Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter.
Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 58
6
ASSESSMENT OF PRESENT
PROGRAM AND ALTERNATIVES
The committee assessed the present Minerals Management Service (MMS) inspection program
as well as the five alternative programs described in Chapter 4. The assessment was made on the
basis of the considerations described in Chapter 5.
PRESENT PROGRAM
The present program of regulation and inspection was initiated in the aftermath of several
major offshore accidents, involving both loss of life and pollution of the environment, which
occurred in the 1968-1971 period. The program was developed predominantly on the basis of
industry recommendations. Given the urgent need for action at the time, this approach probably
was the only practical solution. Since that time, after nearly 20 years of regulation and monitoring
for compliance by USGS, and later by MMS inspectors, there clearly has been improvement in
operational safety and in industry's attitude toward safety. Nevertheless, for the reasons outlined in
Chapter 1 (see "Summary") and because of advancements in safety technology, a fresh look at the
effectiveness of the present program is indicated.
Responsiveness in Meeting Present Safety Needs:
Adaptability to Changing Circumstances
The present MMS inspection program is responsive to the express terms of the Outer
Continental Shelf Lands Act (OCSLA)—i.e., (1) annual announced inspections are conducted of
essentially all OCS facilities subject to environmental and safety regulations, and (2) unannounced
spot inspections are conducted of a reasonable proportion of the facilities (although manpower
constraints in the Gulf of Mexico have resulted in fewer spot inspections than programmed). More
important, however, is whether the substantive safety objectives of the OCSLA are being achieved.
These objectives-occupational (personnel) safety, environmental protection, resource conservation,
and protection of property (primarily OCS facilities)—are stated only in general terms in the statute
and their purview is dependent on specific guidance promulgated by MMS.
This guidance currently is reflected in the national outer continental shelf (OCS) orders and
the potential incidents of non-compliance (PINC) list described in Chapter 2. On the one hand, the
committee's study led it to question the adequacy of that guidance in addressing the full spectrum of
safety issues. On the other hand, the committee has come to believe that a number of PINCs
require inspector activity that may be superfluous, given the essential checks that the operator must
conduct to maintain his operation at an acceptable level of productivity.
58
OCR for page 59
s9
To determine whether the PINC list addresses items that historically have contributed to
accidents, the committee reviewed the MMS "Events File," which contains brief summaries of
accidents (see Figure 6-1 for a typical listing) for cases in the period 1982-1986 involving deaths in
the Gulf of Mexico.
The committee found that there were 63 deaths and 31 injuries caused by the 54 events in the
period. (Table 2-12 presented an overview of these findings.) Each event was classified by basic
root cause, to the extent this could be derived from the file, and the causes were listed in order of
number of events. An attempt was then made to identify any PINC violations that could have
contributed to the cause of the event. Six of the events (11 percent) had either an unknown cause
or one completely unrelated to MMS responsibility. Another 45 of the events (80 percent) were
covered (if at all) only by the "all-purpose" PINC number G-400 ("Is each operation performed in a
safe and workmanlike manner and are the necessary precautions taken to prevent accidents?"~. Of
the remaining 9 percent, two electrical events possibly could have been caused by violations of
G-300 ("Is electrical equipment installed, protected, and maintained in accordance with the National
Electric Code?"~; two events caused by gas being vented during well workovers could be attributed
to a violation of D-408 (condition of valves, pipe and fittings); and one event could have been
caused by violation of one of several welding PINCs. None of the events was caused by or related to
failure of a device whose testing is currently being witnessed by the MMS.
While this result could be seen as proof of the effectiveness of the MMS program, it is the
committee's perception that even though the program undoubtedly has advanced the safety of OCS
operations the foregoing result indicates that it is not sufficiently broad in scope. The following
findings give further weight to this perception.
The committee reviewed the events file for 1982 for deaths, injuries, fires, and pollution in
Gulf of Mexico production operations. It was necessary to go through the listings for all 263 events
to develop Tables 6-1 through 6-6, which group the events by cause. Only 42 (16 percent) of the
events could have been caused by a specific incident of non-compliance (INC) other than G-400. Of
these, 19 (7 percent of total events) were associated with small oil spills from overflow of drip pans
and sumps (E-103 and E-100. Seven (3 percent of the total) potentially were associated with
electrical system INCs (G-300) and five (2 percent) with welding operation PINCs (G-206~. Four
events could have been caused by violation of PINC P-301 ("Is engine exhaust insulated and piped
away from the fuel source?"~. Six events (2 percent) potentially were due to violations pertaining to
shutdown devices. Of these six, two events involved devices that were bypassed at the time of the
event and two involved devices that were required but not installed; only PINCs P-167 and possibly
P-700 (one event each) potentially involved safety devices that failed to operate (see Table 6-6~. (It
also is possible that some of the sump overflows could have been due to failure of a sump
high-level shutdown, but this is not apparent from the data.) In any case, it is clear that very few of
the events were caused by the failure of a safety device to activate.
The rarity of events caused by failure of safety devices does not prove that the regulations
requiring the installation and testing of these devices are unwarranted. It is likely that these
requirements are preventing events that otherwise would have occurred. However, the dam do
indicate that further reduction of events cannot be accomplished by mandating more stringent testing,
inspection, or quality control procedures with regard to the already mandated safety devices. 2
The total of events cited in Tables 6-1 through 6-4 is larger than 263 due lo attribution of multiple
causes to events in some cases.
2One of the committee members who specializes in risk management, Dr. Edwin L. Zebroski, has
studied the Piper Alpha platform disaster. He notes that the PINC inspection process, even using
the most liberal interpretation of item G-400, would have picked up few if any, of the many
deficiencies in operation, staffing, and maintenance practices that contributed to that catastrophic
event.
OCR for page 60
60
FATALITIES 1982-1986
File Number --
Table List -- In Accident Report
Area and Block-------
OCS Area ------------- GOM
Disoict Office -------
Lease Number ---------
Water Depth ---------- 0240'
Distance Tom Shore -- 079 Mi
Operator -------------
Type of Operation
Production
Type of Facility
Type of Production Facility
Steel Tower
Type of Eventts)
it.
Are
Inju?y
Fatality
OCS ~ EVENTS FILE
Structure ---
List --
Cause of Event
Other vessels and tanks (incl. surge and prod. tanksJ
other (specify)—Pressure buildup in tank
Source of ignition
Hot exhaust
List --
E~ects of Event
Number of men injured
Number of fatalities -------------------- 1
General Remarks
A platform well service employee was fatally burned when he was sprayed with diesel Mel as he
removed a plug from the top of a diesel storage tank to check the fuel level. Apparent), filling
operations by the fvessel's] pumps were not completely shut down before the deceased had replaced
the tank vent plug, which caused a pressure buildup in the land Ignition occurred immediately and
was most likely caused by the generator en~ne's exhaust direct) overhead.
Date of event:
FIGURE 6-1 Typical listing of accidents in the MMS Events File.
SOURCE: MMS, OCS Events File. [Information that identifies the specific platform has been
deleted.]
OCR for page 61
61
TABLE 6.-1 Evaluation of Event.Listing for Accidents Causing Deaths tin the Gulf of Mexico, 1982
Description...of cause
Number of Number of
events deaths
Potential PING
violations
1. . Falling from height
2. Opening.a pressurized
system for maintenance
3. Drowning
4. Helicopter accidents :
5. Unknown
6. Design violations
7. Handling heavy loads
8. Illness/heart attack/overexertion
Totals
.
2
2
2
1
1
1
11
2
2
2
2
1
1
1
13
G-400
G-400
G-400
NONE
UNKNOWN
p 653a
G-400
NONE
aThis may have been a system operation, in which case it would have been listed under cause #2.
TABLE 6-2 Evaluation of Event Listing for Accidents Causing Injuries in the Gulf. of Mexico, 1982
Description of cause.
Number of
.. events .-
Falling from height
Handling heavy loads
(including crane accidents)
Loss of footing/walking
.into objects
4. Improper use of tools
or equipment
5. - Opening.pressurized equipment 11
6. Engine/compressor/turbine. 6
maintenance and operation
7. Boat accidents
8. Sandblasting operations
9. Illness/heart attack ~
10. Welding and cutting operations
1 1. Walkway failures
12. Drain and sump systems
13. Design violations
14. Helicopter accidents
15. Electrical shorting
16. Diving operations
1 7. Unknown
Totals
36
35
25
17
5
5
4
4
3
1
1
157
Number of Potential PING
injuries violations
37
35
25
17
15
11
9.
5
4
5
3
4
3
2
1
178
G-400
G-400
G-400
G-400
G-400
G-400
G-400
G-400
NONE
G-206, G-400
NONE
G-400
P-653
NONE
G-300
G-400
UNKNOWN
OCR for page 62
62
TABLE 6-3 . Evaluation of Event Listing for: accidents Causing Pollution in the Gulf of Mexico, 1982
Description of cause
1. Unknown
2. Drain and.sump systems
3. Liquid discharged through vent
4. Handling heavy loads
5. Pipline leak/failures
6. Equipment failures
7. Drip pan design
8. Boat collisions.
9. Safety devices bypasses
10. Poor operating procedures
11. Welding and cutting operations
12. Opening pressurized system
13.: Electrical shorting i
14. Improper tool or equipment use 1
15. Control component failure
Totals
15
13
8
5
5
5
3
2
2
64
Number of Number of
events - barrels
Potential PING
violations
38
34
18
16
15
13
13
6
6
48
2
2
. 1
214
UNKNOWN
E-103
NONE
G-400
E-100, E-104
E-103, P-653
E-100
G-400
P-100
G-400
G-206 . .
G-400
G-300
G-400
P-167
TABLE 6-4 Evaluation of Event Listing for Accidents Causing Fires in the Gulf of Mexico, 1982
Description of cause
Engine/compressor/turbine
maintenance and operation
Unknown
Welding and cutting operations
2.
3.
4. Equipment failure
5. Electrical shorting
6. Opening pressurized system
7. Improper tool or equipment use
8. Poor operating procedures
9. Lightning
10. Drain and sump systems
11. Design violations
12. Sand blasting operations
13. Improper material storage
14 - . .
15.
Totals
Llqula alscnargeo through vent
Control component failure
.~
Number of Number
events injured
13
8
7
5
3
2
2
2
1
1
1
1
-
50
10
1
o
o
3
1
o
o
4
3
1
o
o
o
24
Potential PING
violations
P-301, G-400
UNKNOWN
G-206, G-400
G-300
G-300
G-400
G-400
G-400
NONE
G-400
P-653
G-400
G-400
NONE
P-700
OCR for page 63
63
TABLE 6-5 Summary, 1982 Offshore Event Listing (Production)
Number of Potential
events PINC violations
1. Handling heavy loads
2. Falling from height
3. Lost footing
4. Unknown
5. Improper tool or equipment use
6. Opening pressurized systems
7. Drain and sump systems
8. Engine/compressor/turbine operations
9. Equipment failures
10. Welding and cutting operations
11. Liquid discharge from vent
12. Boat accidents
13. Electrical shorting
14. Sand blasting operations
15. Pipeline leak/failure
16. Illness/overexertion/heart attack
17. Drip pan design
18. Walkway failures
19. Poor operating procedures
20. Safety device bypass
21. Lightning
22. Control component failure
23. Drowning
24. Diving operations
25. Helicopter
26.
27.
Totals
Improper materials storage
Design violations
41
37
25
23
19
14
14
14
10
9
9
8
5
5
5
4
3
3
3
2
2
2
2
1
1
263
G-400
G-400
G-400
Unknown
G-400
G-400
G-400, E-103
P-301, G-400
G-300, E-103, P-653
G-206, G-400
NONE
G-400
G-300
G-400
E-100, E-104
NONE, G-400
E-100
NONE
G-400
P-100
NONE
P-167, P-700
G-400
G-400
NONE
G-400
P-653
It should be pointed out that the events files do not specify whether an INC caused or
contributed to the magnitude of an event. Thus, the analysis of potential PINC violations in these
six tables only indicates the INCs that potentially might have been related to the cause of the event;
it does not indicate that an INC necessarily existed at the time of the event.
It was necessary for the committee to develop these data from the MMS's computer listings.
Similar analyses of the events data by MMS were not available. Such analyses could, however, aid
in the evolution of the inspection program.
The committee also analyzed 262 events in 1982 pertaining to drilling and workover
operations, though not in as much detail as it did the events related to production operations.
Table 6-7 summarizes these events by category of cause. No attempt was made to tie the cause of
events to possible PINC violations. The drilling PINC list is concerned mainly with well design,
operating procedures and tests, and equipment necessary to control wells to minimize the occurrence
and consequences of well-control failures. Of the 1,606 wells drilled and worked over in 1982, only
8 incurred well-control failures. Devices that the MMS requires to be installed and
OCR for page 64
64
TABLE 6-6 1982 Event Listings - Summary by PING Violation
PING violation
Number of events
G-400
None
Unknown
E-103
G-300
G-206
E-100
P-301
P-653
P-100
E-104
P-167
P-700
162
35
24
14
7
5
5
4
2
2
TABLE 6-7 Summary of 1982 Offshore Event Listing (Drilling)
. . .
Cause of event
Number of events
Falling, handling heavy loads, etc.
Tank runover, ruptured hose
Electrical systems
Loss of well control
Pollution from mud circulating system
Welding
Opening a pressurized system
Equipment overpressure
Premature firing of perforating gun
Boat collision
Unknown
Tota s
209
16
9
8
5
4
3
1
1
2
4
262
.,
tested prevented fires in 4 of the 8 events. The extent of injuries or oil pollution in the course of
the 8 blowouts—although clearly not major, based on collateral evidence regarding major accidents in
1982 cannot be determined from the events file, as this information is not reported for some of the
events. It must be kept in mind that any well-control failure involves the threat of loss of life and a
large spill.
OCR for page 65
65
In 1982 there were approximately 275 drilling or workover facilities and 2,900 production
platforms in the Gulf of Mexico. The events file indicates that there were 0.95 events per drilling
or workover facility and 0.09 events per production platform in that year. Therefore, for 1982, the
number of events during drilling operations was 10 times that for production operations. (In
periods of low drilling activity, such as 1986, the frequency of events was 3 to 1 for drilling
operations compared to production operations.) As was noted earlier, the population of drilling
personnel on the U.S. OCS in 1982 was at least as large as the population of production workers.
As with production events, the majority of drilling events were related to human error and operating
and maintenance procedures. The committee believes that a regular review of the events in drilling
operations as they occur could lead to improved regulation and inspection techniques. For these
and other reasons the committee believes that continued frequent onsite inspection of drilling rigs is
important.
In the aggregate, the committee's analysis of the 1982 events file shows that the vast majority
of events in both drilling and production operations resulted only in minor personnel injury, small
flash fires, or small oil spills. These events, which stemmed from human error in operating and
maintenance activity, suggest a lack of proper attitude and awareness toward safety on the part of
workers, supervisors, and management. The current MMS regulations, with their emphasis on well
control in drilling and workover operations, and process upsets in production operations, are
designed to avoid major disasters. However, historically disasters frequently are preceded by
low-level events caused by inattention and a poor attitude toward safety, deficiencies that can be
identified by safety analysis.
Overall, the weaknesses of the present program are as follows:
· Full compliance with the testing requirements of the PINC list does not necessarily
address essential safeW elements comprehensively, especially those involved in the low-level
events—many of which involve human error-that represent the majority of events (accidents).
· Operators may be motivated to concentrate their safety efforts on maintaining devices that
they expect an MMS inspector will require them to test while following a PINC list, rather than on
systematically addressing measures to improve the overall safety of their operations and to conduct
them in a Safe and workmanlike manner.n
· The emphasis in the PINCs on individual mechanical components inhibits a rigorous
evaluation by MMS of the overall safety of the operation. In production operations, the PINC list
and the ratio of INCs to PINCs to a large extent address the reliability of selected devices in
operating within prescribed tolerances. MMS has not established that these data are, in themselves,
sufficient indicators of safe operations. The PINCs themselves place almost total emphasis on
mechanical tolerances and do not leave enough room for safety judgment.
· MMS's focus on incidents of non-compliance tends to obscure the fact that the
responsibility for safety lies with the operator, and not with the MMS. In these circumstances, an
evaluation of the commitment of the operator toward good safety practices, much less any erosion
thereof, tends to fall by the wayside.
The ideal philosophy for safe operation of OCS platforms, of course, is that every operator
will strive to ado the job right the first time," so that the role of the MMS inspector can be limited
to verification. On the other hand, given the importance of safety devices in protecting life and
property, what might be termed "micro-inspection" can lead to an operator attitude that the MMS
inspector will detect anything that is wrong and that, in the absence of overt indication of a
problem, the operator can concentrate on production.
OCR for page 66
66
Responsiveness to Other Evaluation Considerations
Maintenance of Public Confidence
An important element in the effectiveness of a federal regulatory program dealing with safety
is the degree to which the public has confidence that its interests are being safeguarded. This is
particularly critical with respect to OCS activities in light of the federal government's interest in
realizing the substantial revenues to be derived from OCS development. On the Gulf Coast the
question of public confidence in MMS' role in the safety of OCS operations is a dormant issue.
The gradual migration of the center of industry activity from shore to marshes and lakes and to the
open sea, its current remoteness from population centers, and its pervasive importance to the Gulf
Coast economy all have combined to make the attendant risks an accepted part of the local scene.
On the Pacific Coast, by contrast, there is a segment of the population which is unalterably opposed
to any offshore development. This opposition tends to override the issue of public confidence in
the MMS inspection program as such; the consuming issue is development in general, not the
nuances of addressing day-to-day safety problems. In these circumstances it cannot be said that
there is substantial public interest in the specifics of the MMS inspection program. In Alaska, on
the other hand, the high level of public concern and threatened litigation resulted in lease
stipulations responsive to public concerns which, in large part, have shaped-the inspection program
there.
Use of Resources
This study was prompted primarily by MMS's concern regarding the efficient utilization of
government resources. The committee a3grees that there are problems involving the utilization of
the MMS inspection staff. A utilization percentage on the order of 59 percent (Pacific) and 70
percent (Gulf of Mexico) of compensable time is unacceptable on its face. Some inefficiencies
appear to result from MMS's inspection procedures. The substantial time spent in hurried records
checks while at a facility would be better spent in direct inspection activity, with intensive records
review conducted ashore, either before or after the facility inspection. Further efficiency in
personnel utilization could be achieved by lengthening the work day to accommodate visits to more
facilities. (Work rules would have to be changed to accomplish this, perhaps involving new
legislation). The committee believes that changes of this nature could accomplish marginal
improvements in productivity and decreases in transportation costs. It is questionable that they
would result in any substantial impact on the safety of operations.
Assessment of the cost/benefit ratio of the present inspection program is not feasible on the
basis of available data. That is, while MMS costs can be established with reasonable certainty, and
while they can be applied to determine cost per inspection, cost per violation detected, etc., a
measure of the safety impact of the program—in terms of such significant objectives as accidents,
injuries, or pollution incidents prevented-is not feasible. It can be said that the cost per inspection
is high;4 that the cost per violation reported is even higher; that the number of major accidents is
low; and that the fatality rate is similar to that of other heavy, labor-intensive industries (equivalent
to that of the mining industry, for example). All in all, the true safety picture on the OCS and its
relationship to the MMS inspection program cannot be defined quantitatively. (However, it is
3Time engaged in actual inspection and other assigned duties vs. total time the
helicopter transit time is not included in the time credited to inspection.
inspector is on duty;
4In FY 1987, average helicopter cost per inspection visit was $440 in the Pacific Region and $675 in
the Gulf of Mexico (Rig", 1988a, 1988b).
OCR for page 67
67
possible to make a qualitative assessment as to whether a particular change in the inspection
program would result in a higher or lower cost/benefit ratio.)
Qualification and Training of Inspector Force
The committee noted that inspectors receive little formal education in safety practices and
inspection techniques. (Their training places primary emphasis on testing of devices and much less
on safety practices.) While on-thejob training (OJT) gives inspectors sufficient insight into the
processes they are to inspect (and channels them into specializing in either production or drilling
inspections), OJT can fail to give an adequate conceptual understanding of the goals of an
inspection. Further, OJT does not give inspectors an understanding of a large variety of inspection
techniques, particularly in making judgments about safe and workmanlike procedures. Despite the
fact that to some degree inspectors are rotated, they and their individual habits and areas of
emphasis during an inspection appear to become well-known to facility supervisors and their key
personnel. This is particularly true in the Pacific region, where a relatively few inspectors deal with
only a handful of platforms. The committee gained a clear impression that operators there attempt
to anticipate the inspector's inspection pattern.
Identification of Safeb Trends and Warnings
Identification of significant safety indicators and better data collation are needed to provide a
clearer picture of safety problems on the facilities, so as to establish trends. While MMS maintains
that the compliance record is a primary factor considered in selecting facilities for unannounced
inspections, the committee saw indications that transportation costs and scheduling may be a more
significant factor in the field. Moreover, a violation record involving no more than the failure of a
device to trip at its specified set point or the failure of a check valve to seal within the small
tolerances specified by MMS, for example, does not necessarily translate into a poor safety record.
Further, until more directly relevant data can be collected and collated effectively, it will not
be possible to assess the impact of safety-related changes introduced into the offshore oil and gas
industry. Until then, improvements in equipment and process can be introduced only on an
instinctual basis—not necessarily a bad procedure, but not the way to ensure consistent results.
Safety Performance Accountability
The present program does lend itself to a degree of safety accountability for individual
inspectors, operating personnel, supervisors, and operators by measuring, for example, the PINCs
inspected and INC/PINC ratios. However, this focuses the inspection process further on compliance
with specific regulations rather than on the evaluation of safety attitudes and procedures that
underlie the overwhelming number of events. That is, the data bases currently being put together by
the MMS provide data to hold individual inspectors, operators, etc., accountable for compliance
activity. The present approach does not incorporate the kind of accountability for safety that leads
inspectors, operating personnel, supervisors, and operators to address safety as a system rather than
an item-by-item checkoff.
Precedents
Compared to the state regulatory regimes governing offshore oil and gas drilling and
production activity in their waters the MMS program is more rigorous, both as to the scope of
OCR for page 68
68
regulation and the onsite presence of inspectors. (It should be noted that wells and facilities in
shallow water generally are not as complex as those located in deeper water.) The committee was
not able to develop data that presented a valid insight into the safety record of operators in state
waters; but no evidence was apparent to suggest that there had been significant numbers of major
accidents.
Practices in other nations were surveyed with a view to developing possible alternatives for
adoption in this country. They ranged from an essentially laissez faire attitude in several developing
countries to a system seemingly more pervasive than our own in the North Sea fields administered
by Norway. The United Kingdom's system, though comparable to our own in substance, differed
significantly in that the day-to-day oversight was in the hands of third-party inspectors (typically
classification societies certificated for this purpose by the government.)
The Norwegian system places particular emphasis on the responsibility of the operator for
maintaining quality control and the safety of operations. The Norwegian Petroleum Directorate
monitors the operator's safety control system rather than the operator's activities (MIT, 1986~.
A risk analysis, that focuses on personnel safety, which addresses hazards, their consequences,
and possible methods for mitigating them is often employed in development of a system of internal
control (i.e., operator's quality control) of safety. Risk analysis is practiced in Norway, but it is
oriented more toward identifying risks associated with large-scale catastrophic events than routine
workplace accidents. Risk analyses are provided by the licensee in the concept safety evaluation
conducted by the Norwegian Petroleum Directorate as part of the initial project approval.
Subsequent platform modifications may invalidate this risk analysis as noted in a review of
Norwegian and British uses of risk analysis in offshore operations (MIT, 1986~. (See Appendix H
for a description of the Norwegian and British systems.)
ALTERNATIVE 1: INCREASED INSPECTION ONSITE BY MMS
This alternative, mirroring as it does the present program, was analyzed solely with respect to
the potential impact of "more of the same."
The negative elements of the present program probably would not be exacerbated, with the
possible exception that an increased MMS presence on Gulf of Mexico platforms would lead
operators to place even greater reliance on an expectation that MMS personnel will detect anything
that is "wrong." In this event there would be a further clouding of the fact that the operator has
ultimate responsibility for safety and a corresponding diminishment of operator safety consciousness.
While in some cases the increased presence of enforcement personnel has a positive influence
on public confidence, it seems unlikely that this step would be significant with regard to public
perception of the MMS's effectiveness in ensuring the safety of offshore operations, given the
limited public awareness of the nature of the agency's activity. Nor would such an increase be an
effective use of personnel resources as the program is presently structured. Additional personnel
would be needed, as would additional funds for transportation services. Since the only benefit
would be the witnessing of more of the same kinds of tests and drills, whose correlation to
promoting safety the committee questions, the committee sees no merit in this alternative.
This assessment has been reached notwithstanding the fact that the gathering and evaluation of
additional data has been urged by the committee as a necessary precursor to more effective
inspection activity. However, the type of data that is needed is not an increased flow of reports of
INCs, but a flow of information that defines more broadly the day-to-day safety deficiencies being,
encountered on offshore facilities.
OCR for page 69
69
ALTERNATIVE 2: INSPECTION OF A SAMPLING OF PINCs
DURING ANNUAL INSPECTIONS, AND INCREASED SPOT INSPECTIONS
While rejecting the concept that an escalation of the MMS's present program would be
beneficial, the committee nevertheless was struck by the fact that, at all levels, the agency and the
operators believe that the MMS inspection presence promotes industry safety awareness. Some of
this belief is based on the perceived quality and scope of MMS oversight; however, other factors
contribute more emphatically to the consensus. Many operators who are intent on conducting safe
operations through a conviction that it is economically sound practice express the feeling that the
credibility of the industry's commitment to safety would be threatened by the actions of the less
scrupulous operators if the possibility of an MMS spot inspection were to be reduced. Employees
concerned about a safety hazard that management is not addressing to their satisfaction want to be
able to aim an inspector in the "rights direction" MMS inspectors believe they bring a different
viewpoint, which frequently enables them to detect problems that are overlooked by personnel
preoccupied with the facility's ongoing operations.
This strong predilection for an MMS presence, which the committee shares, led the committee
to explore ways in which to enhance the effectiveness of MMS inspections at present personnel and
budgetary levels.
The committee examined whether the utilization of sampling techniques (see Appendix G)
could enhance the effectiveness of the MMS inspection program. Sampling theory is a widely
accepted technique for improving the efficiency of inspection programs. However. it is highly
dependent on a properly developed sampling plan designed to verify the data recorded by the party
being inspected. The committee believes that a valid sampling plan can be developed for witnessing
tests of selected items on the PINC list during inspection of OCS oil and gas production facilities.
However, better use needs to be made of the facility records, which represent considerable time and
effort expended by the operators on conducting periodic tests to meet MMS requirements, as well as
ore maintaining the prescribed records. Review of the records in greater depth before an onsite
inspection could focus the inspection more sharply. With proper controls, the records could take
the place of many MMS-witnessed tests and provide the basis for developing the sampling protocols.
This alternative could lead to a program based fundamentally on the operator regularly
performing the scheduled inspections, followed by selective inspections performed by MMS
personnel utilizing a sampling plan. Making the tests performed by the operating personnel a
formal part of the facility's MMS inspection program should foster a secondary benefit of extending
safety involvement to all employees; it should help to focus attention on the fact that safety is
derived from proper operating practices, rather than being the result of inspections. Integrating the
efforts of the MMS inspectors with those of the operators should reinforce the nrecent thnt c~f~tv is
the responsibility of the operator; if no more than a shift in attitude results, the outcome should be
a level of safety higher than that achieved with the present system.
At the heart of this alternative is the commitment of time to an increased number of
unannounced spot inspections, which will enable MMS inspectors to observe operating procedures
more frequently and assess safety attitudes more accurately. While the committee is confident that
the use of sampling techniques in conducting onsite tests and inspections can provide oversight of
offshore operations that meets the objectives of the OCSLA, which is superior to that being
achieved using present procedures, it also recognizes the possibility that questions could be raised as
to whether sampling meets the specific OCSLA mandates relating to announced and unannounced
inspections. The committee takes no position on the need for legislation in order to undertake a
sampling program, but urges that legislation be sought if deemed necessary. The committee does
note, however, that the Coast Guard has undertaken a sweeping change in respect to regulations it
, ~ ,
rim rim ~ ~-
OCR for page 70
70
administers, based on an administrative interpretation of the OCSLA to the effect that Coast Guard
personnel do not have to conduct all OCSLA inspections.5
As discussed in reference to other alternatives, the "public perception" issue does not appear
to be an important one in addressing the acceptability of various inspection strategies. The
alternative under consideration here does not involve a reduction in MMS activity offshore but a
reallocation of effort, and accordingly should be relatively immune to public criticism.
The real advantage of the alternative lies in a more productive utilization of the current
inspection force, both in terms of the activity it will undertake and in the better scheduling of its
time and transportation services. Given a more efficient use of resources in terms of cost, the
improvement in cost/benefits ratio still might be marginal unless there is a substantial improvement
in the impact of inspections on the safety of operations on the OCS. This is the key element of
this alternative. Improvement will follow only if the resources freed from having to witness tests are
applied to evaluating events (accidents) and disruptions (mishaps) and to conducting safety analyses
and if the inspection program is modified to assess safety-related attitudes. As was pointed out in
Chapter 4, no change will result in more than marginally better safety without the identification and
collection of more meaningful data. While a PING sampling program can be initiated with minimal
risk on the basis of presently available data, upgrading of data will have to be given high priority in
order to refine the sampling program into one that will give the MMS, the industry, and the
Congress confidence that the safety hazards of OCS operations are identified, understood, and
addressed effectively. The following chapter elaborates on data needs and the reallocation of some
inspector resources into data analysis to improve sampling and safety.
Although the committee believes that MMS inspectors are selected and trained to sufficiently
rigorous standards to conduct their present inspection role satisfactorily, it has some reservations
about the qualifications and training of inspectors with regard to the breadth of their understanding
of inspection techniques, particularly of statistical sampling concepts. Many inspectors will require
intensive training before they could be effective in a more sophisticated inspection regime, such as
one built around safety analysis, sampling techniques, and audits of operator records.
Additional training also will be required to enable the current inspectors to assess operator
attitudes toward safety and to identify procedures that involve poor safety practices. Learning to
assess attitudes will be even more difficult than moving from witnessing all tests to witnessing a
sampling of tests.
The focus of an inspection based on a sampling program is to determine the accuracy of the
operator's records and to hold him accountable for his reported tests. In this sense, operator
accountability is improved by this alternative program.
ALTERNATIVE 3: ANNUAL INSPECTION OF A SAMPLING
OF FACILITIES AND INCREASED SPOT INSPECTIONS
The committee considered the application of sampling theory to identifying selected facilities
for annual witnessing of tests while foregoing the annual announced inspection at the others.
Depending on the level of confidence that could be established for this approach, a substantial
5The Coast Guard's regulations deal with the number and condition of lifesaving devices such as
evacuation capsules, life rafts, and personal flotation devices, firefighting devices, both fixed and
portable, and aids to navigation. In addition, the Coast Guard is responsible for general workplace
safety. The Coast Guard's inspection program requires operators to perform (and report to the
Coast Guard) all annual inspections. These inspection are augmented by a Coast Guard oversight
program of random announced inspections, a headquarters analysis of inspection reports filed by
operator and Coast Guard personnel, spot inspections of facilities with poor safety records or
questionable reports, individual investigations of worker complaints, and investigations of casualties.
OCR for page 71
71
reduction in manpower and fiscal resources required to witness tests could be realized. An integral
element of this alternative is a step-up of spot inspections to ensure that facilities not included in
the announced annual inspection sample would receive at least one spot inspection during the year.
The spot inspections would not have extended to witnessing a large number of tests.
This alternative might not result in literal compliance with the requirements of the OCSLA
mandating an announced annual inspection and periodic spot inspections, therefore it might require
legislative action prior to adoption. However, to the degree that an effective sampling plan can be
developed, this alternative would meet the safety objectives of the OCSLA while freeing personnel,
time, and funds for more productive activity.
Potentially, this alternative could have a highly positive impact on the safety awareness of
operators and operating personnel whereto a greater degree than in the case of the PINC sampling
program just described could find themselves in the event of an accident having to explain a safety
deficiency on a platform that had not been recently inspected by MMS. The reduction in the
number of facilities receiving complete inspections by MMS inspectors conceivably could arouse
public concern, which might require a public awareness program by MMS explaining the concepts
underlying the selected-facility alternative.
As in the case of the PINC sampling alternative, key elements of the acceptability of the
selected-facility alternative are a concurrent improvement in data collection and an aggressive safety
analysis program. To the degree that these elements are accomplished, the forecasting of safety
trends may well be enhanced, since it will be possible to look at safety data in terms of an
integrated operating system (i.e., a facility). To be able to develop safety indicators that would
identify a potentially problem-prone facility would add greatly to the efficiency of the MMS
inspection process.
This alternative would place far greater demands on the analytical skills of the MMS
inspectors, who would require extensive training in the use of modern risk assessment tools. It
might be necessary to wait until a new generation of inspectors is in place before implementing this
alternative. Future recruiting could accommodate this need over time so as to phase in personnel
with these skills without displacing the present inspectors, who could continue to perform their
present tasks.
Once in place, this alternative would afford MMS a high degree of flexibility in allocating its
inspection resources to address problem areas. MMS responsibly could defer inspections of
operators whose safety performance was superior, in order to concentrate on those encountering
problems; or it could ease off inspections of categories of PINCs in which no problems were being
encountered to concentrate on those that have posed safety hazards.
This alternative, placing as it does an additional burden of accountability on operators and
operating personnel, might diminish the accountability of individual MMS inspectors and their
supervisors for the performance of detailed inspection tasks. However, the overall accountability of
MMS for the safety oversight of the industry should be enhanced by the fact that better data, more
intensive safety analysis, and selective inspection activity should give MMS a better overall picture of
the safety of the industIy's operations (see Chapter 7~.
In the committee's view this alternative represents an achievable long-term goal. At the
moment, however, it is not feasible given the limited amount of safety data available, which would
make formulation of a suitable selected-facility sampling program impossible. However, this
alternative could flow naturally from the successful implementation of alternative 2, the PINC
sampling alternative.
ALTERNATIVE 4: THIRD-PARTY INSPECTION
WITH GOVERNMENT AUDIT
In this alternative, operators would contract with private organizations certificated by MMS to
perform the annual and spot inspections now being performed by MMS inspectors. (At the
OCR for page 72
72
operator's option the private organization could also perform the inspections now performed by the
operator's own personnel. The third-party organization would maintain the records prescribed by
MMS (which would be subject to spot audit by MMS) and submit copies of the inspection reports
to MMS so that the quality of the inspections could be verified.
As in the case of some of the other alternatives described in this report, this alternative might
require legislative authorization. Whether the objectives of the OSCLA would be better achieved by
this or the present system is a matter of conjecture greatly influenced by the biases of the
evaluator. Those supporting an increase in private-sector activity suggest that greater efficiency
would result at no risk to attainment of the OCSLA's safety objectives; those who believe that
government inspectors are the only ones sufficiently committed to the public interest to provide
objective inspection services maintain that monetary savings would be doubtful and in any event not
worth the ensuing degradation in the safety program. What is indisputable is that monitoring the
performance of private inspection organizations in itself would pose significant difficulties. An
MMS program to maintain a register of private-sector engineering consultants qualified to perform
certifications of platform design, fabrication, and installation, which was undertaken some years ago,
was abandoned due to difficulties in keeping it current.
It is hard to assess the impact that this alternative might have on the safety consciousness of
operators. With adequate precautions to obviate conflict-of-interest situations, there is no reason to
believe that third-party inspectors would not conscientiously carry out their duties so that the
compliance element of the inspection process would be unchanged. This fact in itself, however,
provides the operator with the same kind of shelter that he now has when he successfully "passes"
an MMS inspection. Thus, the committee believes that there would be negligible impact on safety
consciousness; the tendency toward Compliance mentality" would not be corrected by this
alternative. The drastic reduction in MMS presence on OCS facilities could raise public concern.
Moreover, as noted earlier, there is strong sentiment in the industry, on the part of offshore
operators and employees, as well as MMS employees, that the regular presence of MMS personnel
has positive benefits on safety which should not be foregone.
With the reduction of their inspection duties, MMS inspectors would have time to perform the
audit and safety analysis functions the committee described earlier as providing the MMS with better
insight on operational safety on the OCS. In this case, however, they also would be required to
conduct audits of the private inspection organizations. These functions in the aggregate could be
performed with greater scheduling flexibility than direct inspections and would allow MMS to make
more effective use of its personnel resources (although there might be some degradation in the
inspectors familiarity with the practical aspects of OCS operations).
The overall cost of this alternative probably is higher than that of the other alternatives
described in this report, since it introduces a new group of inspectors into the process (paid directly
by the operator, or as an add-on to the MMS budget, depending on the variant adopted). Some
reduction in the number of MMS inspectors would be possible in the case of either variant, but
some redundancy would remain and the MMS audit of inspectors would likely involve higher cost
per inspection. It is questionable whether there would be a sufficient improvement in effectiveness
to offset the additional costs involved.
Paralleling, as it does, the substantive aspects of the present program, the alternative would
produce no direct improvement in the development of data useful in improving safety trend
analysis. However, adoption of this alternative would not foreclose a transition into one of the
other alternatives described (e.g., alternative 2), in which such benefits are realized. In fact, such a
transition might be facilitated since the MMS personnel would be able to concentrate their attention
on program development without the distraction of day-to-day involvement in facility inspection.
6As discussed in Chapter 4, a variant would be that MMS would hire the third-party inspection
services directly. The committee believes that the following analysis is equally pertinent to this
variant.
OCR for page 73
73
Adoption of this alternative would involve difficult transition problems in training the MMS
inspectors to perform audit functions relating to the activities of third-party inspection
organizations. These skills are less related to the background of the inspectors than those involved
in witnessing tests, and might require protracted retraining.
The use of private-sector inspectors probably would provide some additional flexibility to MMS
in modifying the inspection program in the face of changing circumstances. The degree to which
this flexibility would be meaningful depends entirely on the ability of MMS to develop better data
collection and evaluation processes.
A fundamental challenge in adopting this alternative is development of the audit plan for
overseeing the activity of the third-party inspection organizations. Without an effective scheme
allowing MMS to follow un on the performance of the Drivate-sector inspectors. some operators
-
could experience a very rapid deterioration in the safety of their operations. With government
inspectors no longer involved in direct inspection activity, it might be difficult for MMS to ensure
that its mission was being carried out effectively.
Third-party inspection programs are not commonplace in the federal regulatory scheme,
although they do exist. For example, there is statutory authority for the Coast Guard to delegate a
wide array of marine safety functions to the American Bureau of Shipping (a classification society of
the type utilized by the United Kingdom to conduct its inspection program for offshore oil and gas
operations). The Coast Guard has made numerous delegations under this authority, but it has not
delegated operational inspections. None of the states' programs involve third-party inspectors.
A transition to a third-party inspection program with government audit would not of itself
result in an improvement in the safety of offshore operations, nor would it result in a more efficient
inspection scheme. It presents difficulties for the MMS in conducting oversight that it may not be
able to handle without substantial near-term disruption, during which safety oversight might be
seriously compromised.
ALTERNATIVE 5: SELF INSPECTION
The thrust of the views presented to the committee was that hazards presented by offshore gas
and oil operations are too significant to consider an inspection program that does not involve direct
government oversight.
Although, as in the case of the other alternatives, this alternative involves extensive assessment
of operator data in meeting the safety objectives of the OCSLA, there is a basic difference: the
others still rely on a regular (if more limited, in some cases) oversight by MMS inspectors or their
profanes to verify the operator's inspection activity and his records. Full self-inspection would involve
a loss of the motivational benefits of a governmental presence referred to in Chapter 4. It certainly
would risk a loss of public confidence in the safety of OCS operations, and might be seen as an
abandonment of governmental responsibility.
Substantially more MMS resources would be available for SpOt inspections and safety analysis
activities, as noted in Chapter 4. But it is likely that the collection of valid, detailed data needed
for those analyses would become more problematical, as the frequent direct contact between MMS
inspectors and operating facilities and personnel was lost. For the same reason, the day-to-day
performance of OCS operators would become more difficult to ascertain. In the absence of
government inspection, the operator's accountability for poor performance seemingly would be
self-evident. Nevertheless, after a major accident, MMS's discharge of its regulatory responsibility
could be questioned by the public.
OCR for page 74
74
RESULTS OF THE ASSESSMENT
Having assessed the present MMS inspection program and five alternative programs, the
committee made a determination that alternative 2—inspection of a sampling of PINCs during annual
inspections, and increased spot inspections—offers the greatest relative benefits. It provides an
opportunity to improve the efficiency of the inspection program while retaining a substantial
government presence in this area of vital public interest. It reduces the tendency toward a
"compliance mentality" on the part of operator personnel while focusing the inspection on the items
of hardware and procedures that are most significant from a safety standpoint. It opens the way for
the program to evaluate the aggregate safety of operations on all platforms.
This alternative inspection program would result in fewer total inspection man-hours required
for annual inspections, as well as better targeted spot inspections. The committee recognizes that
this increased efficiency could be regarded as a basis for manpower reductions. However, use of the
freed resources for additional spot inspections and a program of systematic safety analyses that are
needed to address recurrent safety problems is an integral element of this alternative. The necessary
resources for an ongoing safety analysis program and an enhanced spot inspection program would be
made available by having MMS inspectors witness only a limited number of tests during the annual
inspections of production facilities, in lieu of attempting to witness 100 percent of the tests in the
PINC list as is now done. The alternative also would result in lower transportation costs since the
number of days spent at each facility would be reduced.
While some uncertainties would be involved because of shortcomings in the MMS data base,
the transition to the new inspection program could be undertaken at an acceptable level of risk
concurrently with the development of analytical methods to improve the data base to make it more
useful.
Alternative 3—annual inspection of a sampling of facilities, and increased spot
inspections—represents a natural and perhaps desirable extension of alternative 2. The committee
considers this step to be too ambitious a change to undertake at the present time, given present
limitations in the data and expertise needed to confidently select facilities for inspection. But as
those limitations are overcome through the implementation of alternative 2, the selected-facility
alternative would provide even more opportunity for targeting inspection resources efficiently,
effectively, and intelligently at the points on the OCS where attention is needed most. Thus,
implementation of this alternative represents a desirable long-term goal, recognizing that legislation
may be required before it can be undertaken.
Representative terms from entire chapter:
mms inspectors
