Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
2 CURRENT INSPECTION PRO Gal: EVOLUTION AND PRACTICE The current OCS platform inspection program was developed by the U.S. Geological Survey (USGS) of the Department of the Interior in the late 1960s and has not been changed significantly in its basic structure and approach since that time. The program became part of the Minerals Management Service (MMS) mission when it assumed the leasing administration functions of the USGS in 1981. The overall safety record on the outer continental shelf (OCS)-defined in terms of major accidents, deaths and oil spillshas been relatively good when compared with the safety record of the offshore oil and gas industries of some other nations. It is comparable to that of the most hazardous industrial activities ashore, such as mining and construction. The record concerning injuries is less clear since the data are imprecise and are not stated in standards common to records in other industrial operations. The problems of safety and environmental risks on the OCS have been studied thoroughly by the government, individual investigators, and contractors (NRC, 1981, 1984; MIT' 1986). Over the past 15 years measures have been developed to reduce those risks. Leaseholders recognize that they have an enormous economic stake in maintaining safe operations. The problem is to keep control devices in good repair and to maintain high 1~VP.1R Of Befit`' awareness over time. This chapter describes the inspection program and practices currently employed by the MMS on the OCS. There follows a summary of the regulatory and technical underpinnings for the system of safety-related requirements in force today in drilling and production operations. Finally, the OCS safety record is examined from a statistical standpoint. ~ _ . _, ~ . ~ in. ~ i) PRESENT INSPECTION PRACTICE Overview of Inspection Program All oil and gas operations conducted on the OCS are inspected periodically by the MMS. Inspection oversight is decentralized in the regions that administer the leasing program. The MMS is required under the OCS Lands Act (OCSLA) to provide for (1) scheduled "announced" on-site inspections, at least once a year, of each facility on the OCS which is subject to any environmental or safety regulation; and (2) periodic "unannounced" onsite spot inspections without advance notice. In its permit process MMS verifies the leaseholder's qualifications to operate safely and specifies the frequency of inspection and testing of safety systems by the leaseholder. It monitors drilling, production, and workover operations; testing of safety' pollution prevention, and metering equipment; and personnel qualifications. The MMS also monitors compliance with the provisions of the many environmental protection laws and their associated regulations and lease sale stipulations. 20
21 The present onsite inspection program of the MMS is built around a body of specific requirements promulgated by MMS, along with onsite monitoring for compliance carried out by an MMS inspection force., Monitoring is facilitated by requirements that operators2 perform tests, conduct drills, and maintain records that will afford MMS inspectors an overview of the status and history of installed safety devices and required functional drills. MMS regulations specify that safety devices to be tested and drills be performed weekly, monthly, semiannually, and annually on a scheduled basis. The records of the tests and drills are required to be kept on each platform or in the operator's nearest field office. Table 2-1 illustrates test activity by one sizable Gulf of Mexico lessee on its production platforms. Of the 78,813 tests performed during the year, 9.3 percent actually were witnessed by the MMS. The remaining 90.7 percent were performed by the operator without MMS supervision, but with the documentation being kept available for review by the MMS. In order to expedite inspections and enforcement and to promote uniformity of inspectors' findings, all MMS standing requirements (derived from regulations) have been melded into a listing of Hpotential incidents of non-compliance" (PINCs), which forms a checklist for the MMS inspectors. This National PINC List" generally addresses tests of safety devices. The underlying concept is that, in the design of facilities, the safety devices are critical for preventing accidents and pollution; that is, these devices are designed to "shut-inn and contain the system in the event of a failure, and therefore must function as designed. A determination that there has been non-compliance with any item on the PINC list is termed an "incident of non-compliance" (or INC), and constitutes a violation of MMS regulations. The PINC list specifies the prescribed enforcement action. The more serious violations (INCs) elicit a shut-in order, which requires immediate corrective action and shutdown of the particular operation involved (or even the entire facility) until correction is effected. Other violations can result in civil penalties, but penalties have been imposed rarely since a court holding that operators must be afforded the opportunity to take corrective action before a penalty can be invoked. The great majority of INCs are deemed noncritical3 and result only in a warning, subject to the operator taking prescribed corrective action within a specified time period. The first part of Appendix D (which is representative) lists INCs reported on two operators during an annual inspection; the second part is a partial biennial summary of the nationwide INC/PINC ratio for drilling and production during a recent year. 1 The focus of this study is inspection related to ongoing operations. It should be noted, however, that initiation of both drilling and production operations involves a series of permit approvals directed to assuring that a facility is safe (i.e., that it has in place a plan for achieving safety performance goals, as well as effective safety procedures and equipment) before drilling or production operations can begin. 20CS lessees are responsible for the safe operational performance of a facility. However, on a practical basis, an "operator" approved by MMS-who may be a sole lessee, one of a group of joint lessees, or a third party engaged by the lessees-manages the day-to-day activity on a platform. Since this report deals with the safety of onsite operations all references are to the "operator," recognizing that ultimate accountability for safety performance lies with the lessees. 3The categorization ~critical" varies in meaning across regions. The term generally relates to requirements directly affecting well control and is not limited to safety devices. The Alaska OCS Region makes no formal distinction between critical and noncritical.
22 C) a) ~ Z Q _ t~ o ._ <' 4) Q ° ' cn C ~n ~ a) ~ ca ~ ~n ~ C~ ~ ~n C LL _ ~ as ~n O ~ _ C Q E ~ o o ~ a) 0 Z ~o o ~ a' a O .O _ ~ .O Q O) '> CL _ _ . _ . _ ~n a, CM ~ J O . O Z O tn xO c c, a C CO CO . C °C E ° 2 G) Q Q) C Q cn ~ ca o ~Q O ~ ~ Q ~ ~ Q C' ~ Ct o C ~n x C ~: o e> o5 0 CO ~ 10 ~t ~ O ~ ~ 1D N ~) 0 0 0 0 0 0 ~ O It) d- _ d" ~ CO CO ~t O (0 O ~ 0 N O O O O O N O 0 CD O _ O O N O _ ~ _ _ _ O O O O O O O O O O _ N CO ~ ~) N O CO CO CO ~ 1D O O O O O N O N O O O O O 0 10 10 0 0 0 d- 10 0 0 (D 1D (D O 10 0 N N N N _ _ _ _ N O ~ CO ~ (D 0 N 0 N d- N U.) ~ CO CD O) ~ ~ _ ~ C~J d- ~ _ N N N N N CV) ~ N N lD 0 1D _ N CO cO _ O N CV) _ N ~ ~ N _ _ ~ ~ _ _ ~ Q. C _ . <o a .= E N CO ~ If) ~ P_ 0 O) O C\1 0 d- lO (D ~ 0 ~ o ~ O _ _ _ _ _ _ N N (~) O ~ U, O O O O O O O ~ ~ U) O U~ O U~ O ~ U) 10 Ct) ~ 10 ~ ~ ~) ~ ~ U) ~ ~ O CO _ ~ ~ ~ (C) _ ~ _ Ir) N N ~ ~ _ N _ ~ ~) ~) ~) N N N ~ N I 3 - c ~n. .~ 3 a) a, E . _ a) _ o ' c a) ~ c C~J X ~ ~ D ~ 0 3 ,o, ,~- C~ ~ ~ ,c | ~ ~ || ~ E i ~ ~ ~ _ Q _ - Q ~X) ~ tn c~ ~ E U] ~ o) o' _ ° ~o C) ~ C) ~ _=XII N : >, ,~ ~ o ·_ ~5 (~) O ~ ~ ' : C~S I ° ° ° c~ c, ~ 4) o o o C ,. ,~) Q Q Q ~ O ~ ~ _ _ "o ~ E E E a) a, ~ ~ ~ ~ ~ ~ Q _ rt~ ij~ ,,, ct E ~ ~ C~ ~ c' ~ Q ~ ~ ~ ~ N ~> a) - o ._ 111 ~L cn o C a' Q - > C ._ Cd N Q C) a cn . . a) - o z
23 Inspection Policy Basic policy guidance for lessees and inspectors is set out in the Minerals Management Service Manual, Chapter 650.1. (U.S. Department of the Interior, 1984) Highlights are (1) a reiteration of the statutory requirement making each facility subject to an annual (announced) onsite inspectionthe manual specifies that all Applicable inspection characteristics delineated on the National PINC list" are to be inspected;4 and (2) a reiteration of the statutory requirement making each facility subject to spot (unannounced) inspectionsthe manual specifies that a minimum of 10 percent of all production facilities are to be spot-inspected annually and that at least 25 percent of the applicable PINCs are to be witnessed (for drilling facilities the percentages are 50 percent of the facilities and 25 percent of the PINCs). Each facility also is subject to unannounced inspections of specific items and systems. Directly supporting the manual (Chapter 650.1) is the Minerals Management Service Handbook (U.S. Department of the Interior, 1986~. This directive establishes the agency's inspection organization and authorizes promulgation of field office supplements covering actual methodology to be used in conducting inspections. These supplements are subject to concurrence at the headquarters level prior to promulgation by the regional director. The handbook outlines procedures to be followed by inspectors in handling incidents of non-compliance, including notifications of operators, and for maintaining and submitting inspection records. It also describes internal review procedures designed to monitor a region's inspection process. The National PINC List was promulgated initially as a headquarters directive to bring national uniformity to the inspection process at a time when each region was enforcing locally promulgated "OCS Orders." (The MMS recently issued uniform regulations which supersede the regional OCS Orders; these regulations went into effect on May 31, 1988. The PINC lists have been revised to conform to the new regulations.) Inspection Procedures Inspections are conducted by district employees classified as Petroleum Engineering Technicianstheir entry level is OS-9, journeyman level is GS-10, and supervisory level is GS-12-who are required to have had field experience in the oil and gas industry prior to being employed by the MMS. Appendix E presents a job description for the Petroleum Engineering Technician (journeyman level). For the most part, the technicians' (inspectors') prior qualifications reflect practical experience on a drilling facility and/or a production platform rather than formal training in inspection techniques. Generally speaking, specific training in inspection procedures is limited to on-the-job training gained while accompanying a trained technician. To some degree inspectors are rotated with a view to maintaining an arms-length relationship with facility personnel. The dispersion of the facilities requires that large amounts of working time be used in getting to and from facilities (notwithstanding the nearly total reliance on helicopters for transportation). This results in inspector time (for production operations) being utilized at a rate of about 70 percent in the Gulf and 59 percent in the Pacific Coast (MMS, unpublished information). Once at a facility, inspectors customarily review the facility records of the tests and drills conducted by the operator to meet MMS requirements, as well as operational records. These reviews appear to be far from comprehensive, but nevertheless, are time-consuming. (Some review of MMS records is done ashore prior to the inspection to give the inspectors specific information 4The PINC lists differ for production facilities and for drilling facilities. The PINC list for production operations was derived in part from the American Petroleum Institute's Recommended Practice Standard 14C, which covers safety systems for offshore production platforms. The lists recently have been expanded to address workover operations.
24 regarding the inspection history of the facility.) Thereafter, the inspector tours the facility accompanied by a technician from the facility who is qualified to operate machinery and conduct tests required by the inspector. MMS personnel do not operate machinery or test equipment, but they do select equipment to be checked and tests to be conducted. The choice of items is viewed by inspectors as something to be determined "using their expertise," not only during unannounced inspections where selective witnessing clearly is authorized, but also sometimes during annual inspections, notwithstanding MMS's 100 percent inspection standard. The criteria used for this selection were not identified or discernible to the committee during onsite visits. Inspector responsibilities in the Pacific region also include inspection tasks to ensure operator conformance with federal air emission standards. This activity presently affects 4 of 20 platforms, but it is expected to extend to all OCS facilities. A small portion of the time of one MMS engineer and two MMS technicians is dedicated to checking the volatile organic compound (VOC) emissions of gas turbines, monitoring water injection ratios, spot-checking exhaust temperatures, and reviewing maintenance records reflecting emissions performance. Other environmental responsibilities of inspectors in the Pacific region include investigation of flaring (gas burning), fuel consumption rates of equipment, and hydrogen sulfide concentrations and pressures. At the conclusion of the inspection, inspectors advise the facility personnel of any deficiencies involving a warning; those involving a shut-in are addressed as they are observed. A record of the deficiencies is made and filed at the district office for follow-up purposes. The G-400 "safe and workmanlike manner" PINC is sometimes used as a way to flag dangerous conditions not covered elsewhere on the list.5 On each visit to a platform, the inspector reviews a summary of the previous inspection and checks to ensure that any INCs have been corrected. Most INCs requiring shutdown of an operation can be corrected while the inspector is still in the field. In such cases the inspector will authorize resumption of operations. Where the INC is corrected after the inspector leaves the platform, the operator will notify the district office, by phone, and receive verbal permission to resume operation. Depending upon the type of INC and the inspector's schedule, the inspector may or may not check to verif,r compliance prior to the next annual inspection. Safety Communication to Operators The MMS OCS regional or district offices issue "safety alerts,n which are notices to operators and lessees about operational safety problems and recommendations for eliminating hazards or dangerous practices. Most safety alerts deal with circumstances that have contributed to or caused injuries. These notices are issued on an ad hoc basic, but are not necessarily related to an accident or fatality event, nor to analyses of INCs. Summary The complete PINC list is intended to lead to a comprehensive check of all systems and operations on OCS facilities so that a valid, instantaneous picture can be drawn of the condition of the listed systems and operations. MMS officials take the position that because process upsets resulting from human error, poor maintenance, and unexpected operational events can be sensed and controlled by safety systems, inspecting the system for compliance with PINC list requirements is a valid means of ensuring systems safety and integrity. In essence, then, the current inspection program and practices conform to the MMS's interpretation of public law as derived principally 5G-400: "is each operation performed in a safe and workmanlike manner, and are the necessary precautions taken to prevent health, safety, or public hazards?"
25 from the OCSLN The questions are: Is this inz~erpretaz~zon adequate from the standpoint of public expectaz~zon regarding safety on the OCS? Is there a different approach to inspection that would enhance safely in the long run? These are questions that this report attempts to answer. TECHNICAL FOUNDATION FOR INSPECTION REQUIREMENTS One approach to evaluating the current inspection system is to examine its technical basis. The MMS inspects both onboard systems and operational procedures for compliance with safety requirements. The requirements for what should be inspected in drilling and production operations and the necessary safety devices were established by the USGS soon after federal regulation of OCS operations began. The requirements were based on technical findings and on formal safety analyses, and have been updated to a limited extent by the MMS as experience has indicated. This section briefly describes those technical bases. Evolution of the Safety Practices for Drilling Operations Requirements regarding procedures to be used to determine casing depths and mud weights, as well as procedures for kick detection and requirements for control devices, are imposed by MMS regulations carried over from the USGS. These requirements are based on the findings of informal reviews by various American Petroleum Institute (API) and industry committees, of previous blowouts and industry experience gained over several decades of operations offshore, and a longer history of land operations. The hazards of drilling and the equipment required to address them are well known. In essence, subsurface conditions dictate the type and amounts of casing and tubing, and the type of wellhead. This MMS safety approval of the design of newly drilled wells requires the installation of surface and subsurface safety valves. Evolution of the Requirements for Safety Devices for Production Facilities Detailed federal requirements for safety and pollution control devices were first promulgated October 30, 1970, in a revision of USGS OCS Order No. 8, dealing with the installation and operation of platforms, and OCS Order No. 9, pertaining to oil and gas pipelines. API's Offshore Safety and Anti-Pollution Equipment (OSAPE) Committee, and the Offshore Operators Committee (oOC)6 provided technical advice to the USGS on the development of the requirements. Subsequently, the USGS commissioned contractors to perform safety analyses on several representative Gulf of Mexico facilities. Both Hazard Analysis (HA) and Failure Modes and Effects Analysis (F MEA) techniques were employed to develop a standard procedure for evaluating hazards at offshore production facilities and ensuring that appropriate safety devices were installed. After reviewing the contractor's work, the oil and gas industry pointed out that a modified FMEA approach was more compatible with the practices of the industry and would supply the necessary information in a manner that was both simple to gather and easy for the government to verify in its design review. The API then developed this concept into its Recommended Practice 14C, (Analysis, Design, Installation and Testing of Basic Surface Safety Systems for Offshore Production PlaJorms, referred to as RP 14C, first published in June 1974~. This document soon was incorporated into the government regulations. It has been updated periodically. 6The Offshore Operators Committee is composed of representatives of the operating companies in the Gulf of Mexico.
26 The modified FLEA approach evaluates each piece of equipment as an independent unit, assuming worst-case conditions of input and output, including the failure of a device and its influence on the environment (e.g., gas, fluids) around other devices. Separators, flowlines, heaters, compressors, etc., function in the same manner regardless of the specific design of the facility. That is, they have fluid level, gas pressure, temperature controls, valves, and in some cases relief valves. These are subject to failure modes that impact the piece of equipment in a consistent manner. Thus, if a FLEA is performed on the item of equipment standing alone, it will be valid for that component in any process configuration. Furthermore, once every process component has been analyzed separately for worst-case stand-alone conditions, there is no additional safety risk created by joining the components into a system (Arnold and Stewart, 1989~. That is, if every process component is fully protected based on its FLEA analysis, a system made up of a number of these components also will be fully protected. It even is possible to configure the system so that protection furnished by devices on one process component can protect others. That is, devices that may be required to provide adequate protection for a component standing alone may be redundant once all components are assembled in a system. The RP 14C procedure for determining what safety devices are required to protect the system and process is summarized below: · For each piece of equipment (process component), develop a FLEA by assuming that every process upset that could become a potential problem in fact occurs. · Provide a sensor that detects the upset and shuts-in the process before an identified hazardous condition develops. · Apply FMEA techniques to identify an independent back-up to the sensor that will provide a second level of defense before the identified hazard develops. The required degree of reliability of the back-up device depends on the severity of the potential hazard. · Where experience in applying FMEA analysis to production equipment indicates that only one level of protection is required because of the degree of reliability of the primary device and the low cost of the specific consequences of failure, nevertheless, two levels of protection should be specified since it is often more costly in engineering time to document the need for only one level of protection than it is to install and maintain two levels. · Assemble the components into the process system and apply F"MEA techniques to determine if protection devices on some components provide redundant protection for other components. Each installation design submitted for MMS approval must contain a process schematic and a Safety Analysis Function Evaluation (SAFE) Chart, which lists each process component and the devices required by the modified F MEN If a device is installed, the chart indicates how the device acts to isolate the component (e.g., which valves it actuates). If a device is not included, an alternative device that will provide the protection is recorded. The combination of process flow diagram and SAFE chart, along with the feedback of data from inspections, ensures that the MMS design review for safety devices is comprehensive. SAFETY PERFORMANCE RECORD The safety of OCS operations can be measured in terms of accidents and resulting deaths and injuries, as well as pollutant (primarily oil) spillage into the environment. At the extreme are losses of entire platforms due to blowouts, explosions, and fires. Any discussion of the safety performance record on the OCS must make note of the fact that OCS data collection currently has many shortcomings and that data collected by the MMS and the
27 U.S. Coast Guard are not consistent. For example, data about deaths and injuries in a given year may be quite different. Several variables contribute to the discrepancy: . Reporting requirements and procedures for the two agencies are different. The number and types of offshore platforms required to be reported are different.7 The reporting year itself is different (i.e., calendar year vs. fiscal year). The committee had available to it parallel statistics compiled by both MMS and USCG. Because its primary focus is on MMS inspection practices, the committee has relied primarily on MMS data, referring to Coast Guard figures where pertinent. and activities. Adequacy of MMS OCS Safety Information System In two studies, the Marine Board conducted a comprehensive review of the technology and regulations relating to OCS oil and gas development (National Research Council, 1981, 1984~. The committee that conducted the 1981 investigation found that "without a strong safety information component in the OCS regulatory program, it is not readily possible for the government to identify safety problems and courses of action." The 1984 study recommended that the MMS establish an OCS Safety Information System for monitoring the safety performance of OCS owners and employers. This system should (quoting) acquire comprehensive OCS event and exposure data; relate events to specific employers, locations, operations, and equipment; calculate frequency and severity rates and analyze trends; and permit monitoring of the relative safety performance of owners and employers, locations, Part of such a system has been developed and put into effect, but the reliable safety information system essential to the management of MMS inspection operations and effective safety management still is not available. Some of the data are poorly organized or incomplete; in particular worker exposure information is lacking. Accordingly, there is an inadequate basis for . industries, . . comparison of the safety performance of OCS operators with operators in other detection of time-related trends in safety performance, identification of particular safety problem areas in OCS operations that may require special attention, and · evaluation of the effectiveness of new or changed inspection requirements. Injunes and Fatalities A primary aim of the MMS inspection program is to ensure that OCS operations do not expose operating personnel to unwarranted physical hazards. In order to assess the relative risks in various industries, it is useful to compare injury and fatality incidence rates. The Bureau of Labor Statistics (BLS) of the Department of Labor, and other federal agencies such as the Bureau of Mines (BOM), publish statistics concerning incidence rates of fatal and nonfatal occupational 7The Coast Guard separates data relating to MODUs and fixed platforms; these data cover MODUs in state waters and U.S.-owned units overseas as well as those on the OCS.
28 injuries and illnesses, lost workdays, etc. Such statistics are widely available and can be used for indust~y-to-industry comparisons and for trend analysis. The only readily available public record of fatal and nonfatal injuries resulting from OCS operations is a compilation published by the MMS entitled, Accidents Associated with Oil & Gas Operations (U.S. Department of the Interior, 1988a). This report supplements the previously published Accidents Connected with Federal Oil and Gas Operations on the Gulf of Medico Outer Continental Shelf, Volume I (OCS Report MMS 86-0038) and Volume II (OCS Report MMS 87-0049) and updates the data contained in those publications. The scope of the new report is broader; it covers the entire OCS during the reporting period. Table 2-2 sets out injury and fatality records for the period from 1977 to 1986, inclusive, extracted from the MMS reports and partial data for 1987 acquired by the committee. This table includes injuries and fatalities in the Gulf of Mexico and Pacific regions. The Atlantic and Alaska regions have snot had any accidents that meet the criteria set forth in the Introductions to the report U.S. Department of the Interior, 1988a. The accidents involving human deaths and injuries listed in the MMS report are those associated with blowouts, explosions and fires, significant pollution incidents, and major accidents. No definitions of "injury" and "fatality" are given in the MMS report, apart from a statement that defines major accidents as those involvingamong other thingsnail fatalities or serious personal injuries that cause impairment of any bodily unit or function" (U.S. Department of the Interior, 1988a). The U.S. Coast Guard provided the statistics for injuries from all causes for the three-year period from 1984 to 1986, as listed in Table 2-2. The Coast Guard also records data on injuries related to equipment failures. The number of injuries from all causes in the Coast Guard data is TABLE 2-2 Injuries and Fatalities on the OCS, 1977-1987 MMS data - USCG data Year Injuriesa Fatalitiesb All injuriesC Equipment-related injuriesC 1977 27 4 1978 12 9 1979 15 17 1980 83 28 1981 22 12 1982 45 18 1983 29 8 1984 30 19 873 22 1985 32 14 851 29 1986 10 7 454 13 1987 NA 1 NA NA aData from Tables 2-A, 2-B, 2-E, and 4-A, 4-B, and 4-E (overlaps have been eliminated) and MMS Regional Office data information (1987 partial data). bData from Tables 2-E and 4-E. CUSCG correspondence to committee. NA = Not available
29 more than 26 times as large as those reported by the MMS (the ratios are 29.1, 26.6, and 45.4 for the years 1984, 1985, and 1986 respectively). It is unlikely that the difference is due to the differences in the definition of injurv.8 A more likely explanation is that the majority of accidents resulting in personal injury in the Coast Guard data are defined differently than those categorized and reported by the MMS as Major accidents. Exposure and Rates of Incidence of Injuries and Fatalities No report is available from public agencies concerning the aggregate exposure of personnel on OCS facilities to safety hazards. As comparison with other industries is possible only on the basis of rates of incidence, a request was made to the Coast Guard to provide the committee with estimates of the daily population at risk on offshore facilities. The Coast Guard supplied an average daily population estimate for the seven-year period between 1980 and 1986, inclusive. This estimate was based on the known number of structures and vessels of various kinds and on the estimated average crew size for different operations. A summary of the data supplied is given in Table 2-3. TABLE 2-3 Estimated Daily Population of Workers on the OCS, 1980-1986 (i) Personnel on mobile offshore drilling units (MODUs) Type of structure/vessel Submersibles Semisubmersibles Drillships Jackups Subtotal Average number per day 732 1 ,200 399 4.436 6,767 (ii) Personnel on manned platforms Type of activity Production operations Drilling operations Subtotal (iii) OCS personnel Total 1 0,385 3,784 14,1 69 20,936 SOURCE: U.S. Coast Guard, unpublished data, 1988 8As contrasted to the MMS, which reports injuries only if they are related to accident "events", the Coast Guard uses a more specific definition of injury (see following subsection) that excludes only minor cuts, bruises, and burns, as well as time off the job.
30 In calculating the total hours of exposure it must be appreciated that offshore facilities operate 365 days per year. Personnel generally work a 12-hour shift, then spend 12 hours off duty. However, since the workers are domiciled on the facilities for the full day, they are exposed to certain hazards even when they are off duty, which is not the case in land operations. In these circumstances, the committee has deemed it necessary to consider both working (12 hr/day) and total (24 hr/day) exposure. Accordingly, the total hours of exposure per year were calculated as follows: Working hours of exposure (EH) for a calendar year (while on duty): EHwkg = 12 x 365 x 20,935 = 91,669,680 hours/year Total hours of exposure for a calendar year (while domiciled, whether on duty or not): EH~o~C = 24 x 365 x 20,935 = 183,399,360 hourslyear The number of injuries reported by the Coast Guard and included in Table 2-2 is based on the definition of injury used in the CAS}L4IN Data Base (U.S. Coast Guard Casualty Reporting Requirements, 33 C.F.R. 146.30~. There, a reportable injury is defined as injury to five or more persons in a single accident or an injury causing any person to be incapacitated for more than 72 hours. Unfortunately, this definition differs from that used by the Occupational Safety and Health Administration (OSHA), which gathers accident data for many industries. OSHA categorizes reportable nonfatal occupational injuries into two groups-see, for example, BLS Bulletin 2259 (Bureau of Labor Statistics, 1986~: 1. Cases involving lost workdays which are either lost workday cases involving one or more days away from work, or lost workday cases involving one or more days of restricted work activity only. 2. Cases without lost workdays that result in transfer to another job, require medical treatment (other than first aid), or involve loss of consciousness or restrictions of work or motion. Neither of these OSHA definitions is sufficiently close to that used by the Coast Guard to justify a comparison of injury incidence rates. This finding is further illustrated by the data in Table 2-4. The ratios of number of injuries to number of fatalities are much greater for industries reported on by the Bureau of Labor Statistics, (BLS, 1986) than the ratio obtained for OCS operations from the Coast Guard reports. The lowest (worst) ratio seen on the BLS data is for mining, a ratio (139) that is still 2.6 times greater than the ratio for OCS (54) (Table 2-34. The likelihood of having such a large discrepancy, if the two sets of data were comparably based, is small. The OCS fatality incidence rate is calculated from the formula (N/EH) x 200,000,000 where N is the number of fatalities, EH is the total hours worked by all employees during a calendar year, and the constant is the standard used by the Bureau of Labor Statistics (2,000 labor hours per year x 100,000 employees) for reporting incidence rates. A minimum (working) and a maximum (total) value of EH in OCS operations was calculated earlier. According to Table 2-2, the average number of fatalities during the seven-year period from 1980 to 1986 (the same seven years used by the Coast Guard to estimate daily population at risk-see Table 2-3) is (106/7) = 15.1 fatalitiesfyear. On this basis, the maximum and minimum fatality incidence rate for OCS operations are 16.5 and 33.0, respectively. To bring these figures into perspective, the fatality incidence rates in various industries in the private sector are given in Table 2-5, for 1983 and 1984 (Bureau of Labor Statistics, 1986~. Clearly, OCS operations result in fatality incidence rates which are comparable with those seen in the more hazardous industries in the United States (e.g., mining and construction). This is not an unexpected result, given the work environment prevailing on the OCS.
31 TABLE 24 Ratios of Injuries to Fatalities, 1984a Industry Injuries Injuries/ (lost workday cases) Fatalities fatalities (ratio) Agriculture, forestry, and fishing 46,300 110 421 Mining 51,400 370 139 Construction 256,500 660 389 Manufacturing 841,800 800 1,052 Transportation and public utilities 249,300 770 324 Wholesale and retail trade 574,300 440 1,305 Finance, insurance, and real estate 44,300 80 544 Services 385,800 510 756 Private sector total (non-OCS) 2,449,700 3,740 655 OCS Oil and Gasb 2,178 40 54 SOURCES aBLS, 1986 for all data except those for OCS. bTable 2-2, covering years 1984, 1985, and 1986. TABLE 2-5 Fatality Incidence Rates Industry 1983 1984 Agriculture, forestry, and fishing 12.7 16.3 Mining 27.6 41.4 Construction 26.3 22.8 Manufacturing 4.3 4.4 Transportation and public utilities 13.3 16.9 Wholesale and retail trade 3.3 3.1 . . -finance, Insurance, and real estate 1.7 1.9 Services 2.2 3.9 SOURCE: BLS, 1986.
32 It must be noted however, that since the early 1970s no major disasters have occurred~on the U.S. OCS that approach the scale of recent disasters on platforms in the North Sea. For example, the July 1988 Piper Alpha explosion and fire cost the lives of 166 of the 229 people on board. This country's OCS operations do not have the concentration of people found in the North Sea operations. However, the possibility of an accident occurring on the OCS that could result in 50 to 100 fatalities cannot be dismissed. A single occurrence of this magnitude would have caused the fatality incidence rate over the seven-year period 1980 to 1987 to have doubled. Causes of Fatalities and Injuries Table 2-6 presents the committee's analysis of the causes9 of deaths and injures in the 54 events that produced fatalities in the Gulf of Mexico over the period 1982 to 1986, as recorded in the MMS's events file (U.S. Department of the Interior, 1988a). The handling of heavy loads and falls were the two most common sources of these accidents. TABLE 2-6 Causes of Accidents Involving Fatalities in the Gulf of Mexico, 1982-1986 Description of cause Number Number of events of fatalities 1. Handling heavy loads (including crane accidents) 16 16 5 2. Fall from height 11 11 1 3. Opening a pressurized system for maintenance 7 8 3 4. Drowning 5 5 0 5. Illness and heart attack 3 3 4 6. Premature firing of perforating gun 2 2 4 7. Electrical shock 2 2 0 8. Vented gas during well work 2 6 4 9. Helicopter 1 2 2 10.Welding operations 1 3 9 11.Vapors from drain lines 1 1 1 12.Jackup rig failure 1 1 0 13. Unknown 2 2 2 Total 54 63 31 aNonfatal injuries associated with fatality events. 9Causes as reported in the MMS events file.
33 Pollution (Spill) Incidents A further hazard deriving from offshore gas and oil operations is the spilling of pollutants which may endanger the marine and coastal environments. MMS files and reports, using data reported by operators, are the original source of information concerning the frequency and volume of such spills from offshore facilities. The most up-to-date report is U.S. Department of the Interior, 1988a. Data concerning oil spills of 50 barrels or more that occurred during the last decade are summarized in Table 2-7 for the Gulf of Mexico. The Alaska and Atlantic regions did not experience incidents that were reportable under the criteria used in the MMS report. The Pacific Region oil spillage was estimated to be about 1,500 barrels per year or less; this volume was attributed almost entirely to seepage, including natural seepage. The pollution incidents in the Gulf of Mexico represent spill rates ranging from a low of 0.3 barrels per million barrels produced (or 0.00003 percent) in 1986, to a high of 20.6 barrels per million (or 0.0021 percent) in 1981. While major spills can and do occur and produce widespread ecological damage and involve large cleanup costs, as in the case of the lxtoc-I spill in Mexican waters (1979 to 1980), oil pollution from offshore operations contributes less than any other source to the release of hydrocarbons into the marine environment. A National Research Council assessment of worldwide inputs from natural sources (e.g., seeps), transportation (e.g., tanker operations and accidents, bilge oil, etc.), the atmosphere (particulates), municipal and industrial wastes and runoff, and offshore oil and gas production ranked the latter category lowest, at 0.05 million metric tons per annum (mta) of the 3.2 mta total (National Research Council, 1985~. Refinery input (0.1 mta) and municipal wastes (0.7 mta) are sources that exceeded the average annual input from offshore operations. The same report noted that U.S. offshore spillage probably contributes less than 5 percent of the world offshore spillage. The data indicate that since 1977 there has been no obvious long-term trend in spillage rates from offshore oil and gas operations. However, over the last five years of record there has been a noticeable reduction in average spill volumes and in the amount spilled in comparison to production. TABLE 2-7 Oil Spills of at Least 50 Barrels (bbl), Gulf of Mexico OCS Total Average spill Production vol. Oil spilled (bbl)/ Year Events vol. (bbl) vol. (bbl) (million bbl) oil produced (bbl/mill) 1977 4 670 168 291.7 2.30 1978 3 1,139 380 280.2 4.06 1979 5 2,095 419 274.6 7.63 1980 9 2,581 287 267.2 9.66 1981 6 5,562 927 270.2 20.58 1982 3 842 281 292.8 2.88 1983 9 1,939 215 317.8 6.10 1984 2 150 75 340.0 0.44 1985 8 1,354 169 359.5 3.77 1986 1 119 119 360.0 0.33 Totals 50 16,451 329 3,054 s.39 (10 yrs) SOURCE: U.S. Department of the Interior, 1988a.
34 Of course, an historical analysis cannot exclude the possibility of catastrophic spills such as occurred in four events between 1967 and 1970 with spills of 10,000 barrels or more. These events spurred industry and government action, which appears to have enhanced the industry's capability to assure well control and process control. Fires, Explosions, and Blowouts One important measure of safety practices is the number of fires, explosions, and blowouts that occur aboard OCS facilities. Table 2-8 shows the number of such accidents occurring on the OCS since 1970 in the Gulf of Mexico (over 9S percent of OCS drilling activity). The number of incidents per year shows no clear trend even when compared to indicators of drilling activity, such as the number of new wells drilled per year (loss of well control during exploratory and development drilling is the leading cause of fires, explosions, and blowouts.) Violations Cited During Inspections Table 2-9 indicates that the average number of inspections per platform (production) has fallen slightly (e.g., a decrease of 18 percentfrom 1.7 to l.4~over 3 years) compared to those TABLE 2-8 Major Accidents in the Gulf of Mexico OCS Regiona Fires and explosions Blowouts 1970 7 2 1971 1 2 1972 0 1 1973 3 2 1974 0 1 1975 4 2 1976 0 1 1977 3 0 1978 7 2 1979 3 1 1980 7 4 1981 3 1 1982 8 2 1983 4 3 1984 6 1 1985 3 1 1986 1 1 aAII fires or explosions that result in equipment of structural damage of $1 million or more. Both production and drilling related events are included in the number. Note: A single accident event may be included under more than one accident category. SOURCE: MMS, unpublished data.
35 a) z ~b o.Q ~ In' G) =~ ~ in ~ .£ Q .0 CL in C' z in o a) Q in - ,0 o C1) A: . a) CM m in o - a, Q cn - ~ U) ._ ~ _ ~ . O O ~ Z Q z ~Q .0 a). Q) `,=0 c' cn C o ._ Q cn _ cn C' ~ {t ·y - ._ O C' Z O5 ~ _ C~ O _ C~ ~ Ct7 CO - O C\l _ co 0 cn 0 C~ U~ U~ ~ CO ~ O CO ~ ~ CO CO CO a, 0 _ 0 uD cO cM ~ co o ~ ~ cM ~ ~ c~ o ~ ~ L~ cM ~ cD 0 Co 0 · . ~ y ct ~ a~ ~n 0 a' ~ ~ cn · - Q Q ._ - o · . a) llJ ~: a) ~ 6 o as Cl'
36 involving drilling activities, which showed a decrease of 53 percent over the same period when offshore exploration was curtailed greatly due to falling oil prices. However, the data do not reflect the scope of the individual inspections, which range from a full review of all PINCs to merely a brief visit to check the operator's resolution of an INC that had resulted in a shut-in. Differences in the geographic distribution of platforms, the complexity of the facility Types of processing systems and number of wells), and the regional emphasis on environmental pollution are factors that may influence the number of assigned inspectors (see Table 2-10~. These factors appear to be renected In the inspection results shown in Table 2-11: for example, the INCs-per-inspection ratio in the Pacific compared to the Gulf of Mexico. However, it is not possible to infer from the available statistics the influence of each factor noted above on inspection frequency. A point of major interest to the committee was the degree to which the. nh~f`.n~P. Of Tic {i a . ~ . . _ compliance with the PINC List) ensures safe operations. Table 2-12 gives the results of the committee's analysis of the 54 fatality-producing accidents listed in Table 2-6. In Table 2-12 the cause of each accident is attributed to one or more possible PINC violations. Only in 5 of the 54 accidents, involving 11 of the 63 fatalities, is a violation of a specific hardware-oriented PINC implicated. The rest can be related in a general way only to the PINC G-400. This PINC asks the question, his the operation performed in a safe and workmanlike mannerly It is described informally by MMS as a "catch-all" PINC, since it is not specific and is sometimes used by inspectors to cite poor operational procedures and general housekeeping. However, the committee observed that very few G-400 PINCs are issued by inspectors. TABLE 2-10 Number of OCS Inspectors by Year, 1985-1987 Year Gulf of Mexico Pacific 1985 55 10 1986 54 1 1 1987 55 13 SOURCE: MMS TABLE 2-11 INCs and Inspections in the Gulf of Mexico and Pacific Gulf of Mexico Pacific . INCs/inspections INCs/inspections Year INCs Inspections (ratio) INCs Inspections (ratio) 1985 4616 1 0120 0.45 406 2188 0.19 1 986 3512 8401 0.42 242 2023 0.12 1987 3405 7404 0.45 238 1 925 0.12 Note: The total number of inspections cited in Table 2-11 is greater than in Table 2-9 because workover, abandonment, metering (production verification), and pipeline inspections are included in Table 2-11 totals as well as production and drilling inspections. SOURCE: MMS
37 TABLE 2-12 Analysis of Reported Accidents Involving Fatalities in the Gulf of Mexico, 1982-1986 Number Number Number Potentially Reported of of of violated cause accidents fatalities injuries PINGS 1. Handling heavy 16 16 5 G400 loads (including crane accidents) 2. Fall from height 11 11 1 G-400 3. Opening a 7 8 3 G400 pressurized system for maintenance 4. Drowning 5 5 0 G-400 5. Illness and 3 3 0 NONE heart attack 6. Premature firing 2 3 4 G-400 of pedorating gun 7. Electrical shock 2 2 0 G-300, G-400 8. Vented gas 2 6 4 G400, G-408 (?) during well work 9. Helicopter 1 2 2 NONE 10. Welding operations 1 3 9 G-200, G-201, G-206, G-209, G-210, G-212, & G-400 11. Vapors from 1 1 1 G-400 drain lines 12. Jackup rig 1 1 0 G-400 failure 1 3. Unknown 2 2 Totals 54 63 31 UNKNOWN
38 Thus, if possible violations of the Catch-all PINC G-400 are disregarded, most of the accidents would have occurred even though the operator might have been in 100 percent compliance with all other PINCs at the time of the accident. The hardware-oriented PINCs seemingly are not tied closely to current accident experiencethis observation does not imply that fatalities have not been averted as a result of these PINCs being enforcedrather it is meant to suggest that the safety-enhancement limits of a hardware oriented inspection program are being reached. PINC G-400 can be useful in addressing operational and procedural hazards, and indeed its increased use is being emphasized by MMS management. But, because it is so general in nature, it alone is not a sufficient tool to use in addressing operational hazards in a consistent and directed manner (see Chapter 7~.
