Click for next page ( 59


The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 58
6 ASSESSMENT OF PRESENT PROGRAM AND ALTERNATIVES The committee assessed the present Minerals Management Service (MMS) inspection program as well as the five alternative programs described in Chapter 4. The assessment was made on the basis of the considerations described in Chapter 5. PRESENT PROGRAM The present program of regulation and inspection was initiated in the aftermath of several major offshore accidents, involving both loss of life and pollution of the environment, which occurred in the 1968-1971 period. The program was developed predominantly on the basis of industry recommendations. Given the urgent need for action at the time, this approach probably was the only practical solution. Since that time, after nearly 20 years of regulation and monitoring for compliance by USGS, and later by MMS inspectors, there clearly has been improvement in operational safety and in industry's attitude toward safety. Nevertheless, for the reasons outlined in Chapter 1 (see "Summary") and because of advancements in safety technology, a fresh look at the effectiveness of the present program is indicated. Responsiveness in Meeting Present Safety Needs: Adaptability to Changing Circumstances The present MMS inspection program is responsive to the express terms of the Outer Continental Shelf Lands Act (OCSLA)i.e., (1) annual announced inspections are conducted of essentially all OCS facilities subject to environmental and safety regulations, and (2) unannounced spot inspections are conducted of a reasonable proportion of the facilities (although manpower constraints in the Gulf of Mexico have resulted in fewer spot inspections than programmed). More important, however, is whether the substantive safety objectives of the OCSLA are being achieved. These objectives-occupational (personnel) safety, environmental protection, resource conservation, and protection of property (primarily OCS facilities)are stated only in general terms in the statute and their purview is dependent on specific guidance promulgated by MMS. This guidance currently is reflected in the national outer continental shelf (OCS) orders and the potential incidents of non-compliance (PINC) list described in Chapter 2. On the one hand, the committee's study led it to question the adequacy of that guidance in addressing the full spectrum of safety issues. On the other hand, the committee has come to believe that a number of PINCs require inspector activity that may be superfluous, given the essential checks that the operator must conduct to maintain his operation at an acceptable level of productivity. 58

OCR for page 58
s9 To determine whether the PINC list addresses items that historically have contributed to accidents, the committee reviewed the MMS "Events File," which contains brief summaries of accidents (see Figure 6-1 for a typical listing) for cases in the period 1982-1986 involving deaths in the Gulf of Mexico. The committee found that there were 63 deaths and 31 injuries caused by the 54 events in the period. (Table 2-12 presented an overview of these findings.) Each event was classified by basic root cause, to the extent this could be derived from the file, and the causes were listed in order of number of events. An attempt was then made to identify any PINC violations that could have contributed to the cause of the event. Six of the events (11 percent) had either an unknown cause or one completely unrelated to MMS responsibility. Another 45 of the events (80 percent) were covered (if at all) only by the "all-purpose" PINC number G-400 ("Is each operation performed in a safe and workmanlike manner and are the necessary precautions taken to prevent accidents?"~. Of the remaining 9 percent, two electrical events possibly could have been caused by violations of G-300 ("Is electrical equipment installed, protected, and maintained in accordance with the National Electric Code?"~; two events caused by gas being vented during well workovers could be attributed to a violation of D-408 (condition of valves, pipe and fittings); and one event could have been caused by violation of one of several welding PINCs. None of the events was caused by or related to failure of a device whose testing is currently being witnessed by the MMS. While this result could be seen as proof of the effectiveness of the MMS program, it is the committee's perception that even though the program undoubtedly has advanced the safety of OCS operations the foregoing result indicates that it is not sufficiently broad in scope. The following findings give further weight to this perception. The committee reviewed the events file for 1982 for deaths, injuries, fires, and pollution in Gulf of Mexico production operations. It was necessary to go through the listings for all 263 events to develop Tables 6-1 through 6-6, which group the events by cause. Only 42 (16 percent) of the events could have been caused by a specific incident of non-compliance (INC) other than G-400. Of these, 19 (7 percent of total events) were associated with small oil spills from overflow of drip pans and sumps (E-103 and E-100. Seven (3 percent of the total) potentially were associated with electrical system INCs (G-300) and five (2 percent) with welding operation PINCs (G-206~. Four events could have been caused by violation of PINC P-301 ("Is engine exhaust insulated and piped away from the fuel source?"~. Six events (2 percent) potentially were due to violations pertaining to shutdown devices. Of these six, two events involved devices that were bypassed at the time of the event and two involved devices that were required but not installed; only PINCs P-167 and possibly P-700 (one event each) potentially involved safety devices that failed to operate (see Table 6-6~. (It also is possible that some of the sump overflows could have been due to failure of a sump high-level shutdown, but this is not apparent from the data.) In any case, it is clear that very few of the events were caused by the failure of a safety device to activate. The rarity of events caused by failure of safety devices does not prove that the regulations requiring the installation and testing of these devices are unwarranted. It is likely that these requirements are preventing events that otherwise would have occurred. However, the dam do indicate that further reduction of events cannot be accomplished by mandating more stringent testing, inspection, or quality control procedures with regard to the already mandated safety devices. 2 The total of events cited in Tables 6-1 through 6-4 is larger than 263 due lo attribution of multiple causes to events in some cases. 2One of the committee members who specializes in risk management, Dr. Edwin L. Zebroski, has studied the Piper Alpha platform disaster. He notes that the PINC inspection process, even using the most liberal interpretation of item G-400, would have picked up few if any, of the many deficiencies in operation, staffing, and maintenance practices that contributed to that catastrophic event.

OCR for page 58
60 FATALITIES 1982-1986 File Number -- Table List -- In Accident Report Area and Block------- OCS Area ------------- GOM Disoict Office ------- Lease Number --------- Water Depth ---------- 0240' Distance Tom Shore -- 079 Mi Operator ------------- Type of Operation Production Type of Facility Type of Production Facility Steel Tower Type of Eventts) it. Are Inju?y Fatality OCS ~ EVENTS FILE Structure --- List -- Cause of Event Other vessels and tanks (incl. surge and prod. tanksJ other (specify)Pressure buildup in tank Source of ignition Hot exhaust List -- E~ects of Event Number of men injured Number of fatalities -------------------- 1 General Remarks A platform well service employee was fatally burned when he was sprayed with diesel Mel as he removed a plug from the top of a diesel storage tank to check the fuel level. Apparent), filling operations by the fvessel's] pumps were not completely shut down before the deceased had replaced the tank vent plug, which caused a pressure buildup in the land Ignition occurred immediately and was most likely caused by the generator en~ne's exhaust direct) overhead. Date of event: FIGURE 6-1 Typical listing of accidents in the MMS Events File. SOURCE: MMS, OCS Events File. [Information that identifies the specific platform has been deleted.]

OCR for page 58
61 TABLE 6.-1 Evaluation of Event.Listing for Accidents Causing Deaths tin the Gulf of Mexico, 1982 Description...of cause Number of Number of events deaths Potential PING violations 1. . Falling from height 2. Opening.a pressurized system for maintenance 3. Drowning 4. Helicopter accidents : 5. Unknown 6. Design violations 7. Handling heavy loads 8. Illness/heart attack/overexertion Totals . 2 2 2 1 1 1 11 2 2 2 2 1 1 1 13 G-400 G-400 G-400 NONE UNKNOWN p 653a G-400 NONE aThis may have been a system operation, in which case it would have been listed under cause #2. TABLE 6-2 Evaluation of Event Listing for Accidents Causing Injuries in the Gulf. of Mexico, 1982 Description of cause. Number of .. events .- Falling from height Handling heavy loads (including crane accidents) Loss of footing/walking .into objects 4. Improper use of tools or equipment 5. - Opening.pressurized equipment 11 6. Engine/compressor/turbine. 6 maintenance and operation 7. Boat accidents 8. Sandblasting operations 9. Illness/heart attack ~ 10. Welding and cutting operations 1 1. Walkway failures 12. Drain and sump systems 13. Design violations 14. Helicopter accidents 15. Electrical shorting 16. Diving operations 1 7. Unknown Totals 36 35 25 17 5 5 4 4 3 1 1 157 Number of Potential PING injuries violations 37 35 25 17 15 11 9. 5 4 5 3 4 3 2 1 178 G-400 G-400 G-400 G-400 G-400 G-400 G-400 G-400 NONE G-206, G-400 NONE G-400 P-653 NONE G-300 G-400 UNKNOWN

OCR for page 58
62 TABLE 6-3 . Evaluation of Event Listing for: accidents Causing Pollution in the Gulf of Mexico, 1982 Description of cause 1. Unknown 2. Drain and.sump systems 3. Liquid discharged through vent 4. Handling heavy loads 5. Pipline leak/failures 6. Equipment failures 7. Drip pan design 8. Boat collisions. 9. Safety devices bypasses 10. Poor operating procedures 11. Welding and cutting operations 12. Opening pressurized system 13.: Electrical shorting i 14. Improper tool or equipment use 1 15. Control component failure Totals 15 13 8 5 5 5 3 2 2 64 Number of Number of events - barrels Potential PING violations 38 34 18 16 15 13 13 6 6 48 2 2 . 1 214 UNKNOWN E-103 NONE G-400 E-100, E-104 E-103, P-653 E-100 G-400 P-100 G-400 G-206 . . G-400 G-300 G-400 P-167 TABLE 6-4 Evaluation of Event Listing for Accidents Causing Fires in the Gulf of Mexico, 1982 Description of cause Engine/compressor/turbine maintenance and operation Unknown Welding and cutting operations 2. 3. 4. Equipment failure 5. Electrical shorting 6. Opening pressurized system 7. Improper tool or equipment use 8. Poor operating procedures 9. Lightning 10. Drain and sump systems 11. Design violations 12. Sand blasting operations 13. Improper material storage 14 - . . 15. Totals Llqula alscnargeo through vent Control component failure .~ Number of Number events injured 13 8 7 5 3 2 2 2 1 1 1 1 - 50 10 1 o o 3 1 o o 4 3 1 o o o 24 Potential PING violations P-301, G-400 UNKNOWN G-206, G-400 G-300 G-300 G-400 G-400 G-400 NONE G-400 P-653 G-400 G-400 NONE P-700

OCR for page 58
63 TABLE 6-5 Summary, 1982 Offshore Event Listing (Production) Number of Potential events PINC violations 1. Handling heavy loads 2. Falling from height 3. Lost footing 4. Unknown 5. Improper tool or equipment use 6. Opening pressurized systems 7. Drain and sump systems 8. Engine/compressor/turbine operations 9. Equipment failures 10. Welding and cutting operations 11. Liquid discharge from vent 12. Boat accidents 13. Electrical shorting 14. Sand blasting operations 15. Pipeline leak/failure 16. Illness/overexertion/heart attack 17. Drip pan design 18. Walkway failures 19. Poor operating procedures 20. Safety device bypass 21. Lightning 22. Control component failure 23. Drowning 24. Diving operations 25. Helicopter 26. 27. Totals Improper materials storage Design violations 41 37 25 23 19 14 14 14 10 9 9 8 5 5 5 4 3 3 3 2 2 2 2 1 1 263 G-400 G-400 G-400 Unknown G-400 G-400 G-400, E-103 P-301, G-400 G-300, E-103, P-653 G-206, G-400 NONE G-400 G-300 G-400 E-100, E-104 NONE, G-400 E-100 NONE G-400 P-100 NONE P-167, P-700 G-400 G-400 NONE G-400 P-653 It should be pointed out that the events files do not specify whether an INC caused or contributed to the magnitude of an event. Thus, the analysis of potential PINC violations in these six tables only indicates the INCs that potentially might have been related to the cause of the event; it does not indicate that an INC necessarily existed at the time of the event. It was necessary for the committee to develop these data from the MMS's computer listings. Similar analyses of the events data by MMS were not available. Such analyses could, however, aid in the evolution of the inspection program. The committee also analyzed 262 events in 1982 pertaining to drilling and workover operations, though not in as much detail as it did the events related to production operations. Table 6-7 summarizes these events by category of cause. No attempt was made to tie the cause of events to possible PINC violations. The drilling PINC list is concerned mainly with well design, operating procedures and tests, and equipment necessary to control wells to minimize the occurrence and consequences of well-control failures. Of the 1,606 wells drilled and worked over in 1982, only 8 incurred well-control failures. Devices that the MMS requires to be installed and

OCR for page 58
64 TABLE 6-6 1982 Event Listings - Summary by PING Violation PING violation Number of events G-400 None Unknown E-103 G-300 G-206 E-100 P-301 P-653 P-100 E-104 P-167 P-700 162 35 24 14 7 5 5 4 2 2 TABLE 6-7 Summary of 1982 Offshore Event Listing (Drilling) . . . Cause of event Number of events Falling, handling heavy loads, etc. Tank runover, ruptured hose Electrical systems Loss of well control Pollution from mud circulating system Welding Opening a pressurized system Equipment overpressure Premature firing of perforating gun Boat collision Unknown Tota s 209 16 9 8 5 4 3 1 1 2 4 262 ., tested prevented fires in 4 of the 8 events. The extent of injuries or oil pollution in the course of the 8 blowoutsalthough clearly not major, based on collateral evidence regarding major accidents in 1982 cannot be determined from the events file, as this information is not reported for some of the events. It must be kept in mind that any well-control failure involves the threat of loss of life and a large spill.

OCR for page 58
65 In 1982 there were approximately 275 drilling or workover facilities and 2,900 production platforms in the Gulf of Mexico. The events file indicates that there were 0.95 events per drilling or workover facility and 0.09 events per production platform in that year. Therefore, for 1982, the number of events during drilling operations was 10 times that for production operations. (In periods of low drilling activity, such as 1986, the frequency of events was 3 to 1 for drilling operations compared to production operations.) As was noted earlier, the population of drilling personnel on the U.S. OCS in 1982 was at least as large as the population of production workers. As with production events, the majority of drilling events were related to human error and operating and maintenance procedures. The committee believes that a regular review of the events in drilling operations as they occur could lead to improved regulation and inspection techniques. For these and other reasons the committee believes that continued frequent onsite inspection of drilling rigs is important. In the aggregate, the committee's analysis of the 1982 events file shows that the vast majority of events in both drilling and production operations resulted only in minor personnel injury, small flash fires, or small oil spills. These events, which stemmed from human error in operating and maintenance activity, suggest a lack of proper attitude and awareness toward safety on the part of workers, supervisors, and management. The current MMS regulations, with their emphasis on well control in drilling and workover operations, and process upsets in production operations, are designed to avoid major disasters. However, historically disasters frequently are preceded by low-level events caused by inattention and a poor attitude toward safety, deficiencies that can be identified by safety analysis. Overall, the weaknesses of the present program are as follows: Full compliance with the testing requirements of the PINC list does not necessarily address essential safeW elements comprehensively, especially those involved in the low-level eventsmany of which involve human error-that represent the majority of events (accidents). Operators may be motivated to concentrate their safety efforts on maintaining devices that they expect an MMS inspector will require them to test while following a PINC list, rather than on systematically addressing measures to improve the overall safety of their operations and to conduct them in a Safe and workmanlike manner.n The emphasis in the PINCs on individual mechanical components inhibits a rigorous evaluation by MMS of the overall safety of the operation. In production operations, the PINC list and the ratio of INCs to PINCs to a large extent address the reliability of selected devices in operating within prescribed tolerances. MMS has not established that these data are, in themselves, sufficient indicators of safe operations. The PINCs themselves place almost total emphasis on mechanical tolerances and do not leave enough room for safety judgment. MMS's focus on incidents of non-compliance tends to obscure the fact that the responsibility for safety lies with the operator, and not with the MMS. In these circumstances, an evaluation of the commitment of the operator toward good safety practices, much less any erosion thereof, tends to fall by the wayside. The ideal philosophy for safe operation of OCS platforms, of course, is that every operator will strive to ado the job right the first time," so that the role of the MMS inspector can be limited to verification. On the other hand, given the importance of safety devices in protecting life and property, what might be termed "micro-inspection" can lead to an operator attitude that the MMS inspector will detect anything that is wrong and that, in the absence of overt indication of a problem, the operator can concentrate on production.

OCR for page 58
66 Responsiveness to Other Evaluation Considerations Maintenance of Public Confidence An important element in the effectiveness of a federal regulatory program dealing with safety is the degree to which the public has confidence that its interests are being safeguarded. This is particularly critical with respect to OCS activities in light of the federal government's interest in realizing the substantial revenues to be derived from OCS development. On the Gulf Coast the question of public confidence in MMS' role in the safety of OCS operations is a dormant issue. The gradual migration of the center of industry activity from shore to marshes and lakes and to the open sea, its current remoteness from population centers, and its pervasive importance to the Gulf Coast economy all have combined to make the attendant risks an accepted part of the local scene. On the Pacific Coast, by contrast, there is a segment of the population which is unalterably opposed to any offshore development. This opposition tends to override the issue of public confidence in the MMS inspection program as such; the consuming issue is development in general, not the nuances of addressing day-to-day safety problems. In these circumstances it cannot be said that there is substantial public interest in the specifics of the MMS inspection program. In Alaska, on the other hand, the high level of public concern and threatened litigation resulted in lease stipulations responsive to public concerns which, in large part, have shaped-the inspection program there. Use of Resources This study was prompted primarily by MMS's concern regarding the efficient utilization of government resources. The committee a3grees that there are problems involving the utilization of the MMS inspection staff. A utilization percentage on the order of 59 percent (Pacific) and 70 percent (Gulf of Mexico) of compensable time is unacceptable on its face. Some inefficiencies appear to result from MMS's inspection procedures. The substantial time spent in hurried records checks while at a facility would be better spent in direct inspection activity, with intensive records review conducted ashore, either before or after the facility inspection. Further efficiency in personnel utilization could be achieved by lengthening the work day to accommodate visits to more facilities. (Work rules would have to be changed to accomplish this, perhaps involving new legislation). The committee believes that changes of this nature could accomplish marginal improvements in productivity and decreases in transportation costs. It is questionable that they would result in any substantial impact on the safety of operations. Assessment of the cost/benefit ratio of the present inspection program is not feasible on the basis of available data. That is, while MMS costs can be established with reasonable certainty, and while they can be applied to determine cost per inspection, cost per violation detected, etc., a measure of the safety impact of the programin terms of such significant objectives as accidents, injuries, or pollution incidents prevented-is not feasible. It can be said that the cost per inspection is high;4 that the cost per violation reported is even higher; that the number of major accidents is low; and that the fatality rate is similar to that of other heavy, labor-intensive industries (equivalent to that of the mining industry, for example). All in all, the true safety picture on the OCS and its relationship to the MMS inspection program cannot be defined quantitatively. (However, it is 3Time engaged in actual inspection and other assigned duties vs. total time the helicopter transit time is not included in the time credited to inspection. inspector is on duty; 4In FY 1987, average helicopter cost per inspection visit was $440 in the Pacific Region and $675 in the Gulf of Mexico (Rig", 1988a, 1988b).

OCR for page 58
67 possible to make a qualitative assessment as to whether a particular change in the inspection program would result in a higher or lower cost/benefit ratio.) Qualification and Training of Inspector Force The committee noted that inspectors receive little formal education in safety practices and inspection techniques. (Their training places primary emphasis on testing of devices and much less on safety practices.) While on-thejob training (OJT) gives inspectors sufficient insight into the processes they are to inspect (and channels them into specializing in either production or drilling inspections), OJT can fail to give an adequate conceptual understanding of the goals of an inspection. Further, OJT does not give inspectors an understanding of a large variety of inspection techniques, particularly in making judgments about safe and workmanlike procedures. Despite the fact that to some degree inspectors are rotated, they and their individual habits and areas of emphasis during an inspection appear to become well-known to facility supervisors and their key personnel. This is particularly true in the Pacific region, where a relatively few inspectors deal with only a handful of platforms. The committee gained a clear impression that operators there attempt to anticipate the inspector's inspection pattern. Identification of Safeb Trends and Warnings Identification of significant safety indicators and better data collation are needed to provide a clearer picture of safety problems on the facilities, so as to establish trends. While MMS maintains that the compliance record is a primary factor considered in selecting facilities for unannounced inspections, the committee saw indications that transportation costs and scheduling may be a more significant factor in the field. Moreover, a violation record involving no more than the failure of a device to trip at its specified set point or the failure of a check valve to seal within the small tolerances specified by MMS, for example, does not necessarily translate into a poor safety record. Further, until more directly relevant data can be collected and collated effectively, it will not be possible to assess the impact of safety-related changes introduced into the offshore oil and gas industry. Until then, improvements in equipment and process can be introduced only on an instinctual basisnot necessarily a bad procedure, but not the way to ensure consistent results. Safety Performance Accountability The present program does lend itself to a degree of safety accountability for individual inspectors, operating personnel, supervisors, and operators by measuring, for example, the PINCs inspected and INC/PINC ratios. However, this focuses the inspection process further on compliance with specific regulations rather than on the evaluation of safety attitudes and procedures that underlie the overwhelming number of events. That is, the data bases currently being put together by the MMS provide data to hold individual inspectors, operators, etc., accountable for compliance activity. The present approach does not incorporate the kind of accountability for safety that leads inspectors, operating personnel, supervisors, and operators to address safety as a system rather than an item-by-item checkoff. Precedents Compared to the state regulatory regimes governing offshore oil and gas drilling and production activity in their waters the MMS program is more rigorous, both as to the scope of

OCR for page 58
68 regulation and the onsite presence of inspectors. (It should be noted that wells and facilities in shallow water generally are not as complex as those located in deeper water.) The committee was not able to develop data that presented a valid insight into the safety record of operators in state waters; but no evidence was apparent to suggest that there had been significant numbers of major accidents. Practices in other nations were surveyed with a view to developing possible alternatives for adoption in this country. They ranged from an essentially laissez faire attitude in several developing countries to a system seemingly more pervasive than our own in the North Sea fields administered by Norway. The United Kingdom's system, though comparable to our own in substance, differed significantly in that the day-to-day oversight was in the hands of third-party inspectors (typically classification societies certificated for this purpose by the government.) The Norwegian system places particular emphasis on the responsibility of the operator for maintaining quality control and the safety of operations. The Norwegian Petroleum Directorate monitors the operator's safety control system rather than the operator's activities (MIT, 1986~. A risk analysis, that focuses on personnel safety, which addresses hazards, their consequences, and possible methods for mitigating them is often employed in development of a system of internal control (i.e., operator's quality control) of safety. Risk analysis is practiced in Norway, but it is oriented more toward identifying risks associated with large-scale catastrophic events than routine workplace accidents. Risk analyses are provided by the licensee in the concept safety evaluation conducted by the Norwegian Petroleum Directorate as part of the initial project approval. Subsequent platform modifications may invalidate this risk analysis as noted in a review of Norwegian and British uses of risk analysis in offshore operations (MIT, 1986~. (See Appendix H for a description of the Norwegian and British systems.) ALTERNATIVE 1: INCREASED INSPECTION ONSITE BY MMS This alternative, mirroring as it does the present program, was analyzed solely with respect to the potential impact of "more of the same." The negative elements of the present program probably would not be exacerbated, with the possible exception that an increased MMS presence on Gulf of Mexico platforms would lead operators to place even greater reliance on an expectation that MMS personnel will detect anything that is "wrong." In this event there would be a further clouding of the fact that the operator has ultimate responsibility for safety and a corresponding diminishment of operator safety consciousness. While in some cases the increased presence of enforcement personnel has a positive influence on public confidence, it seems unlikely that this step would be significant with regard to public perception of the MMS's effectiveness in ensuring the safety of offshore operations, given the limited public awareness of the nature of the agency's activity. Nor would such an increase be an effective use of personnel resources as the program is presently structured. Additional personnel would be needed, as would additional funds for transportation services. Since the only benefit would be the witnessing of more of the same kinds of tests and drills, whose correlation to promoting safety the committee questions, the committee sees no merit in this alternative. This assessment has been reached notwithstanding the fact that the gathering and evaluation of additional data has been urged by the committee as a necessary precursor to more effective inspection activity. However, the type of data that is needed is not an increased flow of reports of INCs, but a flow of information that defines more broadly the day-to-day safety deficiencies being, encountered on offshore facilities.

OCR for page 58
69 ALTERNATIVE 2: INSPECTION OF A SAMPLING OF PINCs DURING ANNUAL INSPECTIONS, AND INCREASED SPOT INSPECTIONS While rejecting the concept that an escalation of the MMS's present program would be beneficial, the committee nevertheless was struck by the fact that, at all levels, the agency and the operators believe that the MMS inspection presence promotes industry safety awareness. Some of this belief is based on the perceived quality and scope of MMS oversight; however, other factors contribute more emphatically to the consensus. Many operators who are intent on conducting safe operations through a conviction that it is economically sound practice express the feeling that the credibility of the industry's commitment to safety would be threatened by the actions of the less scrupulous operators if the possibility of an MMS spot inspection were to be reduced. Employees concerned about a safety hazard that management is not addressing to their satisfaction want to be able to aim an inspector in the "rights direction" MMS inspectors believe they bring a different viewpoint, which frequently enables them to detect problems that are overlooked by personnel preoccupied with the facility's ongoing operations. This strong predilection for an MMS presence, which the committee shares, led the committee to explore ways in which to enhance the effectiveness of MMS inspections at present personnel and budgetary levels. The committee examined whether the utilization of sampling techniques (see Appendix G) could enhance the effectiveness of the MMS inspection program. Sampling theory is a widely accepted technique for improving the efficiency of inspection programs. However. it is highly dependent on a properly developed sampling plan designed to verify the data recorded by the party being inspected. The committee believes that a valid sampling plan can be developed for witnessing tests of selected items on the PINC list during inspection of OCS oil and gas production facilities. However, better use needs to be made of the facility records, which represent considerable time and effort expended by the operators on conducting periodic tests to meet MMS requirements, as well as ore maintaining the prescribed records. Review of the records in greater depth before an onsite inspection could focus the inspection more sharply. With proper controls, the records could take the place of many MMS-witnessed tests and provide the basis for developing the sampling protocols. This alternative could lead to a program based fundamentally on the operator regularly performing the scheduled inspections, followed by selective inspections performed by MMS personnel utilizing a sampling plan. Making the tests performed by the operating personnel a formal part of the facility's MMS inspection program should foster a secondary benefit of extending safety involvement to all employees; it should help to focus attention on the fact that safety is derived from proper operating practices, rather than being the result of inspections. Integrating the efforts of the MMS inspectors with those of the operators should reinforce the nrecent thnt c~f~tv is the responsibility of the operator; if no more than a shift in attitude results, the outcome should be a level of safety higher than that achieved with the present system. At the heart of this alternative is the commitment of time to an increased number of unannounced spot inspections, which will enable MMS inspectors to observe operating procedures more frequently and assess safety attitudes more accurately. While the committee is confident that the use of sampling techniques in conducting onsite tests and inspections can provide oversight of offshore operations that meets the objectives of the OCSLA, which is superior to that being achieved using present procedures, it also recognizes the possibility that questions could be raised as to whether sampling meets the specific OCSLA mandates relating to announced and unannounced inspections. The committee takes no position on the need for legislation in order to undertake a sampling program, but urges that legislation be sought if deemed necessary. The committee does note, however, that the Coast Guard has undertaken a sweeping change in respect to regulations it , ~ , rim rim ~ ~-

OCR for page 58
70 administers, based on an administrative interpretation of the OCSLA to the effect that Coast Guard personnel do not have to conduct all OCSLA inspections.5 As discussed in reference to other alternatives, the "public perception" issue does not appear to be an important one in addressing the acceptability of various inspection strategies. The alternative under consideration here does not involve a reduction in MMS activity offshore but a reallocation of effort, and accordingly should be relatively immune to public criticism. The real advantage of the alternative lies in a more productive utilization of the current inspection force, both in terms of the activity it will undertake and in the better scheduling of its time and transportation services. Given a more efficient use of resources in terms of cost, the improvement in cost/benefits ratio still might be marginal unless there is a substantial improvement in the impact of inspections on the safety of operations on the OCS. This is the key element of this alternative. Improvement will follow only if the resources freed from having to witness tests are applied to evaluating events (accidents) and disruptions (mishaps) and to conducting safety analyses and if the inspection program is modified to assess safety-related attitudes. As was pointed out in Chapter 4, no change will result in more than marginally better safety without the identification and collection of more meaningful data. While a PING sampling program can be initiated with minimal risk on the basis of presently available data, upgrading of data will have to be given high priority in order to refine the sampling program into one that will give the MMS, the industry, and the Congress confidence that the safety hazards of OCS operations are identified, understood, and addressed effectively. The following chapter elaborates on data needs and the reallocation of some inspector resources into data analysis to improve sampling and safety. Although the committee believes that MMS inspectors are selected and trained to sufficiently rigorous standards to conduct their present inspection role satisfactorily, it has some reservations about the qualifications and training of inspectors with regard to the breadth of their understanding of inspection techniques, particularly of statistical sampling concepts. Many inspectors will require intensive training before they could be effective in a more sophisticated inspection regime, such as one built around safety analysis, sampling techniques, and audits of operator records. Additional training also will be required to enable the current inspectors to assess operator attitudes toward safety and to identify procedures that involve poor safety practices. Learning to assess attitudes will be even more difficult than moving from witnessing all tests to witnessing a sampling of tests. The focus of an inspection based on a sampling program is to determine the accuracy of the operator's records and to hold him accountable for his reported tests. In this sense, operator accountability is improved by this alternative program. ALTERNATIVE 3: ANNUAL INSPECTION OF A SAMPLING OF FACILITIES AND INCREASED SPOT INSPECTIONS The committee considered the application of sampling theory to identifying selected facilities for annual witnessing of tests while foregoing the annual announced inspection at the others. Depending on the level of confidence that could be established for this approach, a substantial 5The Coast Guard's regulations deal with the number and condition of lifesaving devices such as evacuation capsules, life rafts, and personal flotation devices, firefighting devices, both fixed and portable, and aids to navigation. In addition, the Coast Guard is responsible for general workplace safety. The Coast Guard's inspection program requires operators to perform (and report to the Coast Guard) all annual inspections. These inspection are augmented by a Coast Guard oversight program of random announced inspections, a headquarters analysis of inspection reports filed by operator and Coast Guard personnel, spot inspections of facilities with poor safety records or questionable reports, individual investigations of worker complaints, and investigations of casualties.

OCR for page 58
71 reduction in manpower and fiscal resources required to witness tests could be realized. An integral element of this alternative is a step-up of spot inspections to ensure that facilities not included in the announced annual inspection sample would receive at least one spot inspection during the year. The spot inspections would not have extended to witnessing a large number of tests. This alternative might not result in literal compliance with the requirements of the OCSLA mandating an announced annual inspection and periodic spot inspections, therefore it might require legislative action prior to adoption. However, to the degree that an effective sampling plan can be developed, this alternative would meet the safety objectives of the OCSLA while freeing personnel, time, and funds for more productive activity. Potentially, this alternative could have a highly positive impact on the safety awareness of operators and operating personnel whereto a greater degree than in the case of the PINC sampling program just described could find themselves in the event of an accident having to explain a safety deficiency on a platform that had not been recently inspected by MMS. The reduction in the number of facilities receiving complete inspections by MMS inspectors conceivably could arouse public concern, which might require a public awareness program by MMS explaining the concepts underlying the selected-facility alternative. As in the case of the PINC sampling alternative, key elements of the acceptability of the selected-facility alternative are a concurrent improvement in data collection and an aggressive safety analysis program. To the degree that these elements are accomplished, the forecasting of safety trends may well be enhanced, since it will be possible to look at safety data in terms of an integrated operating system (i.e., a facility). To be able to develop safety indicators that would identify a potentially problem-prone facility would add greatly to the efficiency of the MMS inspection process. This alternative would place far greater demands on the analytical skills of the MMS inspectors, who would require extensive training in the use of modern risk assessment tools. It might be necessary to wait until a new generation of inspectors is in place before implementing this alternative. Future recruiting could accommodate this need over time so as to phase in personnel with these skills without displacing the present inspectors, who could continue to perform their present tasks. Once in place, this alternative would afford MMS a high degree of flexibility in allocating its inspection resources to address problem areas. MMS responsibly could defer inspections of operators whose safety performance was superior, in order to concentrate on those encountering problems; or it could ease off inspections of categories of PINCs in which no problems were being encountered to concentrate on those that have posed safety hazards. This alternative, placing as it does an additional burden of accountability on operators and operating personnel, might diminish the accountability of individual MMS inspectors and their supervisors for the performance of detailed inspection tasks. However, the overall accountability of MMS for the safety oversight of the industry should be enhanced by the fact that better data, more intensive safety analysis, and selective inspection activity should give MMS a better overall picture of the safety of the industIy's operations (see Chapter 7~. In the committee's view this alternative represents an achievable long-term goal. At the moment, however, it is not feasible given the limited amount of safety data available, which would make formulation of a suitable selected-facility sampling program impossible. However, this alternative could flow naturally from the successful implementation of alternative 2, the PINC sampling alternative. ALTERNATIVE 4: THIRD-PARTY INSPECTION WITH GOVERNMENT AUDIT In this alternative, operators would contract with private organizations certificated by MMS to perform the annual and spot inspections now being performed by MMS inspectors. (At the

OCR for page 58
72 operator's option the private organization could also perform the inspections now performed by the operator's own personnel. The third-party organization would maintain the records prescribed by MMS (which would be subject to spot audit by MMS) and submit copies of the inspection reports to MMS so that the quality of the inspections could be verified. As in the case of some of the other alternatives described in this report, this alternative might require legislative authorization. Whether the objectives of the OSCLA would be better achieved by this or the present system is a matter of conjecture greatly influenced by the biases of the evaluator. Those supporting an increase in private-sector activity suggest that greater efficiency would result at no risk to attainment of the OCSLA's safety objectives; those who believe that government inspectors are the only ones sufficiently committed to the public interest to provide objective inspection services maintain that monetary savings would be doubtful and in any event not worth the ensuing degradation in the safety program. What is indisputable is that monitoring the performance of private inspection organizations in itself would pose significant difficulties. An MMS program to maintain a register of private-sector engineering consultants qualified to perform certifications of platform design, fabrication, and installation, which was undertaken some years ago, was abandoned due to difficulties in keeping it current. It is hard to assess the impact that this alternative might have on the safety consciousness of operators. With adequate precautions to obviate conflict-of-interest situations, there is no reason to believe that third-party inspectors would not conscientiously carry out their duties so that the compliance element of the inspection process would be unchanged. This fact in itself, however, provides the operator with the same kind of shelter that he now has when he successfully "passes" an MMS inspection. Thus, the committee believes that there would be negligible impact on safety consciousness; the tendency toward Compliance mentality" would not be corrected by this alternative. The drastic reduction in MMS presence on OCS facilities could raise public concern. Moreover, as noted earlier, there is strong sentiment in the industry, on the part of offshore operators and employees, as well as MMS employees, that the regular presence of MMS personnel has positive benefits on safety which should not be foregone. With the reduction of their inspection duties, MMS inspectors would have time to perform the audit and safety analysis functions the committee described earlier as providing the MMS with better insight on operational safety on the OCS. In this case, however, they also would be required to conduct audits of the private inspection organizations. These functions in the aggregate could be performed with greater scheduling flexibility than direct inspections and would allow MMS to make more effective use of its personnel resources (although there might be some degradation in the inspectors familiarity with the practical aspects of OCS operations). The overall cost of this alternative probably is higher than that of the other alternatives described in this report, since it introduces a new group of inspectors into the process (paid directly by the operator, or as an add-on to the MMS budget, depending on the variant adopted). Some reduction in the number of MMS inspectors would be possible in the case of either variant, but some redundancy would remain and the MMS audit of inspectors would likely involve higher cost per inspection. It is questionable whether there would be a sufficient improvement in effectiveness to offset the additional costs involved. Paralleling, as it does, the substantive aspects of the present program, the alternative would produce no direct improvement in the development of data useful in improving safety trend analysis. However, adoption of this alternative would not foreclose a transition into one of the other alternatives described (e.g., alternative 2), in which such benefits are realized. In fact, such a transition might be facilitated since the MMS personnel would be able to concentrate their attention on program development without the distraction of day-to-day involvement in facility inspection. 6As discussed in Chapter 4, a variant would be that MMS would hire the third-party inspection services directly. The committee believes that the following analysis is equally pertinent to this variant.

OCR for page 58
73 Adoption of this alternative would involve difficult transition problems in training the MMS inspectors to perform audit functions relating to the activities of third-party inspection organizations. These skills are less related to the background of the inspectors than those involved in witnessing tests, and might require protracted retraining. The use of private-sector inspectors probably would provide some additional flexibility to MMS in modifying the inspection program in the face of changing circumstances. The degree to which this flexibility would be meaningful depends entirely on the ability of MMS to develop better data collection and evaluation processes. A fundamental challenge in adopting this alternative is development of the audit plan for overseeing the activity of the third-party inspection organizations. Without an effective scheme allowing MMS to follow un on the performance of the Drivate-sector inspectors. some operators - could experience a very rapid deterioration in the safety of their operations. With government inspectors no longer involved in direct inspection activity, it might be difficult for MMS to ensure that its mission was being carried out effectively. Third-party inspection programs are not commonplace in the federal regulatory scheme, although they do exist. For example, there is statutory authority for the Coast Guard to delegate a wide array of marine safety functions to the American Bureau of Shipping (a classification society of the type utilized by the United Kingdom to conduct its inspection program for offshore oil and gas operations). The Coast Guard has made numerous delegations under this authority, but it has not delegated operational inspections. None of the states' programs involve third-party inspectors. A transition to a third-party inspection program with government audit would not of itself result in an improvement in the safety of offshore operations, nor would it result in a more efficient inspection scheme. It presents difficulties for the MMS in conducting oversight that it may not be able to handle without substantial near-term disruption, during which safety oversight might be seriously compromised. ALTERNATIVE 5: SELF INSPECTION The thrust of the views presented to the committee was that hazards presented by offshore gas and oil operations are too significant to consider an inspection program that does not involve direct government oversight. Although, as in the case of the other alternatives, this alternative involves extensive assessment of operator data in meeting the safety objectives of the OCSLA, there is a basic difference: the others still rely on a regular (if more limited, in some cases) oversight by MMS inspectors or their profanes to verify the operator's inspection activity and his records. Full self-inspection would involve a loss of the motivational benefits of a governmental presence referred to in Chapter 4. It certainly would risk a loss of public confidence in the safety of OCS operations, and might be seen as an abandonment of governmental responsibility. Substantially more MMS resources would be available for SpOt inspections and safety analysis activities, as noted in Chapter 4. But it is likely that the collection of valid, detailed data needed for those analyses would become more problematical, as the frequent direct contact between MMS inspectors and operating facilities and personnel was lost. For the same reason, the day-to-day performance of OCS operators would become more difficult to ascertain. In the absence of government inspection, the operator's accountability for poor performance seemingly would be self-evident. Nevertheless, after a major accident, MMS's discharge of its regulatory responsibility could be questioned by the public.

OCR for page 58
74 RESULTS OF THE ASSESSMENT Having assessed the present MMS inspection program and five alternative programs, the committee made a determination that alternative 2inspection of a sampling of PINCs during annual inspections, and increased spot inspectionsoffers the greatest relative benefits. It provides an opportunity to improve the efficiency of the inspection program while retaining a substantial government presence in this area of vital public interest. It reduces the tendency toward a "compliance mentality" on the part of operator personnel while focusing the inspection on the items of hardware and procedures that are most significant from a safety standpoint. It opens the way for the program to evaluate the aggregate safety of operations on all platforms. This alternative inspection program would result in fewer total inspection man-hours required for annual inspections, as well as better targeted spot inspections. The committee recognizes that this increased efficiency could be regarded as a basis for manpower reductions. However, use of the freed resources for additional spot inspections and a program of systematic safety analyses that are needed to address recurrent safety problems is an integral element of this alternative. The necessary resources for an ongoing safety analysis program and an enhanced spot inspection program would be made available by having MMS inspectors witness only a limited number of tests during the annual inspections of production facilities, in lieu of attempting to witness 100 percent of the tests in the PINC list as is now done. The alternative also would result in lower transportation costs since the number of days spent at each facility would be reduced. While some uncertainties would be involved because of shortcomings in the MMS data base, the transition to the new inspection program could be undertaken at an acceptable level of risk concurrently with the development of analytical methods to improve the data base to make it more useful. Alternative 3annual inspection of a sampling of facilities, and increased spot inspectionsrepresents a natural and perhaps desirable extension of alternative 2. The committee considers this step to be too ambitious a change to undertake at the present time, given present limitations in the data and expertise needed to confidently select facilities for inspection. But as those limitations are overcome through the implementation of alternative 2, the selected-facility alternative would provide even more opportunity for targeting inspection resources efficiently, effectively, and intelligently at the points on the OCS where attention is needed most. Thus, implementation of this alternative represents a desirable long-term goal, recognizing that legislation may be required before it can be undertaken.