SPPE User Guide

1

Table of Contents
1.0 Background, Scope, and Purpose ........................................................................................................................ 4
1.1

Background ................................................................................................................................................ 4

1.2

Scope... ..................................................................................................................................................... 5

1.3

Purpose..................................................................................................................................................... 6

2.0

Acronyms and Definitions ............................................................................................................................... 7
2.1

Definitions ................................................................................................................................................. 7

2.2

Acronyms ................................................................................................................................................... 7

3.0

Accessing the SafeOCS Database .................................................................................................................... 8

4.0

Submitting a SPPE Failure Notification ......................................................................................................... 10

5.0

Submit a SPPE Failure Notification through file uploading ........................................................................... 15

6.0

Update and add files to an existing SPPE component failure notification ................................................. 18

7.0

Delete files attached to an existing SPPE component failure notification ................................................... 23

8.0

Detailed Instructions on How to complete the SPPE Component Notification online ................................. 23
8.1 Notification Identification, Operator Data, and SPPE Detail ......................................................................... 24
8.2 SPPE Details Cont........................................................................................................................................... 26
8.3 SSC Details, BDSVs, SSVs and USVs, and SPPE Design Criteria ...................................................................... 28
8.4 SPPE Design Criteria Cont. and Well data ..................................................................................................... 30
8.5 Well data Cont. .............................................................................................................................................. 32
8.6 Corrective Action ........................................................................................................................................... 34

9.0

Investigation and Failure Analysis................................................................................................................. 36
9.1 Failure Causes ................................................................................................................................................ 36
9.1.1 Physical Causes ........................................................................................................................................... 36
9.1.2 Human Factor Causes ................................................................................................................................. 36
9.1.3 Systemic Causes.......................................................................................................................................... 37
9.2 Analysis Overview ........................................................................................................................................ 37
9.3

Failure Cause Known .............................................................................................................................. 37

9.3.1

Example of Failure Cause Known ......................................................................................................... 38

9.3.2

Resources............................................................................................................................................... 38

9.3.3

Closure ................................................................................................................................................... 38

9.4

Root Cause Failure Analysis Required (RCFA) ........................................................................................ 38
2

9.5.1

Physical Evidence.................................................................................................................................... 39

9.5.2

Resources ............................................................................................................................................... 39

9.5.3

Closure .................................................................................................................................................... 39

10.

Compliance ................................................................................................................................................... 40

11.

Capture and Share Lessons Learnt................................................................................................................ 40

12.

Reporting Design and Procedural Changes................................................................................................... 40

APPENDIX 1. DEFINITIONS ........................................................................................................................................ 42

3

1.0 Background, Scope, and Purpose
1.1

Background

Congress has established a National policy of making the Outer Continental Shelf (OCS) available to
development and “subject to environmental safeguards, in a manner which is consistent with the
maintenance of competition and other National needs.” (43 U.S.C. 1332(3).) The Secretary of the
Interior (Secretary) administers the Outer Continental Shelf Land Act (OCSLA) provisions relating to the
leasing of the OCS and regulation of mineral exploration and development operations on those leases.
The Secretary is authorized to prescribe “such rules and regulations as may be necessary to carry out
[OCSLA’s] provisions . . . and may at any time prescribe and amend such rules and regulations as [s]he
determines to be necessary and proper in order to provide for the prevention of waste and conservation
of the natural resources of the [OCS].” BSEE adopts regulations and performs offshore regulatory
oversight and enforcement.
In August 2013, the U.S. Department of the Interior's Bureau of Safety and Environmental Enforcement
(BSEE) and the U.S. Department of Transportation's Bureau of Transportation Statistics (BTS) signed an
Interagency Agreement (IAA) to develop and implement SafeOCS, as a voluntary program for
confidential reporting of 'near misses' occurring on the Outer Continental Shelf (OCS). BSEE and the BTS
entered into a Memorandum of Understanding (MOU) in August 2016 to allow BTS to collect equipment
failure data required under BSEE rules for reporting blowout preventer (BOP) system or component
failures (30 C.F.R.§ 250.730(c)) and safety and pollution prevention equipment (SPPE) failures (30 C.F.R.§
250.803). On October 26, 2016, the BSEE director announced the expansion of the SafeOCS program
beyond near miss reporting to include the confidential collection of equipment failure data pursuant to
regulations 30 C.F.R.§ 250.730(c) and 30 C.F.R.§ 250.803.

Data collected by BTS under the IAA may only be used for statistical purposes and is therefore protected
under the Confidential Information Protection and Statistical Efficiency Act of 2002 (CIPSEA) (44 U.S.C.
§3501 note). This requires the following: a) only summary statistics and data analysis results will be
made available to interested parties and b) micro-data on near miss incidents collected by BTS may not
be used for regulatory purposes. Information submitted under this statute is also protected from
release to other government agencies, including BSEE, Freedom of Information Act (FOIA) requests, and
subpoena.

4

1.2

Scope

This document applies to submissions of safety and pollution prevention equipment failures to SafeOCS
in accordance with 30 C.F.R.§ 250.803. The scope has been expanded to include all American National
Standards Institute, American Petroleum Institute, and American Society of Mechanical Engineers
(ANSI/API Spec Q1 and ANSI/ASME SPPE-1) equipment components:
•

Surface Safety Valve

•

Boarding Shutdown Valve

•

Underwater Safety Valve

•

Surface Controlled Safety Valve

•

Subsurface Controlled Safety Valve

•

Subsea Safety Valve

This document establishes the criteria and provides guidance on:
•

Accessing the SafeOCS data system (Section 3)
o

On-line link to the SafeOCS website

o

Creating a new account

o

Starting the online reporting process

•

Reporting SPPE component failure online (Section 4)

•

Reporting SPPE component failure through file notification (Section 5)

•

Updating and adding files to an existing SPPE failure notification (Section 6)

•

Deleting files attached to an existing SPPE failure notification (Section 7)

•

Detailed instructions on how to complete the SPPE failure notification online form (Section 8)

•

Conducting component investigation plus failure analysis and documentation (Section 9)

•

Reporting supplemental information to support learning (Section 10)
o

•

Communicating information about component failures to appropriate stakeholders

Reporting design and procedural changes (Section 11)
o

Reporting design changes

o

Reporting changes in operating and repair procedures.

5

1.3

Purpose

This document was developed to assist the petroleum and natural gas industry with the completion and
submission of the SPPE failure notification form pursuant to regulation 30 C.F.R.§ 250.803.

Federal regulation 30 C.F.R.§ 250.803 was established to ensure accurate reporting of SPPE systems and
components failure from initial notification; investigation and failure analysis; communication of failure
information and lessons learned; to design and procedural changes.

6

2.0 Acronyms and Definitions
2.1

Definitions

A list of definitions is provided in Appendix 1.

2.2

Acronyms
ANSI
ASME
API

American National Standards Institute
American Society of Mechanical Engineers
American Petroleum Institute

BOEMRE Bureau of Ocean Energy Management, Regulation and
Enforcement
BSDV
Boarding Shutdown Valves
BSEE
Bureau of Safety and Environmental Enforcement
BTS
Bureau of Transportation Statistics
CO2
Carbon Dioxide
ESD
Emergency Shutdown
GOM

Gulf of Mexico

HPHT
H2S
HSE

High Pressure High Temperature
Hydrogen Sulfide
Health Safety Equipment

IOGP
JIP
OEM
PTA
RCFA
RWP
SCSSV
SPPE

International Association of Oil & Gas Producers
Joint Industry Project
Original Equipment Manufacturer
Pressure Transient Analysis
Root Cause Failure Analysis
Rated working pressure
Surface Controlled Subsurface Safety Valve
Safety and Pollution Prevention Equipment

SSCSV
SSSV
SSV
TFL
TSE

Subsurface Controlled Safety Valve
Subsurface Safety Valve
Surface Safety Valve
Through flowline
Temperature Safety Element

USV
WCR

Underwater Safety Valve
Well Control Rule

7

3.0 Accessing the SafeOCS Database
The SafeOCS Reporting System is accessed through the website of the SafeOCS program at
www.safeocs.gov. (Figure 3.1)

Figure 3.1 SafeOCS Webpage

•
•
•

To submit a Well Control Rule (WCR) equipment component failure notification, select the WCR
button on the home page or the WCR Failure Notification tab on the main navigation bar.
To submit a Safety and Pollution Prevention Equipment (SPPE) failure notification, select the
SPPE button on the home page or the SPPE Failure Notification tab on the main navigation bar.
To submit a Safety Event report, select the Safety Event button on the home page or the Safety
Event Report tab on the main navigation bar.

Since data reported to SafeOCS are confidential and protected under the Confidential Information
Protection and Statistical Efficiency Act of 2002 (CIPSEA) (44 U.S.C. §3501 note), a user must register and
create an account in the SafeOCS Reporting System before he/she can submit equipment failure
notifications or safety event reports.

8

To register an account in the SafeOCS Reporting System, select the Register tab on the main navigation
bar of the SafeOCS website (Figure 3.2).

Figure 3.2 SafeOCS Registration page

9

4.0 Submitting a SPPE Failure Notification
Step 1: Login to your SafeOCS account
Provide your Email and Password to login to your SafeOCS account at the Login page for SPPE Failure
Notification submission. (Figure 4.1)

Figure 4.1 SafeOCS login homepage

Step 2: Confirm your agreement to the Confidentiality and Burden Statements
After login, the user is required to read and consent to the Burden Statement and Pledge of
Confidentiality. Check the “I have read…” box and select the Start New Report button to continue
(Figure 4.2).

Figure 4.2 POC and Burden Statement webpage

10

Step 3: Select a mode of submission
SafeOCS offers three ways to submit SPPE component failure notifications: Online, Upload, and Postal
Mail (Figure 4.3). Select “Submit New SPPE Failure Notification” online tab to make a report online.

Figure 4.3 safeocs.gov/sppe/home

11

Step 4: Complete the online SPPE Component Failure Notification form
The selection of the “Submitting New SPPE Failure Notification online” will bring up the SPPE online
form (Figure 4.4) for the user to complete.

Figure 4.4 safeocs.gov/sppe/forms/sppefailureform

Detailed instructions on how to complete the SPPE Failure Notification on-line are provided in section 8.
Please refer to that section, if there are questions about the meaning of or the expected values/entries
for any of the data fields.

12

Step 5: Review, edit the SPPE Failure Notification form before submitting
It is important to review and edit the completed notification form before submitting to correct any dataentry errors. Once a notification is submitted, it will not be available for review or edit and errors made
in data entries can only be corrected by submitting an update to the original notification.
Step 6: Submit the completed notification form
Submit the completed notification form by selecting the “Submit” button (Figure 4.5).
Please note:
•
•
•

Only when the “Submit” button is selected, information entered in the online form is saved to
the SafeOCS database and a BTS reference number is generated for the notification.
If the user closes the online form without submitting it, all information entered in the form will
be lost.
Once a notification is submitted, it will not be available for review or edit by the user.
Corrections to a submitted notification can only be achieved by submitting an update to the
original notification.

Figure 4.5 safeocs.gov/sppe/forms/sppefailureform

13

When a notification is successfully submitted, a message will show on the screen of the SafeOCS website
to inform the user that the notification has been successfully submitted (Figure 4.6). An email of
Acknowledgment of Receipt will also be sent to the reporter’s email account registered with SafeOCS
(Figure 4.7).

Figure 4.6 safeocs.gov/sppeformsubmitted

Figure 4.7 safeocs.gov/sppe acknowledgement of receipt

14

5.0 Submit a SPPE Failure Notification through file uploading
Step 1: Login to your SafeOCS account (Refer to Section 4.0 for details)
Step 2: Confirm your agreement to the Confidentiality and Burden Statements (Refer to Section 4.0 for
details)
Step 3: Select a mode of submission:
Among the three modes of submission (Online, Upload, and Postal Mail), select the link “Upload PDF
Form” or the link “Upload Excel Form” (Figure 5.1).

Figure 5.1 safeocs.gov/sppe/home

15

Step 4: Select and upload completed SPPE failure notifications to SafeOCS
Selecting the link “Upload PDF Form” or the link “Upload Word Form” will bring up an interface to allow
the user to select and upload completed SPPE failure notifications to SafeOCS (Figure 5.2).

Figure 5.2 safeocs.gov/sppe_offline/pdf

Upload Instructions:
•

•
•

“Reporting Operator” in the interface is a required field. If the name of the operator for which
you are submitting a failure notification is not in the dropdown list of the field, please select
“Other” at the bottom of dropdown list and then type in the operator’s name in the pop-up text
field.
“Select File” is another required field. The “Browse” function allows the user to select and
upload only one file at a time. However, multiple failure notifications can be included in one file.
“Date of Event.” is a required field. The purpose of this field is to allow operators to match their
records of failure notifications submitted to SafeOCS.

16

When a file is successfully uploaded, a message show on the screen of the SafeOCS website to inform
the user that notifications included in the file has been successfully submitted (Figure 5.3, with example
case). An email of Acknowledgment of Receipt is also sent to the user’s email account registered with
SafeOCS (Figure 5.4, with example case).

Figure 5.3 safeocs.gov/SPPEformsubmitted webpage

Figure 5.4 safeocs.gov/sppe acknowledgement of receipt

17

6.0 Update and add files to an existing SPPE component failure
notification
Additional information, such as pictures, graphs, detailed descriptions, or updates, can be added to the
record of a notification after the original notification has been submitted. This can be done by using the
Update and Add Files function (Figure 6.1).

Figure 6.1 safeocs.gov/sppe/home

18

To ensure that the additional information is attached to the correct notification, the user must select the
BTS reference number from the dropdown list of the BTS Reference Number field (Figure 6.2) before
clicking on the “Go” button to bring up the file uploading interface.

Figure 6.2 safeocs.gov/sppe/home

Please note:
•

To protect confidentiality, a registered user will only be able to see the BTS reference numbers
of the notifications he/she submitted, unless he/she is authenticated to be the operator’s
representative by a duly authorized official of the concerned operator. An operator’s
representative will be able to see BTS reference numbers of all notifications submitted under
the operator’s name and add additional information to those notifications.
19

When the “Go” button is selected, the file uploading interface will be brought up (Figure 6.3). Clicking on
the “Add files” button in the interface will bring up the libraries folder to allow the user to select files in
any folder/directory that is accessible to the user’s computer. (Note: Multiple files maybe selected.)

Figure 6.3 safeocs.gov/sppe/forms/SPPE_attachments

20

When the selection is done, the selected files will be listed in the file upload interface (Figure 6.4). From
the list, click on the “Upload” button to upload a selected file to SafeOCS. Select the “Cancel” button to
delete a file from the list.

Figure 6.4 safeocs.gov/sppe/forms/SPPE_attachments

21

Once a file is uploaded, the user can remove a file that has been added to the record of a notification if
he/she desires so (Figure 6. 5).
By selecting the delete button, all uploaded files will be listed in the interface and can be deleted
(removed) from the records of the notification later.

Figure 6.5 safeocs.gov/SPPE_attachments

When all the selected files have been uploaded, clicking on the “Done” button will return the user to the
interface of the Update and Add File function.

22

7.0 Delete files attached to an existing SPPE component failure
notification
The Update and Add Files function can be used to delete files that have been attached to the record of a
notification. Here are the steps:
•

At the page of the Update and Add Files function, select the BTS Reference Number of the
notification from which an attached file is to be deleted and then select “Go”, which will bring
up a page similar to figure 6.5 and with a list of all the files attached to the notification.

•

Select the “Delete” button associated with a file to delete the file from the database.

•

Select the “Done” button to return to the interface of the Update and Add Files function.

8.0 Detailed Instructions on How to complete the SPPE Component
Notification online
Detailed instructions and information on completing the WCR Failure Notification Form are provided
below. The failure notification form should be completed as much as possible (fields marked with an
asterisk* are mandatory). After completing the form, press the ‘Submit’ button to save the data into the
SafeOCS database. Data entered into the form will not be saved if the reporter leaves the webpage
without pressing the ‘Submit’ button.

23

8.1 Notification Identification, Operator Data, and SPPE Detail

24

SafeOCS database will automatically assign each submission with a unique identifier (BTS reference
number). The system will also provide an optional data field for the operator/company-assigned
reference number, if applicable.
Date of Failure- This should indicate the date the SPPE component failed or did not perform per
specification. This date will be used to access the submission in order to add or update the report.
Operator Company Name- Select the company name from the supplied dropdown list. If the name of
the operator for which you are submitting a failure notification is not in the dropdown list of the field,
please select “Other” at the bottom of dropdown list and then type in the operator’s name in the popup text field.
Complex ID- That is a series of numbers that corresponds to a particular production platform or group of
platforms. The complex I.D. is a 1 to 5-digit number.
Structure Number- This is a series of numbers that corresponds to the area or block number. Area and
block have multiple structures. The structure I.D. is usually a 1 to 2-digit number.
API Well Number, if applicable- API number provided by the operator. The API is usually a 12-digit
number
Company Name Submitting Form, if different than the Operator- Name of the company submitting the
notification.
Type of Company Submitting Form (select one)- If the production contractor is not the submitting agent,
select other and type in the company involved with the failure in the text field. (Service, OEM,
Certification, etc.…).
Equipment manufacturer- Free text field to input the principal agent in the design, fabrication and
furnishing of original safety and pollution prevention equipment.
Model- A free text field to enter the equipment model number of the defective component.
Serial Number- Free text field to enter the unique identifying serial number of the component.
Working pressure- A free text field to enter the standardized working pressure rating. Working pressure
should be in pounds per square inch gauge (psig) units. (Ex. 5,000 psig)
Nominal size- A free text field to enter the whole and fractional size for the equipment. Nominal size
should be in inches. (Ex. 2-9/16”).
Provide a narrative describing any redress history for the SPPE that failed- A free text field to include any
activity involving the replacement of qualified parts. Note: should include the new installation dates and
scope of repair work, if any.

25

8.2 SPPE Details Cont.

26

Please provide the date and a narrative description of the last SPPE test- A free text field to provide a
description of the last test that was performed on the failed equipment including the date, criteria,
outcome of test, and functional parameters prior to this failure.
What was the certification status of the failed SPPE (select one)- Newly installed equipment should be
certified pursuant to ANSI/API Spec Q1 or other Quality Assurance Program. This certification is
intended for companies that manufacture equipment or components used in oil and natural gas
production. Certified equipment installed prior to the inception of ANSI/API Spec Q1 2013 should
choose ANSI/ASME SPPE-1, if not certified, then select “Non-Certified SPPE.”
Was the SPPE previously repaired, remanufactured, or subject to hot work offsite? – Select YES/NO to
indicate if Hot work was performed offsite in a shop and not on the platform. Please provide details in
the redress history box.
What type of tree was associated with the SPPE that failed? – Dry Tree; Subsea Tree.
Which SPPE component failed? – Select the components involved in the reported failure. Note: the valve
gate/seal is not the same as the valve body.
What was the type of SPPE that failed? – Select the type of equipment that was involved in the reported
failure.

27

8.3 SSC Details, BDSVs, SSVs and USVs, and SPPE Design Criteria

28

What was the type of SSSV that failed? – Select the type of SSSV that was involved in the reported
component failure.
Was the SSV formerly a pump through type tubing plug? – Select YES/NO to record whether a pump
through type tubing plug used as a SSV.
If the SSSV that failed was Subsurface Controlled (SSCSV), what type was it? (Select One) – Velocity;
Tubing-pressure; Not Applicable.
What was the service class of the SSSV that failed? (Select One)- Select the service class of the control
system involved in the failure.
What was the service class of the BDSV/SSV/USV? (Select One)- Select the service class of the wellhead
valve assembly involved in the failure.
If the SPPE that failed was a BSDV, which type was it? (Select One)- Automatic; Manual BSDV; Not
Applicable. If it was not a Boarding shutdown valve, then choose N/A.
Was the SPPE designed for High Pressure High Temperature (HPHT) conditions? – Select YES/NO to
record the pressure and temperature conditions. Note: HPHT environment means when one or more of
the following well conditions exist: (1) The completion of the well requires completion equipment or
well control equipment assigned a pressure rating greater than 15,000 psia or a temperature rating
greater than 350 degrees Fahrenheit; (2) The maximum anticipated surface pressure or shut-in tubing
pressure is greater than 15,000 psia on the seafloor for a well with a subsea wellhead or at the surface
for a well with a surface wellhead; or (3) The flowing temperature is equal to or greater than 350
degrees Fahrenheit on the seafloor for a well with a subsea wellhead or at the surface for a well with a
surface wellhead.
Was the SPPE designed for Artic Conditions? – Select YES/NO to record whether the equipment was
designed for extreme cold weather conditions. (Not applicable in the GOM).

29

8.4 SPPE Design Criteria Cont. and Well data

30

Please specify the most extreme exposure conditions for which the SPPE was designed to function. - Five
fields to record the pressure, temperature, rate, units, and other operating conditions of the equipment.
Note: Gas rate= Thousand Cubic Feet (MCF) or liquid rate. Liquid rate= barrels per day or velocity.
Velocity= ft./sec (feet per second). Please also include water depth and other environmental conditions.
What was the type of well associated with the SPPE failure? – Select Production or Injection to specify
the well type.
Was the well shut in at the time of failure? – Select YES/NO to record the well operating status prior to
the failure. If the well was operating prior to the failure, select no. Note: Yes, if the well was rendered
inoperative prior to actual test. E.g.- Shut in for weather related incident or for production reasons.
Note: Do not select yes if the well was rendered inoperative due to the failure or performing a test.
What was the last Well Test Rate? – Free text field to enter the last test rate. Note: The gas must be
converted to Barrel of Oil Equivalency (BOE)/day and added to the oil rate for total BOE/day rate.
What was the date of the last Well Test? – Free text field to enter the last well-rate test date.
What were the Environmental Conditions? – Sand; H2S; CO2; or Other. Select the external environmental
operating condition. If the environmental conditions for which you are submitting a failure notification is
not listed, please select “Other” and then type in the condition in the text field.
Pressure and Temperature – Two drop down boxes; the first to select the surface pressure and
temperature and the second to select the bottom hole pressure and temperature. Note: If the bottom
hole lacks a gauge, then refer to the most recent pressure transient analysis (PTA) or bottom hole
pressure survey available.
Under what conditions was the SPPE activated at the time of the failure? – Select the conditions
involved in the failure being reported.
Description of the failure – Free text field to provide adequate information to the conditions and nature
of the failure. Note: Please provide a description of the damage parts and include the leakage rate or
pressure of build up if it was over the limit.

31

8.5 Well data Cont.

32

Specify how many cycles or hours were completed since the last preventative maintenance – Number
field to input the amount of cycles or hours completed.
Provide a narrative describing the general configuration of the SPPE and hydrocarbon flow path. – Free
text field that should clearly describe the pipe arrangement, the total number of SPPE valves, the
sequence, and the flow path from the completion well to the production manifold. Note: If it is a
Boarding shutdown valve, describe the number of wells and the isolation valve arrangement for each of
those wells.
What factors contributed to the failure? – Select the equipment behavior, omission, event, or deficiency
that sets the stage for the failure. If the contributing factor for which you are submitting a failure
notification is not in the field list, please select “Other” at the bottom and then type in the cause in the
supplied text field.
Preliminary Root Cause. -Select the process or events that lead to the failure. If the preliminary root
cause for which you are submitting a failure notification is not in the list, please select “Other” at the
bottom and then type in the root cause in the supplied text field. Note: If the choice is ‘wear and tear’
please refer to the SPPE Details section and include the installation date and shelf life of the failed
component in the redress history narrative box.
Is a formal Root Cause and Failure Analysis recommended? – A formal Root Cause Failure Analysis
(RCFA) includes the operator, OEM, and an inspection of the failed parts. Select yes, if the component
required a RCFA.

33

8.6 Corrective Action

34

What corrective action was taken related to the SPPE failure? - Select the corrective action taken on the
platform to place the equipment back into operation. If the corrective action for which you are
submitting a failure notification is not part of the list, please select “Other” at the bottom and then type
in the action taken in the supplied text field.
Where was the corrective action accomplished- Select the facility that performed the corrective action
on the equipment. “Other” maybe selected to input the corrective action completed in the supplied free
text box that is not included in the provided list.
If the corrective action was accomplished on location, who conducted the corrective action? – Select the
entity that performed the corrective action.
Was the failure associated with an HSE incident? – Select YES/NO to record if this was a Health Safety
Equipment (HSE) incident. If Yes, select the type of incidents. “Other” maybe be selected to specify the
type of incident in the supplied text box that is not included in the provided list.

35

9.0 Investigation and Failure Analysis
In the event of a component failure it is important to conduct an effective investigation and failure
analysis in order to identify the causes (i.e., physical, human, and systemic) and root cause(s) of a
failure. This will establish a knowledge base that the industry can use to instill safety and improve
equipment/component reliability.

There are several major approaches to investigation and failure analysis that are used within the
industry. Any one of these approaches should be selected in order to verify the root cause and identify
the causes (physical, human, or systemic) of the failure.

The scope of any investigation and analysis related to the equipment/component failure must be based
on factual information (e.g. hose failure, valve leaking in closed position).

9.1 Failure Causes

As part of the investigation and failure analysis process, three types of causes are identified. These are:
physical, human factor, and systemic causes.

9.1.1 Physical Causes
The consequence, manifestation, or results determined through evidence that have influenced or
triggered a component failure. Examples include corrosion, fatigue, excessive stress, erosion, rupture,
etc.

9.1.2 Human Factor Causes
These are related to human activities that have contributed to the failure of a system or component.
Identifying and understanding the contribution of human factors during component failure
investigations will improve corrective action identification and component performance. Examples
include maintenance error, failure to follow procedures, etc.

36

9.1.3 Systemic Causes
These are related to any system or process activity rather than other specific isolating factors, including
failures in the procedures used to execute the work.
NOTE: If the failure is part of a wider event, then the appropriate investigative procedure may need to
be followed IN ADDITION to the creation of the report on component failure.

9.2 Analysis Overview
This section presents the two types of investigation and failure analysis.
•

Failure Cause Known

•

Root Cause Failure Analysis

NOTE: If an investigation fails to sufficiently determine the root cause(s) of the failure, then analysis
can proceed to a RCFA.
If the root cause is known, then this information is submitted to SafeOCS.
The Failure Notification Form can be updated (as needed) during the investigation and analysis process.
The document can be uploaded, along with additional information, using the SafeOCS unique reference
number or identifier that was assigned to the original Failure Notification Form.

9.3

Failure Cause Known

The failure cause is known if a failure scenario was conducted and the conditions that lead to the failure
were carefully observed and described. A failure scenario is the process in which all the possible
sequence and combination of events, conditions, and system states leading to the failure were
identified.

37

9.3.1 Example of Failure Cause Known
A valve damaged during installation normally can be easily categorized as Failure Cause Known. It is
important to report such issues, because if this were to escalate to a systemic/reoccurring event, then it
may warrant a change to the design or installation/maintenance procedures.

9.3.2 Resources
The Production/Senior Subsea Engineer should discuss what happened with another technical member
of crew to determine:
•

What happened?

•

How it happened?

•

Why it happened?

A description of the event and other appropriate information should be provided on or with the Failure
Notification Form.

9.3.3 Closure
The investigation is considered closed when the failure cause is known and the information is provided.
The system will process the resubmittal, thus fulfilling the regulatory requirement. Cases that do not
show a failure cause known are discussed next under Root Cause Failure Analysis Required (RCFA) (9.4).
If the Failure Notification Form has previously been submitted as “final”, it may still be modified or
updated as appropriate. Just attach any supporting documentation using the unique reference number
or an equivalent unique identifier that was assigned to the original Failure Notification Form by the
SafeOCS system.

9.4

Root Cause Failure Analysis Required (RCFA)

The RCFA (sometimes called a formal root cause failure analysis) is a more detailed investigation
requiring more time and resources to complete. The result of the RCFA can be used to correct specific
problems and prevent reoccurrence, for instance: OEM product bulletins, equipment owner
maintenance system changes, etc.
38

9.5.1 Physical Evidence
In many instances, component failures are field repairable, but there may be cases when a replacement
assembly is readily available. In such an event, the physical evidence of the failed component is
provided. Photographs, dimensions, sketches, and written reports can be submitted as further evidence
of the investigation.

9.5.2 Resources
Typically, an RCFA includes at least one SME, one or more appropriate representatives from the OEM, a
suitably qualified third party, and/or the operator.
The RCFA report should include the causes (physical, human, and systemic) and the contributing factors
for the failure occurrence.

9.5.3 Closure
The incident can be considered closed when the component failure report in the database is updated
(closing the initial report) and the final report is published. A Failure Notification Form that has either
been modified or updated must include the necessary documentation supporting the identified cause(s)
and attached using the unique reference number or equivalent unique identifier.

39

10. Compliance
Pursuant to 30 C.F.R.§ 250.803, a failure report shall be generated for SSVs, BSDVs, and USVs contained
in section 10.20 of API Spec 6A and section 7.10 of API Spec. 14A and Annex F of API RP 14B for SSSVs.
To facilitate the accomplishment of this responsibility, this guidance document established protocols
governing the reporting and subsequent investigations of a safety and pollution prevention equipment
failure incident.

11. Capture and Share Lessons Learnt
When developing protocols for identifying, investigating, reporting, and maintaining records of incidents
and failures, it is important that each of these events serves multiple purposes. For instance, proper
investigation and reporting assists OEM’s and owners identifying problematic areas and weaknesses
that can be improved ensuring equipment safety and reliability.
Pursuant to 30 C.F.R.§ 250.803, it is important that lessons learnt from component failures are shared
with the appropriate industry stakeholders.

12. Reporting Design and Procedural Changes
Pursuant to 30 C.F.R.§ 250.803, changes in design and operating procedures (resulting from a failure)
that were not submitted as part of the Failure Notification reporting process must be submitted to
SafeOCS within 30 days. This information should include the unique reference number assigned by the
SafeOCS system or an equivalent unique identifier established when the Failure Notification Form was
originally submitted.

40

For questions contact SafeOCS
www.safeocs.gov
1-844-OCS-FRST (1-844-627-3778)

41

APPENDIX 1. DEFINITIONS
SPPE
The process or control equipment whose primary function is safety or the prevention of pollution in
offshore oil and gas operations. SafeOCS captures failure data for the five specific SPPE components.

Operator Company
The operator or operating company named as the designated operator of the well associated with the
SPPE.
Complex ID
Unique Bureau of Ocean Energy Management, Regulation and Enforcement (BOEMRE) identifier
assigned to a single structure or a group of structures connected by a walkway

Structure Number
Unique Bureau of Ocean Energy Management, Regulation and Enforcement number assigned to a
specific structure within a complex.

API Well Number
A well identifier assigned as defined in API (American Petroleum Institute) by the appropriate state or
federal regulatory agency.

Production Contractor
A company hired by the Operator to manage and operate their equipment.

Redress History
The equipment history of any activity involving the replacement of qualified parts.

Dry Tree
Surface assembly of valves, spools, pressure gauges and chokes fitted to the wellhead of a completed
well to control production, located on the deck of the production platform.

Subsea Tree
An assembly of valves, spools, pressure gauges and chokes fitted to the wellhead of a completed well to
control production located on the seafloor.
Surface Safety Valve
The valve which contains the wellstream and shuts off flow when closed. The SSV is usually operated by
actuator that is designed to close the SSV upon command or loss of power.

42

Subsurface Safety Valve
A device whose designed function is to prevent uncontrolled well flow when closed.
Boarding Shutdown Valve
A valve usually within 10 feet of a boarding pipeline riser (from a subsea well, flowline, or pipeline) that
shuts off flow when closed. It is usually automatically operated and designed to close upon loss of
power.
Underwater Safety Valve
Automatic valve assembly (installed at an underwater wellhead location) which contains the well stream
and shuts off flow. The USV is typically operated by an actuator that causes the surface safety valve to
open when power is supplied and to close automatically when power is lost or released.
Surface Controlled subsurface safety valve (SCSSV)
A downhole safety valve that is operated from surface facilities through a control line strapped to the
external surface of the production tubing.
Subsurface Controlled subsurface safety valve (SSCSV)
A downhole safety valve designed to close automatically in an emergency. There are two basic operating
mechanisms: valves operated by an increase in fluid flow and valves operated by a decrease in ambient
pressure.
Tubing retrievable
Type of subsurface safety valve that is run and retrieved as part of the production tubing string.
Wireline retrievable
Type of safety valve in which the principal components can be run and retrieved by wireline or slickline.
Through flowline (TFL)
Pertaining to treatments performed on subsea wells where the fluids and associated pump-down
equipment, such as plugs or darts, are pumped through the flowline normally used for production fluids.
Velocity-type SSCSV
A type of valve designed to close when high well-effluent velocity causes a pressure differential across a
bean (orifice) in the valve in excess of the design differential chosen by the installer.
Tubing-pressure-type SSCSV
A type of valve designed to close when tubing pressure drops below a pre-set level referenced by a
pneumatically charged container in the SSCSV.
Production
The phase of oil and gas operations involved with well fluids extraction, separation, treatment, disposal,
measurement, and sale.
Injection Well
A well in which fluids are injected into the reservoir rather than produced from it, the primary objective
typically being to maintain reservoir pressure.

43

Well Shut-in
A well which is capable of producing, but is isolated with closed valves and not presently producing.
Failure
A condition that prevents the component from operating as designed. Improper performance of a
device or equipment item that prevents completion of its design function.
Root Cause
The cause (condition or action) that begins a cause/effect chain and ends in the equipment component
failure. If eliminated, it would prevent the reoccurrence of the event (under investigation) and similar
occurrences.
Formal Root Cause Failure Analysis (RCFA)
A comprehensive systematic investigation process undertaken to identify the root cause of a component
failure or other effect.
Corrective Action
An action, which is taken to correct a failure and restore equipment functionality.
Preventive Action
An action to address a failure’s cause to prevent reoccurrence.
Hot-Work
Work that involves heat at temperatures above the hydrocarbon flash point (ex. welding, grinding).
Rated Working Pressure
The maximum internal pressure that the equipment is designed to contain or a design operating
condition.
Maximum Allowable Working Pressure
The highest operating pressure allowable at any point in any component during normal operation or
disrupted conditions.
Tree
an assembly of valves, gauges, and chokes mounted on a well casing head, used to control the
production fluid and flow of oil, water, or gas.

44