficient). The accompanying tow boat was unable to perform basic rescue operations of the crew from the water.

3.1.9. Alexander L. Kielland Semisubmersible Accommodation Vessel (Floating Hotel—Flotel)

The Alexander L. Kielland semisubmersible accommodation vessel (floating hotel) accident occurred in Norwegian waters in March 1980 with 123 fatalities [45,46]. The vessel was located on the Ekofisk field in the Norwegian Continental Shelf. Only 89 out of 212 workers survived the accident, and most died by drowning as the platform turned upside-down in deep waters. The main cause of this accident was material fatigue (an undetected fatigue crack in the weld on the subsea part of the platform) resulting in a collapse of the rig leg. It took 14 min from the initial failure of the leg to the eventual capsize. Ineffective command structures in the event of an accident and severe gale force winds (but not a severe storm) significantly contributed to the accident. The initial crack had most probably existed since the rig was built, but will have developed over time, resulting in the remaining steel being 50% damaged at the time of the accident. During the evacuation, only one life raft was launched successfully, while the rest were smashed against the platform by high waves during their launch.

In response to the Alexander L Kielland disaster, command organization was tightened and a clear authority who would order abandonment in case of emergency was identified. These revised command structures, similar to conventional shipping command structures, are now frequently put into use when vessels lose anchorage in storm conditions or when fixed installations are threatened by out-of-control vessels.

The failure to deploy lifeboats led to new legislation regarding on-load release hooks for lifeboats on oil rigs.

One of the major responses to the Alexander L Kielland accident was the introduction of the Norwegian Petroleum Act in 1985, which has undergone significant improvements since its introduction.

3.1.10. Bohai 3 Jack-Up Rig

The Bohai 3 jack-up rig accident occurred in Chinese waters in June 1980 with 70 fatalities [36]. The cause of the accident was a blowout followed by a fire. The blowout preventer failed to seal the well.

3.1.11. Hasbah 6 Jack-Up Rig

The Hasbah 6 jack-up rig accident occurred in the Persian Gulf in October 1980 with 19 fatalities [47]. The accident involved a blowout, including the release of hydrogen sulfide gas. It happened during the drilling of an exploratory well. The blowout was not stopped due to a failure of the blowout preventer. No fire occurred.

3.1.12. Ocean Ranger Semisubmersible Drilling Rig

The Ocean Ranger semisubmersible drilling rig accident occurred in Canadian waters in February 1982 with 84 fatalities [48]. It was one of the biggest rigs built at the time. The rig sank and collapsed due to the fatigue of material during severe weather. Design flaws in the construction of the rig, mainly in its ballast control system and the malfunction of the life rafts associated with insufficient training of the crew for response to accidents resulted in loss of life. No fire occured during this accident.

3.1.13. Nowruz Platform

The Nowruz platform accident occurred in Iranian waters in March 1983 with 11 fatalities [49]. A tanker collided with the Nowruz platform, causing a major release of oil from a collapsed riser and a subsequent fire. The accident occurred during the war between Iraq and Iran and the capping operation was delayed; the Iranians capped the well around a half year after the initial accident. This platform was also attacked by Iraqi planes. Additional accidents occurred in this zone and during the capping operation, an additional nine workers sadly lost their lives.

3.1.14. Glomar Java Sea Drillship

The Glomar Java Sea drillship accident occurred in Chinese waters in October 1983 with 81 fatalities (no survivors) [50]. The cause of the accident was the loss of the stability and integrity of the drillship due to severe weather. The moorings could be released from the central control positions, as long as main power was available but it appeared that the hydraulic system could not be supplied from the emergency switchboard. The severity of the storm was underestimated by senior personnel. Additionally, there were obvious difficulties in communications with the shore and supply vessel, associated with incompatibilities in procedures for the various actions of personnel (infrequent training exercises in embarkation to and the launching of life craft) and the lack of clarity in the command structure. The ship sank.

3.1.15. Enchova Central Fixed Jacket Production Platform

The Enchova Central platform accident occurred in Brazilian waters in August 1984 with 42 fatalities [51]. The blowout was caused by a bad cementing job and was followed by a fire and an explosion. Most workers were evacuated by helicopter or life raft, but 36 died due to a malfunction of the lowering mechanism in one life raft (the raft was first vertically suspended and then fell 20 m), while another six died jumping from the platform into the sea. The platform suffered an additional blowout in 1988 after which there was also a fire and an explosion; however, that incident was without any fatalities. This second blowout occurred during workover to convert one well from oil to gas production. It was followed by a fire which lasted around one month while the blowout was alleviated through two wells specially drilled for that purpose. The platform was declared a total loss and after around 18 months it was replaced by a new one.

3.1.16. Piper Alpha Platform

The Piper Alpha production platform accident occurred in British waters in July 1988 with 167 fatalities [52,53,54,55]. Only 61 out of the 226 workers survived the disaster. A fire and an explosion were caused by a condensate pump during general reconstruction, and by a lack of communication to the platform’s crew. This is to date the deadliest accident in the history of the offshore oil and gas industry and was a milestone that reshaped offshore safety legislation and practices. The accident destroyed the entire facility. It took close to three weeks to control the fire.

A leakage occurred from one of the platform condensate pipes on 6 July 1988. A pressure safety valve was removed from compressor A for recalibration and recertification and two blind flanges were fitted onto the open pipework. Pump B tripped during the night and the crew decided to switch to the missing pump A; gas condensate leaked from the two blind flanges which were fitted onto the open pipework. All risers were subsequently ignited by fire and exploded, which was followed by the structural collapse. The crew from the connected platforms saw the fire but did not stop the gas and oil flow from their platforms toward the Piper Alpha platform. Firewalls that would have resisted a fire on the oil platform failed to resist the gas explosions.

Brought on stream in 1976, Piper Alpha was one of biggest piled offshore oil platforms in the UK, representing about 10% of the UK’s total crude production at the time. In addition to crude oil, the offshore platform started producing gas in early 1988 and had three main gas transport risers and another export riser before the accident.

In 1990, the official public inquiry concluded that the initial condensate leak was the result of maintenance procedure failure. The inquiry, which was documented in the Cullen Report [56], was critical of the operator for having inadequate maintenance and safety procedures. Consequently, after the accident the UK Government’s Health and Safety Executive (HSE) was given the responsibility of implementing the recommendations: the introduction of regulations requiring the operator of every fixed and mobile installation operating in British waters to submit a Safety Case, for its acceptance, to the Health and Safety Executive (HSE). Moreover, traditional prescriptive safety legislation was replaced with a more progressive “goal-setting” model (kept in the EU’s offshore safety Directive 2013/30/EU [57]), rather than presenting operators with a fixed checklist of targets that had to be satisfied to meet statutory requirements.

The Piper Alpha tragedy resulted in a cultural shift within the offshore oil and gas industry.

3.1.17. Seacrest Drillship

The Seacrest drillship accident occurred in Thai waters in November 1989 with 91 fatalities [58]. Only 6 out of the 97 crew members onboard were rescued. Poor storm prediction and inadequate weather warnings associated with a possible error in the stability of the ship and a mechanical failure in the anchoring system were the main causes of this accident. It was reported missing on 4 November 1989 and was only found floating upside-down by a search helicopter the next day. The capsizing was believed to have occurred so quickly that there was no distress signal and no time for the crew members to respond to the disaster.

3.1.18. DB 29 Pipeship

The DB 29 pipeship accident occurred in Chinese waters in August 1991 with 22 fatalities [59]. The barge had been laying a pipe for an offshore oilfield in the South China Sea and at the time of its sinking was on passage being towed by the tug. The barge did not have its own propulsion and was overloaded. No fire or explosion was involved in this accident.

3.1.19. Petrobras P-36 Semi-Submersible Floating Production Unit

The Petrobras P-36 floating production unit accident occurred in Brazilian waters in March 2001 with 11 fatalities [60]. A fire and an explosion were caused by overpressure and a rupture in a tank, which caused the leaking of hydrocarbon vapour due to design faults and errors in the activation of equipment. Two sea water pumps were under repaired without measures in place in case of emergency. Inadequate contingency plans and the inadequate training of personnel for dealing with emergency ballast and stability control situations were also identified.

Following this accident, the Brazillian national regulator updated the technical regulations of safety management systems for marine drilling installations and oil and gas production. The new regulations established seventeen management practices [61] divided into three groups: leadership, personnel and management. In general, the goals of the new procedure were to establish an objective approach to safety that required operators to document safety, health and environmental procedures. New requirements were introduced demanding that operators (i) document their analysis of the main risks using qualitative methods such as hazard identification, (ii) provide better human training and (iii) prevent accidents of a similar nature from reoccurring [61].

3.1.20. Adriatic IV Gas Production Platform

The Adriatic IV gas production platform accident occurred during drilling operations in the Mediterranean Sea near the Egyptian coast in August 2004 with no fatalities [62]. The gas blowout occurred during drilling operations and was followed by a fire and an explosion; the platform was damaged beyond repair. The fire spread due to unknown reasons and lasted over a week before being brought under control. One positive circumstance was that the production ceased during the drilling operation as a precautionary measure based on a prior appropriate recommendation. Production from the same site resumed, and after less than a year had achieved the same full rate as before the accident.

3.1.21. Mumbai High North Platform

The Mumbai High North production platform accident occurred in Indian waters in July 2005 with 22 fatalities [63]. The facility was one of four bridge linked platforms receiving oil and gas from 11 satellite unmanned platforms with multiple import risers and gas lift export risers, all next to each other. A multipurpose support vessel was completing a diving task when a crewmember was injured. Due to severe weather conditions, it was not possible to use the helicopter, and the injured crewmember was safely evacuated to the platform. During the manoeuvre, the support vessel struck several marine risers which caused a gas leakage followed by a fire and an explosion because the fluid flow in the risers was not contained by emergency shutdown valves. The destructive fire lasted around two hours and nearby platforms were severely affected by heat radiation. India did not have any kind of regulatory body for offshore oil and gas but after this accident it started to collaborate with the USA (taking advantage of its extensive experience) to develop appropriate regulations.

3.1.22. Usumacinta Jack-Up Rig

The Usumacinta drilling jack-up rig accident occurred in Mexican waters in October 2007 with 22 fatalities [64]. A collision due to the severe weather conditions caused a release of gas. Subsequently, the subsea valves of wells were closed to stop the leakage of oil and gas, but unfortunately the valves had been damaged in the collision and some leakage continued after these safety valves were closed. This resulted in the evacuation of 81 workers. Later, a spark from containment work caused a significant fire which was contained after few hours, but a second fire caused immense damage to the platform, including the collapse of its derrick and severe damage to the cantilever deck and connecting bridge. The life rafts were not structurally strong enough to handle the weather conditions; this fault was one of the direct causes of the severe loss of life. A total of 56 days elapsed between the initial collision and the regaining of complete control of the well. The platform was not properly designed for horizontal motion, and this was the primary cause of this accident.

3.1.23. Montara Production Platform

The Montara production platform accident occurred in Australian waters in August 2009 without any fatalities. A major oil spill and fire resulted from the blowout of the Montara oil well, which was caused by the failure of well cement and lasted 10 weeks. The blowout preventer had not been not installed. The West Atlas drilling rig, temporarily connected by bridge to the Montara platform, was completely burnt down and had to be dismantled for scrap.

The inquiry into the causes of the Montara accident found significant problems caused by the complicated arrangement where powers were split between regional and national authorities. This accident led to changes in Australian offshore regulations for oil and gas.

3.1.24. Macondo Deepwater Horizon Semisubmersible Drilling Rig

The Macondo Deepwater Horizon semisubmersible drilling rig accident occurred in the USA’s waters in April 2010 with 11 fatalities [65]. Bad cementing work (concrete at the bottom of the well did not seal off hydrocarbons in the formation) caused a blowout followed by a fire and an explosion. Further, the blowout preventer was inadequately designed (single-blind shear ram, unable to cut through tool joints). The crew also misinterpreted the test, which showed that the oil and gas arrived through drilling pipes toward the surface. Finally, the well blew out and spilt over 4 million barrels of crude oil, causing huge environmental damage. Moreover, methane gas was released from the well under high pressure, shot up and out of the drill column, expanded onto the platform and then ignited and exploded (the fire subsequently engulfed the platform). The well was declared sealed after 153 days.

This accident has had a huge impact on the improvement of oil and gas offshore regulations worldwide.

3.2. Main Causes of the Offshore Accidents and Uncertainties around Their Origins

3.2.1. Overview of the Main Causes of the Accidents

Table 2. Short overview of the presented offshore oil and gas accidents with their causes.

	Type	Description of the Cause	Fire	Number of Fatalities
1. Qatar 1 jack-up rig	Jack-up rig	Collapsed during tow	No	20
2. C. P. Baker	Drilling barge	Blowout	Yes	21
3. Sea Gem	Jack-up rig	Material failure	No	19
4. Gemini	Jack-up rig	Material failure	No	18
5. Ocean Express	Jack-up rig	Vessel stability	No	13
6. Ekofisk Bravo	Production platform	Blowout	No	0
7. Ixtoc I	Semisubmersible drilling rig	Blowout	Yes	0
8. Bohai 2	Jack-up rig	Collapsed during tow	No	72
9. Alexander L. Kielland	Semisubmersible accommodation vessel (floating hotel)	Material failure	No	123
10. Bohai 3	Jack-up rig	Blowout	Yes	70
11. Hasbah 6	Jack-up rig	Blowout	No	19
12. Ocean Ranger	Semisubmersible drilling rig	Material failure	No	84
13. Nowruz platform	Production platform	Blowout	Yes	11
14. Glomar Java Sea	Drillship	Vessel stability	No	81
15. Enchova Central	Fixed jacket production platform	Blowout	Yes	42
16. Piper Alpha	Production platform	Error during maintenance	Yes	167
17. Seacrest	Drillship	Vessel stability	No	91
18. DB 29	Pipeship	Collapsed during tow	No	22
19. Petrobras P-36	Production floating unit	Error during maintenance	Yes	11
20. Adriatic IV	Gas production platform	Blowout	Yes	0
21. Mumbai High North	Production platform	Collision	Yes	22
22. Usumacinta	Jack-up rig	Collision	Yes	22
23.Montara	Production platform	Blowout	Yes	0
24. Macondo Deepwater Horizon	Semisubmersible drilling rig	Blowout	Yes	11

gives a short overview of the accidents briefly described above in this review article.

Of the 24 listed accidents, 12 had an associated fire, i.e., 50%. Almost every blowout resulted in a fire; fires also occurred during the two collision accidents (both associated with gas leakage) and in one case a fire occurred during maintenance (also due to leakage of gas). Collapses during towing, collapses due to material fatigue or problems in stability usually do not result in fire (because gas leakage is avoided).

The main causes of the disasters can be approximately classified into the seven broad categories outlined in

Table 3. Main causes of offshore oil and gas accidents.

1.	Severe Weather
2.	Procedural failures (procedures not followed or inadequate, incompatibilities in procedures, communication failures, ineffective command structure during the accident, inadequate weather warnings, inadequate contingency plans)
3.	Human factors (lack of training, inexperienced personnel, lack of knowledge of procedures or inability to respond in emergency)
4.	Control system failure, including loss of well control and safety critical equipment maintenance faults
5.	Mechanical failures
6.	Design flaws
7.	Escape, evacuation and rescue failures

.

The above types of the causes versus the number of accidents where they occurred are summarized in

Table 4. Overview of main causes of the accidents.

	Categories as Given in Table 3
Accidents as Listed in Table 2	1	2	3	4	5	6	7
1. Qatar 1 jack-up rig					●
2. C. P. Baker				●
3. Sea Gem					●
4. Gemini						●
5. Ocean Express	●						●
6. Ekofisk Bravo		●	●	●
7. Ixtoc I semi			●	●	●
8. Bohai 2		●			●
9. Alexander L. Kielland	●	●
10. Bohai 3				●
11. Hasbah 6				●
12. Ocean Ranger	●	●		●		●	●
13. Nowruz platform			●
14. Glomar Java Sea	●		●
15. Enchova Central				●
16. Piper Alpha	●	●				●	●
17. Drillship Seacrest	●	●					●
18. DB 29		●
19. Petrobras P-36		●	●	●
20. Adriatic IV
21. Mumbai High North	●	●	●				●
22. Usumacinta	●			●	●
23.Montara		●		●
24. Macondo Deepwater Horizon				●			●
Σ	8	10	6	11	5	3	6
% of cause present in the 24 incidents	33.3%	41.6%	25%	45.8%	20.8%	12.5%	25%

. More than one of the main causes in Table 4 occurred at the same time in a considerable number of accidents. Table 4 also indicates that there is no single cause for a major incident, but a combination of causes, some latent and each contributing to the incident escalation sequence (the chain of events [66]).

From the reports of accidents, it is not always possible to make a distinction among causes; for example, it is not always clear if a procedural failure occurred or if human factors were predominant, etc. Moreover, sometimes the cause was unclear, as in the Adriatic IV accident.

Failure of well control and procedural issues are the dominant causes of accidents.

3.2.2. Uncertainty Regarding the Main Causes of Accidents

To analyze the accidents, let us suppose that we observed 10 devices and that 2 such devices had failures during the certain time interval resulting in a probability of occurence A = 2/10 = 1/5, which can be defined as a proportion by category, p. Similarly, if in the group of 10 different observed devices, we noticed 3 failures, the probability of failure B = 3/10. For the third group of 8 devices, we noted 1 failure, resulting in a probability C = 1/8. The average probability of failure can be calculated as the total number of failures divided by the total number of observed devices; (2 + 3 + 1)/(10 + 10 + 8) = 6/28 = 3/14, meaning that in total we observed 6 failures on 28 devices, which can be defined as a pooled proportion, P₀. The further size of the confidence interval where the probability to obtain the same result is governed by β-distribution (in probability theory and statistics, the β-distribution is a family of continuous probability distributions defined on the interval [0, 1]), where the confidence interval is always narrower for average cases than for every single observed case, because more information produces lower uncertainty (If we observe all devices and not only a random subset, the uncertainty would be zero).

In this section, the fluctuation of the total number of accidents in the identified seven categories (given in Table 3) of the main cause of accidents is analyzed using the exact confidence limits of binomial data [67,68]. The total numbers of accidents in the seven categories are summarized in

Table 5. Overview of the main causes of the accidents, where p represents the proportion by category.

		Categories as Given in Table 3
Y (Category) 1	Pooled	1	2	3	4	5	6	7
k: Number of “hits”	49	8	10	6	11	5	3	6
N: Number of trials	168	24	24	24	24	24	24	24
p = k/N	0.292	0.333	0.417	0.250	0.458	0.208	0.125	0.250
Lower Confidence Level—LCL	0.234	0.178	0.246	0.115	0.282	0.086	0.035	0.115
Upper Confidence Level—UCL	0.355	0.521	0.603	0.435	0.642	0.389	0.292	0.435

¹ Categories of accidents from Table 3.

.

To estimate the uncertainty of the input data of Table 5, which represents a proportion p = k/N, the exact confidence limits for the estimated probabilities were computed.

Let k represent the number of “hits” in n independently identically distributed “Bernoulli” trials. The number of “hits” has a binomial distribution with parameters p and n. Given the number of “hits” k, we want to find, with the given probability, the confidence interval of p = k/N, which is represented by the interval [LCL, UCL]. For example, for Category 1, p = 8/24~0.333 and the exact confidence limit identified for the given probability of 90% is [0.178–0.521]. We can see that the resulting interval is wide, as the uncertainty of this example is large. This is because the analysed dataset is limited (N = 24 accidents). It can be commented that given 8 “hits” in 24 “trials”, there is a 90% probability that the proportion k/N is between 0.178 and 0.521. As we only have 24 observations (i.e., accidents), the computed confidence interval is relatively wide. Although it seems to be insufficient, it is fortunate that such accidents are rare but unfortunately very often with huge consequences.

More details about the exact confidence intervals for the proportions are summarized in [67,68,69].

From Figure 2 we can see that all confidence intervals touch the green horizontal line, which represents the pooled proportion P₀ = 49/168 = 0.292. Thus, it seems from Figure 2 that the pooled proportion P₀ = 0.292 can represent the proportions of all seven analysed categories. We can test this visual observation statistically [67,68]. Let H₀ denote the hypothesis that the proportion between the number of “hits” and the number of trials is the same in all categories: P₀ = (Total number of “hits”)/(Total number of trials). We want to investigate whether H₀ is true, as the P-Value of the test was 0.139 and the given significance level was 0.05 (The probability that the test is false is typically 0.05 [67,68]). As a resolution, the observed counts are consistent with the hypothesis H₀ at the given significance level and H₀ cannot be rejected since the evidence against H₀ is weak. It can be concluded that there is no evidence of a difference between the categories of the main causes of accidents. Thus, according to the results of the statistical testing, the fluctuations of proportions of the analyzed seven categories, which are presented in Figure 2, can be understood as random for the analyzed dataset with the N = 24 incidents. Of course, the situation could be different if the number of analyzed incidents was increased. Thanks to correctly implemented safety standards, we should acknowledge the fact that the number of incidents is limited, as we analyzed very reliable technical components (offshore oil and gas platforms).

4. Lessons Learned from Accidents and New Updated Regulations

During recent years, to avoid offshore spills of hydrocarbons with cataclysmic results, increasing pressure has been put on public administrative authorities and agencies worldwide to enact all possible measures to increase the overall level of safety and to update relevant guidelines and technical standards. Relevant recent changes and updates in the offshore oil and gas industry have also been made in respect to safety-related well integrity issues, blowout preventers—BOPs and capping and containment devices.

Obviously, the recommended procedures ought to be accepted and used around the world. For example, some technical standards are developed on a national level, but in practice, if they are widely accepted by the worldwide industry, informally they are treated as international.

The whole of Europe (the European Union, Norway and the United Kingdom) use a goal-oriented approach, while the United States, Mexico and China use a prescriptive regime for the regulation of oil and gas offshore operations. Some of these domestic regulations are accepted worldwide, at least as a good example of best practices. We will also discuss some issues related to Canada and Australia.

Beside others, the most important working bodies in this sector that follow the European safety approach are the Oil Spill Response Advisory Group—OSPRAG, the International Association of Oil and Gas Producers—IOGP, Step Change in Safety, Oil & Gas UK, etc. On the other hand, the work of the Center for Offshore Safety is based on the American Petroleum Institute—API Recommended Practice 75, and therefore based on American rules. Moreover, the International Association of Drilling Contractors—IADC follows the United States’ philosophy.

4.1. Updated Safety Technologies

The main safety devices for the final defense and containment of spills are blowout preventers (BOPs) and capping devices:

• Blowout preventers—BOPs have improved by providing many new practical solutions, e.g., a new procedure for the access of Remotely Operated Vehicles (ROVs) to subsea control systems is defined more clearly, casing installation, cementing and integrity tests certified by a qualified engineer are required, as well as independent third-party verification of Blind Shear Ram capacity and stack capacity (which includes minimum requirements for ram types, numbers and capability).
• The capping device [70] has the main role in containing hydrocarbon spills and consequently protecting the marine environment before engineers find a way to permanently seal the well. Such devices have been developed and improved by many companies following the Macondo Deepwater Horizon accident from 2010.

4.2. National Legislation

Two main approaches are used in national legislation related to the industry [71,72]:

• Prescriptive: legally required to use an approach similarly to the US, which makes legal requirements explicit through written safety policy to clarify what is required from both dutyholders and enforcement officers but which may need more frequent amendment as a consequence of becoming outdated;
• Goal setting: best practices, objective decision making and a step-by-step challenge approach which is mainly used in Europe and which is more flexibile but can lead to missunderstandings.

4.2.1. Europe

The new Directive 2013/30/EU related to the safety of offshore oil and gas operations was introduced in 2013 in Europe (relevant for the European Union but also for Norway as the member of the European Economic Area (EEA)) to increase the safety of offshore oil and gas operations. The Directive puts forward a goal-oriented approach based on risk assessment, which means that those who fail to follow all well-known and reasonable best practices will be fully responsible for any accidents caused by negligence. In the absence of harmonized technical standards under the 2013/30/EU Directive, a sufficient level of safety should be assured using the best technical regulations that are available worldwide, which need to be listed in an elaborate report on major hazards required for all offshore installations to prevent major accidents (a common format for the form for reporting major accidents exists). The term “major accident” is defined in the 2013/30/EU Directive as an incident with an explosion, fire, loss of well control, a release of dangerous fluids or any other cause that has significant potential to cause fatalities or severe injuries to five or more people or can lead to significant damage of the installation. Moreover, an accident is considered major if it can cause climatic changes or significant damage to the environment. An unfavorable circumstance is that ATEX Directive 2014/34/EU, pressure equipment Directive 2014/68/EU and machinery Directive 2006/42/EC cannot be used because offshore oil and gas activities on mobile drilling units and the equipment installed on them are explicitly excluded from their scope. The exclusion is because drilling ships operate in European water only for a limited time (although even an isolated accident with equipmen under pressure during drilling from an drilling ship in the worst-case scenario can lead to catastrophic consequences through a chain of unpredicted events). This situation has created an obvious gap in safety which needs to be filled in with international pieces of legislation (or by foreign countries) and which further needs to be listed in obligatory reports on major hazards prescribed by the 2013/30/EU Directive. The main concern in Europe is if they could appropriately replace the provision of the relevant European Directives.

Unlike the 2013/30/EU Directive, the three aforementioned mentioned product safety Directives are prescriptive and numerous harmonized technical standards within these Directives exist. Although nonbinding, the application of these standards assures full compliance with the respective Directives.

Additionally, the activities in the petroleum industry in Norway are addressed in the Norwegian NORSOK technical standards and by its Petroleum Safety Authority (PSA/PTIL), an independent government regulator with responsibility for safety, emergency preparedness and the working environment in the Norwegian petroleum industry. Experts from a wide range of Norwegian companies actively participate in the development of international and European standards that define what are safe and economical design and processes. However, the Norwegian safety framework and climate conditions may require their own standards [73] or additions and supplements to international standards and European standards.

4.2.2. United States of America (USA)

The Deepwater Horizon accident in 2010 happened close to the United States’ coast, and had a tremendous impact on its domestic oil and gas industry. Safety regulations and public administrative authorities and agencies have been thoroughly reorganized. The Mineral Management Service (MMS) changed its name to the Bureau of Ocean Energy Management, Regulation and Enforcement (BOEMRE) which is now divided into three new agencies in order to appoint clear jobs:

• The Bureau of Ocean Energy Management (BOEM); responsible for offshore resources;
• The Bureau of Safety and Environmental Enforcement (BSEE); responsible for safety and environmental regulations;
• The Office of Natural Resources Revenue (ONRR); responsible for revenues from energy production.

The USA introduced Workplace Safety Rules in 2010 to increase safety levels related to well integrity, blowout preventers and control systems through Safety and Environmental Management Systems. It is unlikely that any report of major accidents would be acceptable in European waters without following these drilling safety rules.

Moreover, the US Coast Guard plays a significant role in the oil and gas safety regime, and in many cases its decisions have worldwide consequences.

4.2.3. Mexico

Mexico shares a maritime border in the Gulf of Mexico with the United States and because of domestic energy reform, exploration activities have been initiated by various companies. Issues of security and environmental impacts are crucial: since the accident, through the Agencia de Seguridad, Energía y Ambiente (ASEA) founded in 2014, Mexico has imported the federal legislation ruling the National Agency for Industrial Safety and Environmental Protection of the Hydrocarbons Sector, much of which was covered in the regulatory framework set up by the United States institutions after the accident.

4.2.4. United Kingdom (UK)

The United Kingdom’s Health and Safety Executive (HSE), the Department of Energy and Climate Change (DECC) and the Maritime and Coastguard Agency (MCA) jointly formed the Oil Spill Response Advisory Group (OSPRAG) to review offshore safety in its domestic waters.

The United Kingdom applies goal-oriented European rules (the United Kingdom has left the European single market but the described rules will apply until further notice).

4.2.5. China

China is the second economy of the world, but as reported in [74], its safety culture does not always follow its fast growth. China has a strict command and control approach with prescriptive rules which sometimes are not fully developed or clear. There are noticeable gaps and overlaps in jurisdiction among different levels of central and local government. China has been attempting to introduce risk assessment elements into its offshore legislation through the so-called resilience approach, which can improve the system response in some cases.

4.2.6. Australia

In Australian waters in 2009, a blowout was caused by the failure of cement at the Montara oil well. This was similar to the aforementioned Deepwater Horizon accident; the blowout preventer did not work, but in the case of the Montara, the device had not even been installed.

In Australia, the National Offshore Petroleum Safety and Environmental Management Authority (NOPSEMA) takes care of occupational health and technical safety including wells and pipelines, and the protection of the offshore environment. On the other hand, the National Offshore Petroleum Titles Administrator (NOPTA) takes care of greenhouse gas emission.

4.2.7. Canada

Canada has introduced a new regulation to increase technical safety related to the petroleum industry but also to nuclear installations. Liability for companies has now increased to CAD 1 billion, while liability for the fault will remain unlimited. The provinces of Newfoundland, Labrador and Nova Scotia updated their acts accordingly.

4.2.8. Brazil

The Brazilian National Petroleum Agency (ANP) issued a new regulation “Technical Regulations of Operational Safety Management System for Marine Drilling Installations and Oil and Natural Gas Production”. This requires a full safety management system, making overall safety the main driving factor in design. The new regulations established seventeen management practices divided into three groups; leadership, personnel and management. In general, the goals of the new procedure were to establish an objective approach to safety that required operators to document safety, health and environmental procedures. They required operators to document their analysis of the main risks using qualitative methods such as hazard identification, at a minimum helping to create more regulation, provide better human training and prevent accidents of a similar nature from reoccurring.

4.2.9. India

Offshore oil and gas safety is regulated by the Oil Industry Safety Directorate (OISD) of India, in the wake of Mumbai High North disaster in 2005. India has a set of 34 Standards covering safety in exploration and production, including well integrity and control, well operations and elements of a safety management system. A standard for emergency requirements and evacuation specifically addresses escape, evacuation and rescue issues.

5. Conclusions

The performed review reveals that around half of the largest offshore accidents are associated with fire; either a fire caused it, or it occurred as a consequence in a chain of unfortunate events. Moreover, the analysis shows that around 40% of human lives are lost in accidents in which a fire occurred.

Fires were present in almost all accidents with a blowout (due to the ignition of released hydrocarbons), while they were not present in accidents that occurred during towing or that were due to the instability of platform (in such cases hydrocarbons are not released into the atmosphere, but they are released into the sea or not released at all). Control system and procedure failures associated with severe weather conditions are usually caused by accidents and the next most numerous are human errors and mechanical failures. Many human lives were also lost during rescue operations.

Major updates in national and international safety legislation occurred after each of the analyzed major accidents, which served as watersed moments for increasing the overall safety levels worldwide in the offshore oil and gas industry.

Useful Links:

-

Oil Spill Response Advisory Group—OSPRAG: www.oilspillresponse.com/news--media/news/upgrade-of-the-osprag-capping-device/ (accessed on 13 October 2021);

-

International Association of Oil and Gas Producers—IOGP: www.iogp.org (accessed on 13 October 2021)

-

Step Change in Safety: www.stepchangeinsafety.net (accessed on 13 October 2021);

-

Oil & Gas UK: https://oguk.org.uk/ (accessed on 13 October 2021);

-

Center for Offshore Safety: www.centerforoffshoresafety.org (accessed on 13 October 2021);

-

International Association of Drilling Contractors—IADC: www.iadc.org (accessed on 13 October 2021);

-

Norwegian Petroleum Safety Authority—PSA/PTIL: www.ptil.no/en (accessed on 13 October 2021);

-

Bureau of Ocean Energy Management—BOEM: www.boem.gov (accessed on 13 October 2021)’

-

Bureau of Safety and Environmental Enforcement—BSEE: www.bsee.gov (accessed on 13 October 2021);

-

Office of Natural Resources Revenue—ONRR: www.onrr.gov (accessed on 13 October 2021);

-

US Coast Guard: www.dco.uscg.mil (accessed on 13 October 2021);

-

Mexican Agencia de Seguridad, Energía y Ambiente—ASEA: www.gob.mx/asea (accessed on 13 October 2021);

-

United Kingdom’s Health and Safety Executive—HSE: www.hse.gov.uk/offshore/index.htm (accessed on 13 October 2021);

-

Australian National Offshore Petroleum Safety and Environmental Management Authority—NOPSEMA: www.nopsema.gov.au (accessed on 13 October 2021);

-

Australian National Offshore Petroleum Titles Administrator—NOPTA: www.nopta.gov.au (accessed on 13 October 2021);

-

Brazilian National Petroleum Agency—ANP: https://www.gov.br/anp/pt-br (accessed on 13 October 2021);

-

Oil Industry Safety Directorate of India—OISD: www.oisd.gov.in (accessed on 13 October 2021);