5

Panel 4: Standards and Regulations

The workshop’s fourth and final panel included four speakers who were asked to address quality assurance/quality control processes and procedures, the links between standards and specific application design requirements, safety management, oversight of subcontracted vendors, reporting requirements, and examples of how other industries control the quality of critical components.

FASTENER ENGINEERING BASICS

Fredrick Kachele, U.S. Navy

Fredrick (Rick) Kachele is a materials engineer at the Naval Surface Warfare Center in Philadelphia and the acting technical warrant holder for the Naval Sea Systems Command of the U.S. Navy. The technical warrant holder oversees the standards, tools, and processes that are used to create components that conform to Department of the Navy requirements. Kachele’s remarks focused on how the Navy deals with the challenges of the ocean environment, how designing the interactions between components and people can help to reduce variability, and on the use of quality assessments to inform decision making.

Dealing with the Ocean Environment

Kachele stressed the importance of understanding the environment and its effects. When dealing with the ocean, he said, “the ocean is always going to win.”

Given that, design parameters should be based on a thorough knowledge of the specific life cycle and operational conditions of every piece of equipment.

The ocean is relentless and unpredictable. Stress loads vary and unplanned events happen, and it’s best to remain flexible when the unpredictable occurs, Kachele said. In addition, corrosion is inevitable; it can only be managed, not eliminated. He said the Navy’s first line of defense against corrosion is a design using galvanically similar materials that require the lowest level of CP that is feasible, though he cautioned that using CP at all can mask other forces that contribute to adverse effects. Finally, Kachele said any paint or coating offers only temporary protection. This effect is particularly obvious in the Navy, where equipment is often in service for decades.

Managing Interactions

Kachele said one of the Navy’s biggest challenges is managing not only how components interact, but also how engineers work together. For example, if a bolt connects a valve to heat exchange piping, the valve operators and the heat exchange operators need to understand each others’ needs in order to reduce negative consequences. Building effective working relationships between people with different areas of expertise, such as metallurgists and fastener engineers, can sometimes require bridging cultural divides between different fields. Engineers also have to collaborate and communicate effectively with the authorities who make the final decisions, monitor a project’s budget and timeline, and balance competing priorities.

In his experience, Kachele said, people often don’t fully appreciate the complex engineering that fasteners require. The Navy operates in very deep water. Unexpected repairs, especially those requiring expensive dry-docking, are infeasible, so fasteners must be “as reliable as a light switch.” At the beginning of a project, those inexperienced with fasteners may joke about “dumb iron,” but once they have seen the whole process, they come to appreciate how engineers meet the various complexities that are involved while staying within the expected budget.

Fastener engineers typically come into the process after several decisions have already been made, Kachele said, such as what materials will be used and what ASME codes or insurance standards have to be met. Designers must be both knowledgeable and strategic, because some requirements can be very difficult to follow. A rule for boil and pressure vessels, for example, may work very well in one situation, but is not transferable to another, and fastener engineers must take all of these elements into account as they work.

Control of the interfaces is essential for consistency, Kachele said. Each design group has different priorities. In the Navy, workers are expected to keep costs low because warships are expensive. A high level of design and process control is costly, but it also enables the Navy to better understand how the ships will function in

service. In a design review meeting that Kachele shared as an example of competing priorities for piping leading to a heat exchanger, one group proposed one material for piping to prevent corrosion, while another proposed a different material to increase heat transfer. The materials are incompatible with each other, but luckily this difference was noticed before production began, which is far less expensive than making changes after the parts are in service.

Assessing Quality to Aid Decision Making

Decision making requires a careful balancing of priorities and a thorough understanding of the quality of materials and components. Decisions are also a product of the results of previous decisions, which have set the work on a certain path and are critical to understand before the next decision can be made. Understanding why you are making a decision is essential, Kachele stressed—particularly if others disagree with it.

There are times when the Navy has to balance cost against reliability. For some operations, it might be okay to lower the cost and tolerate a failure; in some cases, it may be possible to utilize extended maintenance to extend the equipment’s life span. The Navy is careful to test and inspect as early as possible, although Kachele cautioned that attempting to test while building can waste resources.

“Quality” is a nebulous term, and it can be difficult to communicate, track, or “look up in a table,” Kachele said. For example, while FS 85 and NASM 8831 are both applicable for alloy steel fasteners with comparable strengths, that information alone won’t tell you which bolt was made at a higher quality.

Kachele called it “wonderful” that oil and gas test facilities are required to be accredited to the strict parameters in ISO 17025. Ideally, he said, quality should be “built in,” and the more important a component is, the higher quality it should be. It’s important to reach a consensus as to where certain components are located on a continuum of quality. For example, the Navy groups components by their application and limits what can be considered crucial in order to ensure that the most critical items are receiving the most scrutiny.

Two of the tools the Navy uses to facilitate decision making are MIL-STD-882, known as the “risk cube,” and a sensitivity analysis. The risk cube is a visual way to communicate complex technical idea paths and the likelihood of various outcomes to engineers, accountants, and sailors (Figure 5.1). It could be useful, for example, when explaining HE to somebody without an engineering background.

A sensitivity analysis is a mathematical formula that can be used to understand the data behind a given decision. Plugging data into the equations creates a Bell curve whose width can illuminate what is known versus what still needs to be determined. That information can then help decision makers know where resources are needed to get data that can influence a decision and mitigate risks.

Kachele wrapped up his remarks by summarizing the key elements that factor into the Navy’s decisions when building ships. First, the ocean environment must always be monitored, especially as it relates to corrosion. Second, it is essential to facilitate appropriate exchange and interaction among different components and experts. Finally, understanding quality can improve the decision-making process. Two publicly accessible documents, MIL-STD-777 for controlling piping systems and MIL-STD-882, the risk cube for resolving system safety, are especially helpful in informing Navy decisions about the most critical components.

API SPECIFICATIONS Q1 AND 20E

David Miller, API

David Miller is the director of API’s Standards Program. He presented an overview of API and its standards program before detailing the most relevant specifications for this workshop, Specification for Quality Management System Requirements for Manufacturing Organizations for the Petroleum and Natural Gas Industry, 9th Edition (Q1), including its Monogram Program, and API Spec 20E, Specification for Alloy and Carbon Steel Bolting for Use in the Petroleum and Natural Gas Industries, 2nd Edition (20E). Miller also shared the results of a recent API analysis and discussed the process for reviewing and updating standards to incorporate new research and lessons learned.

An Overview of API

API was formed in 1919 as a national trade association and today represents more than 600 companies. Its mission is to support a strong U.S. oil and natural gas industry, and it does so through developing statistical reports, creating standards and certification programs, and engaging in legislative and regulatory advocacy. API’s members, who Miller said were well represented within the National Academies and at this workshop, come from a wide spectrum of the oil and gas companies based in and operating from the United States. API is assisted in its work by volunteers from a number of other organizations, particularly when developing or updating standards.

The Standards department is one of API’s three foundational divisions. It published its first report in 1924 in an effort to ensure interchangeability between manufacturers with regard to pipe sizes, threads, and couplings. Today, there are numerous active standards to advance a variety of goals throughout the entire supply chain for oil and gas production.

API is accredited by the American National Standards Institute (ANSI), which requires that API’s procedures and specifications follow a rigorous process that includes the “four pillars” of openness, balance, consensus, and due process. To uphold openness, API regularly publishes procedures, meetings, and standards plans, which are typically updated every quarter. To achieve balance, API uses a “one-third rule” when forming standards consensus committees: One-third of the committee members are owners or operators of oil and gas equipment; one-third are in supply or manufacturing; and one-third represent a broader, “general interest” community, including engineering consultants, academics, and government and nongovernmental organization representatives. Although some subcommittees

that determine budgets and project schedules include only corporate members, API membership is not required for voting rights on consensus standards committees.

Consensus, the third requirement of ANSI, is the crux of the process API uses to set standards. A two-thirds majority of at least 50 percent of eligible voters is needed to approve any standards action, whether it be a revision, withdrawal, or addition of a new standard. Due process is met when API puts its documents out for public comment before publication. API reads and responds to every comment received and alerts commenters to what next steps are being taken. This process is actively used; during the public comment process for Standard 53 (for BOPs), for example, API received and responded to more than 1,000 comments.

A final requirement for ANSI accreditation is that ANSI is able to conduct regular, comprehensive audits for all standards that have undergone revision. These audits ensure that API uses proper procedures to uphold the four pillars, Miller said.

Q1

Miller offered an overview of the Specification for Quality Management System Requirements for Manufacturing Organizations for the Petroleum and Natural Gas Industry, 9th Edition, known as Q1. Q1 details the primary quality management system (QMS) for oil and gas companies. Miller said Q1 is more stringent than ISO 9001 and has been widely adopted; used around the world and referenced in BSEE’s regulations, it is the QMS for more than 4,500 oil and natural gas companies. Since the first edition was released in 1994, it has evolved to meet the industry’s changing needs; Q1 is now in its ninth edition (2014), and the tenth edition is in the works. Miller noted that the tenth edition and an addendum to the ninth will include information from this workshop.

Designed as a resource for the petroleum industry, Q1 provides procedures, process controls, and standards for personnel, equipment, and facilities to ensure that components meet customer, product, and industry requirements. This includes requirements for a host of QMS controls including design, purchasing, contract review, inspection, calibration, and testing.

Q1 is developed and maintained by and for petroleum industry professionals, Miller said. In particular, its maintenance is led by the API Subcommittee on Quality (SC18), which consists of industry professionals, equipment manufacturers, service and supply companies, regulators, and quality systems professionals. It is the leading international standard for the petroleum, petrochemical, and natural gas industries, and goes above and beyond other QMSs because of its industry-specific requirements.

The meat of the information in Q1 most relevant to this workshop, Miller said, is contained in Section 4 (QMS Requirements) and Section 5 (Product Realization). Miller highlighted Section 5.6 in particular, which covers the purchasing controls

for equipment and materials like bolts. Miller said API is committed to facilitating the use of its standards, which it does through references to federal regulations and making the standards available for free public viewing.

Q1 also provides the basis for the API Monogram license, a voluntary certification program companies can participate in to demonstrate compliance with API standards and specifications. The program is covered by Q1’s Annex A and expands on Q1’s QMS requirements. To display the monogram, a manufacturer’s facilities must have a QMS that conforms to Q1, meet design and documentation requirements, possess and demonstrate the right level of manufacturing competency, and include a system for reporting nonconformance. Licensed companies must pass regular, independent audits by API to ensure products meet general Q1 specifications as well as particular product specifications, such as 20E.

Q1 is the only QMS listed in CFR 20, Part 250, recognized by BSEE for equipment used in the outer continental shelf. To date, API has issued more than 4,500 Monogram licenses for Q1-certified companies in 71 countries.

20E

As described by other workshop presenters, API Spec 20E, Specification for Alloy and Carbon Steel Bolting for Use in the Petroleum and Natural Gas Industries, 2nd Edition, is the specification for carbon and steel alloy bolting for oil and natural gas applications. It covers many aspects of bolt manufacturing, including production, calibration, testing, marking, record keeping, storage, and shipping.

20E was first issued in 2012, and its second edition came out in early 2017. The first 20E license was issued in 2013; to date, there are 31 licensees and applicants. Miller said that some of the ideas raised at the workshop, in addition to ideas raised by various task groups, will find their way into upcoming requirements. For example, he noted that 16A (for BOPs) and 17T (for subsea trees) will soon require 20E adherence.

Miller stressed that 20E and Q1 are meant to be used together to improve the manufacturing process. Every QMS audit improves procedures that enhance bolt reliability, and it’s important to differentiate between Q1 and 20E specifications, as both have to be separately met.

A Review of the Data

API recently reviewed auditing results for Q1 and 20E in the years 2013-2016 in order to detect any patterns of nonconformities in the product material and identify opportunities for improvement. The data showed that Q1 and 20E nonconformities were slightly higher than expected, which Miller attributed to a relatively small sample size and relative newness of 20E. For example, Miller noted that there

are only 31 manufacturers currently building to 20E specifications, making for a far smaller number of audits compared to more common specs such as 6A (for valves and wellheads), which is followed by hundreds of manufacturers.

The 20E auditing results (Figure 5.2) revealed that the most common nonconformities were found in the area of record retention. Miller noted that this is not surprising, because record retention is a new requirement for manufacturers. The second most common nonconformity for 20E was in the qualification of raw material sourcing, and the analysis of Q1 nonconformities also pointed to gaps in purchase control. Echoing the views expressed by a few other workshop presenters, Miller emphasized the importance of managing the entire supply chain.

The reviews are meant to help assess industry performance, identify quality management or technical trends, and enable informed changes and improvements to both Q1 and 20E. Miller said this recent study presents a snapshot of the first edition of 20E and can be a point of comparison after the second edition’s changes come under review.

Updates to Specifications

API continuously updates its programs and specifications. For example, API is currently implementing changes to Q1 recommended by the API multi-segment task group and BSEE’s QCFIT report. Another task group under API’s Subcommittee on Quality is currently in the comment-resolution step of the process and will soon publish its addendum to the ninth edition. Miller emphasized again that comments are taken very seriously; commenters are even invited to present their concerns to the subcommittee and hear how the comments will be adjudicated.

Updates in 20E’s second edition included broadening requirements, prohibiting zinc plating, strengthening heat treatment, and measuring furnace loads. Manufacturers have a certain amount of time to implement the new changes, but there is a deadline in order to maintain API compliance.

Wrapping up his remarks, Miller reiterated the important roles of Q1 as the industry’s quality management systems standard and of 20E as the industry’s bolting standard for critical applications. Both specs are regularly reviewed and updated per ANSI’s accreditation requirements and implemented and audited under the API Monogram program. Together, Miller said Q1 and 20E are important resources for producing quality products for industry use.

Subsequent to Miller’s presentation, API published the fourth edition of API specification 16A, Specification for Drill-through Equipment, which calls out the use of both Spec 20E, Specification for Alloy and Carbon Steel Bolting for Use in the Petroleum and Natural Gas Industries, and Spec 20F, Specification for Corrosion Resistant Bolting for Use in the Petroleum and Natural Gas Industries, with Specification 16A, requiring minimal bolting specification levels depending on the type of bolting (pressure containing, pressure controlling, or closure) and location of use (surface or subsea). Only utility bolting (used to mount equipment onto the 16A products) does not need to meet either Specification 20E or 20F.

INSIGHTS FROM THE AVIATION INDUSTRY: QUALITY OVERSIGHT OF CRITICAL TITANIUM ENGINE COMPONENTS

Andy Woodfield, GE Aviation

Andy Woodfield has worked at GE Aviation for almost 30 years and is currently the consulting engineer for titanium alloys. His responsibilities include oversight of the production of premium titanium products, which make up a portion of the critical rotating parts in GE’s aircraft engines.

In his talk, coauthored with Tim Mouzakis of the FAA, Woodfield shared lessons learned from decades of work in the aviation industry. He zeroed in on industry practices before a plane crash in 1989, discussed how the Jet Engine Titanium

Quality Committee (JETQC) led the industry to change the approach to quality management after the crash, and drew out lessons that could be applicable to the oil and gas industry.

Before launching into his prepared remarks, Woodfield shared some thoughts on points raised by previous workshop presenters. He said that discussions around the importance of detailed audits resonated with his experience in the aviation industry, which he said had a history of weak incident reporting prior to the 1989 crash, pointing to opportunities for improvement in the oil and gas industry. He said he also agreed with speakers who emphasized the importance of learning from failures, near failures, and even the absence of failures. Careful examination of all three categories for bolt failures is important for determining the true industry failure rate, which appears to be currently unknown. He also agreed that an improved understanding of failures requires better reporting, information sharing, and analysis, which can then be used to calculate and aggregate failure distributions to perform more precise risk analyses.

Leading up to the Crash

In 1989, a plane crashed near Sioux City, Iowa, in part because a critical rotating disc on the tail-mounted engine of a DC-10 failed in flight. More than 100 people died. The root cause of the disc failure was identified as a melt-related inclusion, a small particle containing contaminant elements that found their way into the titanium during the melting process. Woodfield passed around a bag containing a few metallic particles affixed to a piece of tape, roughly the same size as the one that caused the disc failure, to give participants an idea of just how small these inclusions can be, despite their outsize impacts.

Before the accident, there were several in-service shutdowns and near misses related to titanium melting inclusions. These events did not cause accidents like the Sioux City crash, but they could have, and the aviation industry missed the opportunity to learn from them, Woodfield said. This experience, he said, underscores how important it is to study near misses, especially if true failures are rare.

In the 1970s and 1980s, standards for titanium melting required double or triple vacuum arc re-melt material with ultrasonic billet inspection typically at a #3 or larger flat-bottom hole. This inspection method, while state-of-the-art at the time, was insufficient, Woodfield said, because it likely missed inclusions of the size responsible for the Sioux City crash.

The inclusion that led to the disc failure was a “hard alpha” particle that contained nitrogen, causing the particle to be brittle and readily crack (Figure 5.3). Other inclusion categories are Type II alpha, where ingot segregation leads to areas overly rich in aluminum, and beta-stabilized, high-density inclusions, whose discovery in raw materials can disrupt the supply chain.

After the Crash: JETQC

After the disc failure was determined to be caused by a hard alpha inclusion, the FAA convened JETQC to address inclusions in premium quality titanium material with the overall goal of improving aviation safety. JETQC includes representatives from the FAA, premium quality titanium suppliers, and U.S. and EU engine makers. The organization is also pursuing more global membership to ensure a common and consistent reporting method around the world. Because JETQC operates similarly to the oil and gas industry-wide task groups, Woodfield suggested the JETQC experience could offer valuable lessons for addressing the oil and gas industry’s bolt failures.

JETQC worked hard to define which components are critical, find ways to improve the quality and reliability of these components, and encourage companies to share information on inclusions. The JETQC-001 specification, currently in its eighth iteration, defines what material is critical and what data will be collected and then details more than 100 specifications for more than 10 titanium alloys in use in critical engine discs. JETQC also implemented an early warning system

so that an uptick in inclusions can be quickly addressed by OEMs, suppliers, and industry-wide workshops.

Under JETQC-001, Woodfield said suppliers are required to quarterly report ultrasonic testing data on the frequency, size, and most importantly, the rate of inclusions by alloy and melt method. JETQC compiles annual reports and shares that information with the suppliers; these published reports follow a standard format that the FAA requires but do not become public record. The suppliers also conduct a formal root cause analysis on each melt inclusion with an assigned confidence level in the analysis, and then implement a series of corrective actions related to the identified potential root cause.

These data from supplier testing are considered to represent “near-miss” situations because the system allows manufacturers to avoid putting faulty materials into service. Suppliers were initially reluctant to share data in order to protect their proprietary information, but JETQC persevered through these “growing pains,” Woodfield said, and the results have proven extremely valuable. These data have become the baseline by which the industry measures whether the inclusion rate is getting better or worse, and the design community also uses the data to update probabilistic design methods.

OEMs are also required to report “component finds,” which can be near misses if inclusions are found through inspection, or failure data if a component failed in use. Happily, Woodfield said, the last failure was almost 20 years ago. When an OEM finds and reports an inclusion, a thorough investigation and chemical assessment of the material is conducted to attempt to determine the inclusion’s root cause.

The JETQC-001 specification also details how new suppliers or OEMs are included. Although companies can be reluctant to share knowledge in order to protect proprietary information, JETQC has worked to overcome this resistance, and new companies are in the qualification process, Woodfield said.

Achievements of JETQC and Industry

From 1990 to 2005, a period that saw many changes in the production and inspection of premium titanium, the rate of inclusions dropped dramatically (Figure 5.4). Collecting inclusion rate data led directly to a greater understanding of how significant the problem was, Woodfield said, and this in turn enabled improvements in every single point in the manufacturing process. Woodfield said that the way material was produced before the 1989 crash bears no resemblance to how it is produced today. Steady collection of these data bear these improvements out, and companies are careful to impress upon their workforce the importance of correctly following every step in the manufacturing process.

In addition to facilitating manufacturing improvements, individual OEMs also conduct training and hazard reviews for suppliers. JETQC has developed training

materials for the OEMs to use during the hazard reviews. Woodfield said these initiatives are particularly important because not everyone understands how such tiny particles can cause so much damage; training and reviews help to underscore the notion that every step on the shop floor is crucial to avoiding inclusions.

JETQC also compiled an exhaustive list of more than 100 potential sources of inclusions, before and after 1990. That effort took 2 years to complete and doubles as a history of the industry during this time, Woodfield said. Following this effort, the root cause for any inclusion now found by a supplier and its confidence level is anonymously included in the annual JETQC feedback to the suppliers, thus allowing all suppliers to assess their processes against known industry inclusion sources.

Differentiating between certain elements in an inclusion, especially nitrogen and titanium, at the microscopic level is very difficult, and Woodfield said that NIST has begun to help JETQC and the industry to improve measuring practices and methods to study individual inclusions. In addition, the FAA has funded a program to create standards against which companies can measure themselves. The companies will report data anonymously and then measure their practices against a “gold standard” to reinforce the aim of continual improvements.

Lessons Learned

Before closing, Woodfield outlined lessons from the JETQC experience that he believes may be applicable to the oil and gas industry. First, he said, the FAA’s regulatory oversight was crucial to the collaboration process. Without this government authority, he posited that manufacturers and suppliers would never have shared the proprietary information that the situation required.

Second, it is important to define the problem. Woodfield said it was encouraging that the oil and gas industry has defined critical bolts and critical applications, which helps designers, investigators, and standards bodies understand where to direct their attention, and just as importantly, where not to.

Third, measuring and publishing problems, near misses, and absence of problems is essential, Woodfield said. With very few actual events to draw upon, there can be a great deal of uncertainty around failure rates and root causes. In his view, measuring inclusion rates is the single most important thing JETQC has accomplished in its 27 years. Measurements show trends and can tie inclusion rate decreases or increases to procedural changes. The more data that can be included—including near misses in addition to actual failures—the stronger the conclusions will be.

Finally, Woodfield said that proactive, industry-wide initiatives have contributed to greater safety. The aviation industry has become more engaged in the collaborative improvement process while being careful to protect proprietary information. Establishing this trust among participants and stakeholders was essential starting the initial work, and maintaining a high level of trust has allowed more global companies to join the collaboration.

Other FAA initiatives were also helpful. The Rotor Integrity Subcommittee focuses on critical rotating engine parts of all materials (not just titanium). The FAA publishes advisory circulars that cover premium quality titanium and nickel, recommending practices for production and lifing of these parts.

Concluding his talk, Woodfield said JETQC’s focus on collaborating, evolving, and collecting data for 27 years has helped to dramatically lower the inclusion rate in critical aviation components. By publishing statistics and trends within the industry, JETQC has been able to create a “spotlight effect” on problem areas. This spotlight, he said, creates peer pressure to “get your house in order” without having to rely on legislation.

Driving down the inclusion rate has truly been a group effort. Without the cooperation of the FAA, suppliers, and engine producers, the material would be nowhere near the quality level we have today, Woodfield said in closing.

FAA REGULATORY REQUIREMENTS PROMOTE QUALITY PRODUCTS FOR AVIATION SAFETY

Angelia Collier, Federal Aviation Administration

Angelia Collier is an aviation safety inspector at the FAA. Her expertise is production approvals for manufacturers, who are known as production approval holders (PAHs). She presented an overview of the different aspects of the authority the FAA has over the industry, including audits and oversight, to offer assurances that the aviation industry is operating with safe, quality products and articles. In addition, she discussed bolt failures experienced in the aviation field and how the level of oversight for standard parts such as nuts and bolts provided by standards groups compares to the oversight previously provided by the Department of Defense.

The FAA’s Authority over Manufacturers

Collier explained that the FAA’s regulatory authority over aviation manufacturers is set forth in U.S. Code Title 49, Section 44701(a), Section 44702, and Title 14, Code of Federal Regulations (CFR), part 21. The statutory and regulatory requirements grant the FAA broad authority over numerous steps in aircraft production and operations, from design and production approvals to quality systems, supply control, and audits of manufacturers and suppliers. In addition, FAA Order 8120.23 is the policy document that explains how the agency conducts risk assessments of PAHs and determines the frequency of surveillance of PAHs.

FAA regulations determine the minimum safety standards for the design, material, construction, work quality, maintenance, and performance of airplanes, engines, and propellers. Collier noted that the FAA issues certificates and production approvals to ensure the design and production of the product or article meets applicable standards.

FAA orders contain detailed information for FAA personnel; the aviation industry also refers to FAA orders to establish its own procedures and controls. The FAA also provides guidance directly to the industry via advisory circulars to highlight specific methods manufacturers may use to meet regulatory requirements.

In order for a product or an article or aircraft to be placed into service, Collier noted that its manufacturer must acquire all the necessary FAA certificates and approvals. Type certificates and production certificates are essential to aircraft safety and are not issued by the FAA unless the PAH meets all requirements. For aircraft, engines, and propellers, type certificates are evidence of design approval; supplemental type certificates are required for design changes; and production certificates are required to produce aircraft, airplane engines, or propellers. After a type certificate is issued, a manufacturer has 6 months to apply for a production

certificate. These stringent requirements are how the FAA oversees the safety and quality of parts.

The FAA establishes minimum requirements for the design of aviation products and articles and issues certificates and approvals for initial design and major changes to design. FAA regulations require PAHs to have a quality system in place to ensure the production of safe, conforming products and articles. 14 CFR section 21.137 requires that the quality system be established and described in writing. The quality system includes 15 distinct elements to demonstrate that each product or article conforms to its approved design and is in a condition for safe operation. The intent is for each PAH to develop a quality system that meets both the needs of the PAH and the rule, Collier said. As such, PAH quality systems are scalable to the size and complexity of the product or article that is being produced. Collier pointed out that one of these elements requires PAHs to have a quality system in place that also covers their supply chain, including sub-tier suppliers. The FAA considers it the PAH’s responsibility to ensure that every part sourced will result in a product that conforms to FAA regulations.

Oversight and Audits

Collier talked about how the FAA oversees PAHs to ensure that they comply with regulations and their products meet the approved design. This authority is known as Certificate Management (CM), and it is a direct way to ensure PAHs are in compliance with FAA regulations. CM can be applied on either an ongoing or as-needed basis, depending on the situation, and is carried out by the FAA’s Aircraft Certification Service, known as “AIR.”

Ongoing CM takes place on a schedule and includes principal investigator evaluations, supplier control audits, and qualified security assessor audits. All audits include a product audit. The supplier control audit provides assurance that PAHs are using suppliers whose materials are in compliance with quality and design regulations. If there has been an accident or if a nonconforming part is found, the FAA enacts as-needed CM.

In order to direct its resources appropriately, the FAA conducts annual risk assessments of PAHs to determine how much oversight a given PAH needs. Risk assessments are based on three pillars: exposure of their products to the National Airspace System, organizational assessment, and facility assessment.

Mechanisms for Preventing Defective Bolts

The aviation industry and deep-sea offshore drilling industry share a commonality on defective fasteners (bolts). The Fastener Quality Act of 1990 was passed in response to the discovery of large amounts of counterfeit bolts. The act created

strict fastener requirements and was mostly aimed at pipeline vendors, suppliers, and users, but also impacted aviation manufacturers.

Defective bolts have been largely traced to improper manufacturing processes, especially heat treatment and passivation. In response to these problems, the FAA initiated the Suspected Unapproved Parts Investigations and launched Safety Alerts for operators. The agency also compiled data from the defective hardware.

The European Aviation Safety Agency (EASA) also discovered defective components in its aircraft that led to accidents in rotorcrafts and transport airplanes. EASA determined the cause to be defective nuts and bolts that were used in critical applications. The FAA, EASA, the various standards groups, and the aviation industry are collaborating to examine the problem and develop a harmonized solution.

The FAA allows for the use of “standard parts,” such as nuts and bolts, in type design under 21.9(a)(3). Anyone can make a standard part as long as it is made to government or industry standards. The FAA does not currently require design or production approval for these “standard parts,” but the agency assures manufacturers adhere to the appropriate specifications.

In the 1990s, the Department of Defense disbanded much of its quality infrastructure and standards oversight to reduce expenses. Standards groups such as the Aerospace Industries Association and the Society of Automotive Engineers took over fastener specifications, but didn’t provide the same level of quality oversight as the Department of Defense. The FAA is actively working with industry groups to better control standard parts.

PANEL 4 DISCUSSION: STANDARDS AND REGULATIONS

The fourth and final panel discussion, focusing on Standards and Regulations, was moderated by Brun Hilbert, principal engineer at Exponent’s Mechanical Engineering and Materials and Metallurgy practice.

During the panelists’ presentations, each speaker offered a different perspective on standards for critical parts, with special attention to the various ways different industries manage quality. Kachele described the processes of design decision making and risk assessment in the Navy, emphasizing the important role of information about the ocean environment in informing approaches to reduce risk. Miller’s role as API standards director allows him to have a bird’s eye view of standards as they apply to suppliers and OEMs and gives him the ability to analyze the diversified data API collects to continually revise and improve standards. Woodfield detailed how the aviation industry dramatically improved the quality of premium titanium parts for airplanes and offered several lessons that could assist the oil and gas industry. Collier summarized how the FAA exercises its authority to ensure the safety of civil airplanes through mechanisms including regulations, certifications, orders, advisory circulars, and audits.

Several themes stood out in the discussion that followed. Participants were eager to discuss lessons offered by the aviation industry’s experience, challenges with standards and specifications, how best to define “critical,” the importance of collaboration and data collection, and the threat posed by counterfeit or noncom-pliant parts. The session wrapped up with an opportunity for participants to offer final thoughts on the workshop as a whole.

Lessons from Aviation

David Matlock drew a parallel between the 1989 plane crash and the 10,000-bolt recall. In the case of the bolts, it was not possible to determine exactly which ones were defective, which is why the recall was so large. After the plane accident, he asked, how did the industry determine whether other parts in use might also have inclusions? Woodfield explained that there was a sweeping effort to remove and reinspect parts similar to those involved in the crash using a far more sophisticated inspection process to search for inclusions. In addition, some parts manufactured during the same era as those responsible for the crash were taken out of service.

Trent Fleece asked Woodfield if, in his experience, manufacturers resist examining their own practices, believing that other shops, but never their own, are responsible for creating inclusions. Woodfield agreed that he had seen this attitude but noted that over time, most suppliers “have come around.” Fleece noted the pervasiveness of human factors and biases and noted how difficult it can be to address such issues.

Fleece then asked if RCAs were conducted for every failure. Woodfield said that today every failure receives an RCA, but that hasn’t always been the case. As late as the 1990s, he saw speculation over root causes without much rigor involved. Over time, the industry recognized the importance of RCAs. Aviation usually uses a method called Team Oriented Problem Solving 8D, which has eight steps but places the most importance on answering questions, especially what didn’t cause the failure (known as “proving the converse”). The majority of the data used in these analyses come from the lack of failures, and that has been the “key piece” in aviation RCAs in Woodfield’s opinion. He also reiterated the importance of being able to define your level of confidence in the root cause identified.

Candi Hudson asked Woodfield about the processes used to characterize inclusions in titanium. First, Woodfield said, if an indication of an inclusion is found, the entire heat is depositioned. Then, the material is cut very carefully, because inclusions can be lost if the material is improperly sectioned. Next, a microprobe (not transmission electron microscopy) is used to confirm whether there is or isn’t an inclusion. If there is an inclusion, a microscopic investigation is run to understand what it is and where it came from.

Jyotirmoy Mazumder asked for clarification on what a hard alpha is and, in par-

ticular, whether hard alphas could appear through material sterilization, a routine procedure that improves a material’s mechanical properties. Some common alloys, he noted, include an alpha phase because this provides the best mechanical properties for the material. Does Woodfield mean that a hard alpha inclusion comes from this process, or something else? Woodfield replied that the term “hard alpha” refers to an alpha particle, but this particle is harder than usual because of the addition of oxygen, nitrogen, or carbon. For example, an air leak during melting can cause a hard alpha inclusion. Or an inclusion can be introduced during melting and then mostly disappear, but still cause problems because of its increased hardness.

Another participant noted that in the aviation industry, comprehensive testing occurs after a certain number of flight hours. If a problem is found, it’s essential to examine who made the plane, what airline owns it, and whether the problem stemmed from production or service conditions. Perhaps the oil and gas industry should put out similarly detailed reports, the participant posited, because currently microcracks and environmental contributing factors are not examined at this level. Collier expressed surprise that there was not a more thorough examination, particularly from a regulatory authority, when oil and gas critical fasteners fail.

Tim Haeberle asked Woodfield if the engine speed just before the Sioux City crash could have added stress that led the part to fail. In 1989, he asked, was that level of failure-point data available, and are those data available now in the Internet of Things era? Woodfield replied that traceability of the part was the critical data that determined its root cause. As for engine performance, record keeping then was very rudimentary, and the best they could do at the time was coordinate a count of the engine’s cycles with the fatigue level at the time of the failure. Today, he said, there are much more real-time data being collected; for example, if a part has a failure indication in flight, it is possible for a message to be sent to an engineer immediately so that a new part will be waiting for installation as soon as the plane lands.

The Challenge of Updating Standards

Robert Schafrik, committee chair, asked Miller about the challenges related to document control for standards and specifications, particularly for suppliers who must handle hundreds of documents that are constantly being updated. Miller explained that 20E and Q1 do have specifications for record retention and document control. Several different organizations provide API documents to suppliers via standing orders, which ensures that a new batch is sent out when a standard is updated. The bigger challenge, as he sees it, is that OEMs and suppliers must carefully analyze and interpret these changes to see how they affect a facility’s processes.

Tom Goin agreed that this documentation and updating process can be labor intensive. Every standard is reviewed two ways: for its technical aspects and for

how it must be applied in a factory. U.S. Bolt keeps records of past orders and asks for relevant standards with every new order. ASTM standards undergo frequent revisions, which can be confusing, and it is not required that the latest version be used. Unless the purchaser specifies exactly which version of a standard they want, the decision falls to the manufacturer or supplier, Goin said.

Following up on that point, Khlefa Esaklul raised the need for greater clarity on when manufacturers need to switch over to newer specs; while oil and gas companies usually follow the latest edition, he said he has seen engineers “hide behind” specifications that are older, particularly NACE MR175, which addresses stress corrosion cracking in CRAs. The industry and regulatory bodies should resolve this issue together, Esaklul said, so that even though documents frequently change, it remains clear which version should be used.

Esaklul asked Woodfield how the aviation industry handles the adoption of updates to standards. Woodfield replied that aviation component manufacturers must use the latest editions of all standards, and there is a short window of time, typically 6 months, between the release of new standards and the date by which companies are expected to adopt them. MacMoy added that in his experience, the answer can depend on the OEM, supplier, or purchaser.

Haeberle noted that ASTM standards cover much more than just bolts. They also cover commodity products that are made and stored by the thousands; if new specifications were forced into use within too short a time span, these stored products would become obsolete before they could be used. This, he said, is the reason ASTM has specifications from 1999 or even earlier that are still in use. API, however, explicitly states what edition is required. On occasion, API has eschewed updates, for example, to an ASME code, and opted to reference an earlier version in the API specification instead of adopting the update.

John Scully noted that defects in oil and gas equipment components aren’t necessarily as clear-cut as inclusions in titanium. For example, material can perfectly meet specifications but still suffer from HE or have banding that can lead to trouble. Aviation, in his view, has the “luxury” of a well-defined problem (inclusions), with well-laid-out steps for avoiding the development of this problem and systems for finding it when it occurs. 20E, conversely, casts a broad net in order to address all of the potential issues while still focusing on what is important, but the result is a lack of detail that adds confusion. Is it possible to write a specification that covers all of the many issues that could contribute to failure in subsea drilling and production?

Noting that no specification is a silver bullet, Kachele said the problem must be considered holistically, with controls applying to many different aspects. The Navy recently commemorated the loss of a submarine, the U.S.S. Thresher, which was lost in 1963 after undergoing sea trials. After the accident, the Navy underwent a sea change in its approach to building ships, altering design controls, design

reviews, maintenance routines, and material traceability over the ship’s whole life span, from ore to disposal. Attacking the problem from “a dozen different angles,” Kechele said, is the best way to minimize the risks as much as possible.

Miller weighed in to share API’s perspective. First, he said, while API tries to write specifications to adhere to all of ANSI’s four pillars, the organization places particular emphasis on openness. Anyone competent in a specific area can be included in the process, and discussions aren’t limited to one group’s interests. He said newcomers to the process are frequently surprised at the breadth of experience and the number of ideas that are considered before consensus is reached.

Second, API works with the idea of continuous improvement. Standards must be revised every 5 years, but some of the more important ones are evaluated much more frequently, Miller said. In addition, QMS audits are essential to revisions. A standard might be clear to API, but if audits reveal that manufacturers are having problems, revision is necessary.

Woodfield agreed that hard alpha inclusions may be easier to eliminate than the types of cracks workshop participants are grappling with. Although there are more than 100 known sources of inclusions, the list of known sources provides a valuable framework for investigators to use during root cause analyses. Based on the information provided at the workshop, he noted that it seems the oil and gas industry still faces a fair amount of uncertainty and data gaps, making it difficult to pinpoint root causes. Collecting certain data is complicated, but calculating problem rates is essential to gauging performance over time, he said.

Defining “Critical”

Elliott Turbeville asked how other industries define “critical” components, a concept that has been applied somewhat unevenly in the oil and gas industry. Kachele agreed that defining critical components is not simple and requires a lot of discussion among stakeholders. In the Navy, he said the program manager for a set of ships is responsible for risk analysis during design and construction. Once the ship is at sea, the fleet also provides input.

Woodfield said that in his experience in aviation, defining “critical” sometimes can be relatively easy; for example, if the failure of a component has the potential to lead to a loss of the aircraft, it is considered critical. On the other hand, if the result is something less extreme, such as reduced engine performance, then it is less straightforward. Collier agreed and added that for a part to be critical, it must provide a function that, if it failed, would significantly degrade the airworthiness of a plane and inhibit its ability to fly or land safely.

Echoing a point raised by a few participants throughout the workshop, Hilbert commented that it is also important to consider any relevant differences between oil and gas drilling operations versus production equipment. For example, he said

he has seen critical bolts fail in subsea flow lines, which are separate from drilling operations. Flow lines are in use for years and carry substantial amounts of oil and gas. Bolt failures in that context might not be as dramatic as those occurring on drilling equipment, but they could still cause severe environmental damage.

The Importance of Collaboration

Collier noted that the FAA has a strong history of collaboration with industry and other international regulatory bodies. If the FAA doesn’t know something, she said, the agency gets information through these relationships. She sees altering specifications as a collaborative process that involves data sharing and close cooperation among stakeholders.

Jon Shoemaker pointed out that an important difference is that the FAA has control over every aspect of planes “from cradle to grave,” but the oil and gas industry doesn’t have that kind of authority, especially with regard to its supply chain. He asked Collier how the FAA can manage the airworthiness of older planes that precede standards requirements and revisions, beyond safety notices and bulletins, especially when changes to standards are usually a sign of progress. Collier reiterated that industry collaboration is crucial at all steps of the FAA’s work; in her work on parts manufacturer approvals, industry is “always in the room” when a situation is being discussed. The FAA conducts its own research, and the process can be lengthy, but industry representatives actively collaborate and when a change or revision is announced, she said, “nothing is a surprise” to anyone.

Tying this conversation to the oil and gas industry experience, Fleece suggested that he might have inadvertently mischaracterized the relationship between the industry and BSEE. He emphasized that there is constant contact and collaboration between the two groups. Collier reflected that the FAA is perhaps more involved, and the aviation industry is perhaps more heavily regulated, because public safety is directly at risk when airplanes crash. In response, Fleece stressed that in his view the oil and gas industry is indeed heavily regulated. In addition to ensuring that frequently revised codes and requirements are properly followed by BP, Fleece also works on several committees with BSEE to communicate how the industry is interpreting the new rules. While that relationship is still evolving, he said it is quite different from where it was two decades ago, with significantly more collaboration in recent years.

Continuing, Fleece noted that BSEE inspectors perform on-site rig, BOP, and mobile offshore drilling unit inspections; act as a witness for predeployment testing; and ensure that records are in order. BSEE also reviews testing records for all of the self-tests that BP runs, such as function tests performed weekly and pressure tests performed every 2 weeks. Collier asked if BSEE stepped up its role after the

Deepwater Horizon spill, similar to what happened in the aviation industry after serious accidents, and Fleece said that the situation was analogous.

The Importance of Data Collection and Research

Haeberle noted that engineers prefer to have as much data as possible when problem solving. Right now, for example, the industry is specifically interested in data on cracking as it relates to CP and different strengths, and what effects deeper water and more extreme temperatures will have on yield strength and EAC resistance. He asked Kachele if the Navy, which is funded by U.S. taxpayers, has any public research to share in those areas.

Kachele answered that the U.S. Naval Research Laboratory is the best source for publicly available data. That organization focuses on fundamental research questions, such as how a material performs. Kachele’s work, on the other hand, centers around specific events on naval ships and is not publicly available. Derek Horton, U.S. Naval Research Laboratory, affirmed that the lab’s work is available in published reports and through the Defense Technical Information Center, both of which are publicly available and accessible online. However, he said, there is still a lack of information on newer, higher-strength fasteners because research is ongoing.

Prompted by Horton, Kachele briefly discussed the Navy’s approach to ensuring adherence to specifications. Kachele began with his definition of critical: If something can cause loss of life, it is critical. Other components clearly do not fall into this category, although there are also components that are in-between and more challenging to define. To address those areas, Kachele said the Navy has programs designed to determine a level of risk appropriate to the application and establish tailor-made controls for material, procurement, and design review of the application in question. Horton added that in the design review, the Navy takes a checks-and-balances approach to any changes, ensuring that a subject matter expert is involved in the process and has the final say on any configuration change.

Counterfeit and Nonconforming Fasteners

Johnson asked whether other industries have had experience with counterfeit bolting, and if the potential for counterfeit bolts to find their way into critical applications should be a concern for oil and gas. Collier answered that this was a significant concern for the FAA in the late 1980s and early 1990s, when subpar fasteners were being produced in China. However, she said, the issue was largely resolved when Congress passed the Fastener Quality Act in 1990; today, defective products are still a concern, but the problems do not generally stem from counterfeiting.

Kachele cautioned that there is a difference between counterfeit fasteners, which are outright fraud, and noncompliance, where manufacturers don’t know

that they aren’t meeting the proper specifications. He said he frequently receives fasteners that he knows do not meet the right standards. While it’s not fraud, it’s incompetence, which in some ways might be worse, he added.

Miller explained that like the Navy, API is more concerned about nonconformities than counterfeiting. He emphasized that API works strenuously to ensure compliance, such as through noncompliance reporting requirements in every specification, noncompliance reporting systems within API, and the API quality Monogram program. To his knowledge, he added, counterfeit bolts have made their way into consumer products but not manufacturing.

Johnson asked if the API Monogram could be counterfeited. Miller said he supposed it was possible, but the information of the licensees is also available online and frequently updated with additions and removals. Miller then shared a story of a counterfeit manufacturer that was discovered. API worked with law enforcement to audit the factory, and the investigation ultimately landed the perpetrators in jail, he said, underscoring the seriousness with which API treats such matters.

Goin added that counterfeiting of commercial fasteners has been around for a long time. He said he has even seen unscrupulous domestic distributors order low-quality, low-cost components from other countries, put the domestic distributor’s mark on fasteners, and sell them as a higher-quality product at a higher price. Asked by Johnson if it would be possible for such fasteners to make their way into critical functions, Goin responded that it is indeed possible, and that is why it is so important to know and trust your supply chain. Johnson remarked that perhaps smart counterfeiters would attempt to make critical bolts because they are more valuable, akin to counterfeiting a $100 bill instead of a $1 bill.

Kachele agreed, and pointed out that this discussion illustrates why a specification can take you only so far. You have to become familiar with your suppliers, limit their number, and visit them regularly in order to develop trust in their products and minimize the risk of failure. Shoemaker agreed that supply chain choices are essential. As a drilling contractor, he said he learned this lesson when his company started to commoditize different well equipment components instead of relying on its trusted OEM. The company set up new international supply chains and ended up with counterfeit or subpar components that led to problems on drilling rigs and failures at 50 percent of the supposed breaking strength. Because of that experience, he said, his company and its peers no longer stray far from OEMs or their top-tier suppliers.

Closing Remarks

Before closing, Hilbert invited attendees to share final thoughts and reflections on the workshop as a whole.

Although the workshop’s focus was on bolt failures, Fleece pointed out that it

is important to remember that most bolts don’t fail. He described work focused on better understanding the factors that may protect against failure. For example, side outlet valves on BOPs have eight critical bolts per flange. The bolts used in these applications are smaller and softer than most of the bolts discussed at the workshop, and they are very close to anodes for the CP system. The industry has conducted studies focused on these bolts and on other critical equipment areas, including other BOP bolts, trees, wellheads, flow lines, and manifolds, in order to get a better handle on what materials are being used, their failure rates, what other issues have come up, and what reporting systems are in place. Fleece said these studies, which have perhaps not been communicated as widely as they should be, have revealed trends consistent with existing action plans designed to prevent and address vulnerabilities.

Miller commented that in his view, workshop participants had overlooked the Safety Environmental Management Systems (SEMS) requirement, which was built off an API recommended practice (RP). RP75, which covers SEMS, improves safety, he said, by mandating more thorough employee training, empowering employees to make safety management decisions, and selecting independent third parties to conduct audits. SEMS audits are required for all production in the Gulf of Mexico, and the Center for Offshore Safety (located in Houston, Texas) has BSEE-granted authority to accredit entities that conduct the SEMS audits.

Schafrik closed the workshop by thanking everyone for taking the time away from their day jobs to help facilitate exchange of information and inform the committee’s activities.