Designing Safety Regulations for High-Hazard Industries (2018)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

3 Applications of the Conceptual Framework: Case Studies from the Pipeline and Offshore Oil and Gas Sectors To illustrate the regulatory design concepts from Chapter 2 with examples from high-hazard industries, this chapter contains four case studies. The first two review the pipeline regulatory regimes in the United States and Canada. The second two, from the offshore oil and gas sector, contrast the offshore regulatory regime in the United States with the regimes of the United Kingdom and Norway in combination. The four case studies are structured similarly. Before the individual U.S. and Canadian regimes for pipelines are examined, background is provided on the general structure, features, and operations of the pipeline industry in North America and the public safety interest that motivates its regulation. A similar structure is followed for the offshore sector. A general survey of the offshore oil and gas industry is provided, and then the U.S., UK, and Norwegian regulatory regimes are reviewed. In each case, consideration is given to the following: • Number, size, and geographic scope of the regulated firms; the complexity of their operations; and characteristics of their work- forces where appropriate; • Government agencies responsible for administering the regula- tions, including their budgetary resources and staffing levels and competencies; 34

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 35 • Types of regulations that make up the regimes on the basis of the conceptual framework discussed in Chapter 2;1 • Challenges regulators and regulated firms face in implementing, enforcing, and complying with the regulations; and • Challenges associated with assessing the effectiveness of the regula- tions in preventing catastrophic incidents. In addition to providing real-world examples of the various types of regulatory design, the case studies help illuminate the next chapter’s discus- sion of the factors regulators and policy makers must consider in making regulatory design choices. Among them are the characteristics of the indus- try and activities being regulated, the resources and competencies of the regulatory agency, and the broader policy and legal environment. The case studies are offered for these illustrative purposes, with no preconceptions about, or intention to assess, the safety performance of the two industries or relative effectiveness of the five regulatory regimes. The case studies were developed by reviewing specific regulations and industry and government documents. Chapters 4 and 5 draw on the broader scholarly literature to explain regulatory design choices by using examples from the case studies. Additional insights for the case studies were obtained from meetings with representatives from regulatory agencies and industry, including pipeline operators, drilling contractors, and oil and gas produc- ers. The case studies of the offshore sector, whose operations are more labor-intensive than those of pipelines, were further informed by briefings from labor union representatives. Offshore workers in the United Kingdom and Norway have formal roles in the development, review, and implemen- tation of safety regulations. The committee met with union officials from these countries to elicit worker views on the regulatory approaches. The committee would have valued the opportunity to have surveyed or met firsthand with workers, unionized and nonunionized, from a wide range of offshore professions; however, such means of access were impractical given the committee’s resources. Offshore workers in the United States are not unionized. Thus, in- formation on worker views of safety regulation could not be obtained directly. Nevertheless, the committee met with an official from a U.S. union representing workers in petrochemical industries. He conveyed his under- standing of how safety management programs work in these industries and how workers view them. The committee also invited briefings from 1 The case studies focus on micro-level and macro-means regulations and provide little information on the use of macro-ends regulations. However, all of the countries examined have such regulations, mainly in the form of liability regimes. For more information on these liability regimes, see Bennear (2015) and BIO by Deloitte and Stevens and Bolton (2014).

36 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES environmental interest groups from the North Sea region. Although these efforts were unsuccessful, a local official from a North Sea coastal commu- nity offered his views on the functioning and performance of the region’s offshore regulations. These individuals and the many others who informed the case studies are acknowledged in the Preface. PIPELINE SAFETY REGULATION IN THE UNITED STATES AND CANADA The pipeline industries in the United States and Canada share many char- acteristics, and regulation in both countries is intended to promote safety. These topics are discussed next. That discussion is followed by an examina- tion of the regulated firms, the regulatory agencies, and the regulatory re- gimes of each of the two countries. Many pipelines cross the U.S.–Canadian border, and the two countries have many similar regulatory requirements. Nevertheless, the regulatory regimes differ in some important respects, as explained in the case studies. General Characteristics of the North American Pipeline Industry A vast network of pipelines transports most of the natural gas and hazard- ous liquids, including crude oil and refined petroleum, shipped within the United States and Canada. As shown in Figure 3-1, the network consists of several system types that vary in size, physical properties, and use char- acteristics. Field and gathering pipelines are at the front end of the trans- portation process. They carry raw gas and crude oil short distances from production fields to processing and storage facilities. Their diameter and pressure profiles can vary considerably. Most gathering systems consist of smaller-diameter pipes (≤6 inches) that operate under low to moderate pres- sure [≤400 pounds per square inch (psi)]. However, some gathering lines can be much larger, especially when they are used to transport natural gas from fields to processing plants. Further downstream, transmission pipelines transport the processed gas and crude oil longer distances. Their high-pressure (400 to 1,400 psi), large-diameter (≥6 inches) lines can span several thousand miles. They connect to other transmission systems and storage hubs or terminate at refineries, chemical plants, and utilities. Transmission pipelines also carry gasoline, diesel, and other refined petroleum products from refineries to distribution centers.2 Most natural gas is transferred from transmission pipelines to local distribution systems for delivery to homes and businesses. Distribution 2 Some systems transport propane gas rather than natural gas.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 37 pipelines typically consist of a series of high-capacity steel mainlines that feed a grid of smaller-diameter (≤6 inches), low-pressure (≤100 psi) metal and plastic service lines connected to metered customers. Gathering, transmission, and distribution pipeline systems differ in many respects, both within and across system types. Gathering lines are usually owned by the gas and oil producers, whereas transmission pipe- lines are usually owned by energy transportation companies that are paid to move the shipments of others. The operators of the largest transmission networks employ hundreds of engineers and technicians for system control, operations, maintenance, and surveillance. Their systems are configured with pump or compressor stations positioned every 20 to 80 miles and SCADA3 systems for remotely controlling flow and monitoring lines for leaks. A single transmission company may operate a network of lines and storage centers. However, some transmission lines are not part of networks. For example, a company may operate a single line that connects an oil stor- age depot to a refinery less than 100 miles away. The variation in size and scope of natural gas distribution systems is even greater than that of transmission systems. On one end of the distribu- tion spectrum are large utilities that serve millions of customers in multiple communities. Their systems consist of hundreds of thousands of miles of pipeline, which are monitored and controlled by SCADA systems. They employ hundreds of engineers and technicians. On the other end are nu- merous gas distribution systems owned by individual municipalities and 3 Supervisory control and data acquisition. 3-1 3-2 FIGURE 3-1 Types of hazardous liquid and gas pipeline systems. NOTES: Flow lines, which carry wastewater or “produced” water to injection wells after separation of the water from the oil and gas, are not shown. Flow lines are subject to varying degrees of regulation but are not discussed further in this report. SOURCE: National Energy Board.

38 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES cooperatives. Many serve fewer than 10,000 customers, perhaps only a few hundred. The small municipal distribution systems seldom have SCADA systems and have few technicians and engineers on staff. The diversity within the gas distribution industry creates distinctive regulatory design and enforcement challenges. Transmission and distribution systems both can vary widely in design, configuration, materials, and construction methods. These characteristics reflect the state of practice and the level of technology of the period in which they were installed, along with other factors. For example, some older transmission pipelines cannot accommodate in-line cleaning and in- spection devices known as “pigs” because their pipe geometries are incom- patible. Some older gas distribution systems, which can date to the early 1900s, still contain iron pipe. The various pipe materials and fabrication methods, welding techniques, and external coatings used over the course of decades have thus led to systems requiring different condition monitoring, maintenance, and repair practices. In addition, pipeline systems are located in a wide range of envi- ronments that expose them to different soil chemistries; moisture levels; temperature extremes; and risks from natural hazards such as floods, earth- quakes, and landslides. They span urban, suburban, and rural settings and have exposure to environmentally sensitive areas as well as to concentra- tions of people and activities such as farming and excavation that risk third-party damage. A single pipeline can span many natural and human settings; this is even more so for a large network of pipelines. Pipelines also differ in the products they transport, especially in the case of hazardous liquid pipelines. For example, crude oil can differ in chemistry and in levels of density, viscosity, water, and sediment. These characteristics can affect operating, maintenance, and integrity management practices, such as pressure settings, cleaning frequencies, and the injection of chemicals for corrosion and flow control. The intensity of pipeline use can also influence these procedures. A pipeline that is underutilized or idle for periods because of low or no flow may need to be monitored more closely for internal corrosion caused by oxygen ingress, water, and deposits of sediment during those periods. Gathering lines that carry raw gas and crude oil from well sites can have high levels of water and other contami- nants such as salt, carbon dioxide, and sediment. The levels depend on the production source and whether extracted product is treated near the field. The variability in pipeline physical properties, use patterns, operating conditions, and environmental exposures means that operators must take into account many context- and system-specific factors when they choose pipeline design and construction methods and operating, maintenance, and repair procedures. Some of these choices will be highly tailored or unique, while others will be more uniform and standardized. Because there are

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 39 hundreds of thousands of miles of pipeline, multiple operators often face many of the same conditions and circumstances. Standards for practice and technology application have thus been developed for universal or common use. For example, call-before-you-dig systems can control many of the risk factors associated with third-party damage, regardless of whether the pipe- line is in an urban or rural setting; cathodic protection can control many of the risk factors associated with external corrosion, regardless of whether the pipeline is coated or uncoated; and vigilance in keeping water and sedi- ment levels below certain thresholds can help prevent internal corrosion, regardless of whether the system has older or newer steel pipes. Public Safety Interest of Regulation Pipelines can fail to contain their product for many reasons. Among them are violent ruptures, cracks, and small breaches caused by time-dependent mechanisms (such as corrosion and stress cracking) and by singular events (such as an excavation strike or a flood). Society has an interest in prevent- ing such failures to protect lives and property; minimize harm to wildlife and wildlife habitats; and avoid contamination of air, water, and soil. The United States averaged 280 pipeline failures resulting in fatalities, injuries, fire, explosion, loss of property, or environmental damage above a reporting threshold per year from 2006 to 2015. Most reported failures involved slow leaks, as opposed to sudden ruptures. From 2006 to 2015, the United States averaged 33 pipelines failures per year that resulted in deaths or injuries requiring hospitalization. Some resulted from ruptures.4 Ruptures can have catastrophic consequences. The 2011 rupture of a corroded gas distribution main in Allentown, Pennsylvania, killed 5 people, damaged 50 buildings, and caused the evacuation of 500 people.5 The 2010 rupture of a natural gas transmission line in San Bruno, California, caused an explosion that killed 8 people and damaged more than 100 homes.6 Releases from gathering and transmission lines that do not result in fires and explosions can also be harmful to the environment, especially when lines pass through or near environmentally sensitive areas. For example, the release of more than 800,000 gallons of crude oil from a ruptured trans- mission pipeline in Marshall, Michigan, into a tributary of the Kalamazoo River resulted in the country’s most expensive onshore oil spill cleanup.7 4 See Figure 1, https://fas.org/sgp/crs/misc/R44201.pdf. 5 See https://www.phmsa.dot.gov/PHMSA/Key_Audiences/Pipeline_Safety_Community/ Safety_Awareness_and_Outreach/Pipeline_Incidents/UGI_Utilities_Pipeline_Leak_in_Allentown,_ PA,Pipeline. 6 See https://www.ntsb.gov/investigations/AccidentReports/Reports/PAR1101.pdf. 7 See https://www.ntsb.gov/investigations/AccidentReports/Reports/PAR1201.pdf.

40 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES Case 1: U.S. Pipeline Safety Regulation The United States has about 200,000 miles of hazardous liquid transmis- sion pipelines, 300,000 miles of gas transmission pipelines, 240,000 miles of oil and gas gathering pipelines, and 2.2 million miles of gas distribution pipelines (see Table 3-1). The federal government establishes minimum safety regulations that apply to all pipelines, but states are allowed to regu- late intrastate pipelines as long as their programs are certified by the federal government. States cannot establish regulations for intrastate systems that are weaker than or incompatible with the federal requirements, but they can adopt more stringent requirements. Most states have opted to regulate their intrastate gas transmission and distribution systems by imposing requirements that are compatible with and sometimes more stringent than those imposed at the federal level.8 Only about one-third of states have sought certification to regulate intra- state hazardous liquid transmission pipelines, and therefore responsibility for regulating these systems and enforcing compliance rests largely with the federal government.9 More than 90 percent of the country’s 240,000 8 Except for Alaska and Hawaii, all states, as well as Washington, D.C., and Puerto Rico, participate in the program (http://www.napsr.org/About-NAPSR). 9 See http://pstrust.org/wp-content/uploads/2015/09/2015-PST-Briefing-Paper-14-Jurisdictional- Issues.pdf. TABLE 3-1 Length of Hazardous Liquid and Natural Gas Gathering, Transmission, and Distribution Pipelines in the United States, 2014 Length (miles) Gas and oil gathering 240,000 Hazardous liquid (oil and refined products) transmission 199,642 Gas transmission 301,816 Gas distribution 2,168,835 Total 2,910,293 SOURCES: Gathering Pipelines: Frequently Asked Questions (https://www.phmsa.dot.gov/ portal/site/PHMSA/menuitem.6f23687cf7b00b0f22e4c6962d9c8789/?vgnextoid=4351fd1a 874c6310VgnVCM1000001ecb7898RCRD&vgnextchannel=f7280665b91ac010VgnVCM 1000008049a8c0RCRD&vgnextfmt=print#QA_0); Pipeline Safety: Department of Trans- portation Needs to Complete Regulatory, Data, and Guidance Efforts (http://www.gao.gov/ assets/680/672809.pdf).

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 41 miles of oil and gas gathering pipeline are exempt from federal regulation, although some systems are regulated by states.10 The Regulated Industry Pipeline companies that must comply with government safety regulations are large in number and operate systems that vary widely in scope. About 600 companies own hazardous liquid pipelines.11 The dozen largest operate lines throughout the country; some of them operate lines in Canada as well. However, about 80 percent of hazardous liquid pipeline operators own less than 200 miles of pipeline. About 1,800 companies operate gas pipelines. About two dozen of them own more than 1,000 miles of transmission pipeline and account for 80 percent of all gas transmission pipeline mileage.12 However, most gas pipeline operators are local utilities. The United States has about 1,500 gas distribution systems, most of which are operated by utilities.13 About 120 of these systems serve more than 1 million customers, and about 600 serve fewer than 1,000. Most have between 1,000 and 10,000 customers. About two-thirds of all gas distribution systems are municipally owned, including most of the smaller systems. For example, of the 94 gas distribution systems in Indiana, only three have more than 30,000 customers.14 The small opera- tors seldom have SCADA systems, control rooms, or even compressors, and these operators average fewer than two dozen employees, most of whom are technicians and administrative personnel. The Regulators Pipelines are regulated at the federal and states levels in the United States. The U.S. Department of Transportation’s Pipeline and Hazardous Materials Safety Administration (PHMSA) administers the federal regulations. State regulations are usually administered by public utility commissions. The federal government sets the minimum safety standards for all pipelines but depends on states with approved programs for oversight and enforcement 10 See https://www.phmsa.dot.gov/staticfiles/PHMSA/DownloadableFiles/Pipeline/Technical%20 Advisory%20Committees/Tab%207b%20-%20Briefing%20-%20TPSSC%20Gas%20 Gathering%20Lines%20-%20Dewitt.pdf. 11 See http://www.phmsa.dot.gov/staticfiles/PHMSA/DownloadableFiles/110404%20 Action%20Plan%20Executive%20Version%20_2.pdf. 12 See https://www.eia.gov/pub/oil_gas/natural_gas/analysis_publications/ngpipeline/ MajorInterstatesTable.html. 13 See 2014 PHMSA Distribution Annual Report Data (http://www.phmsa.dot.gov/pipeline/ library/data-stats/distribution-transmission-and-gathering-lng-and-liquid-annual-data). 14 See http://onlinepubs.trb.org/onlinepubs/pbr/Allen071216.pdf.

42 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES of intrastate pipeline systems in particular. Without this state role, PHMSA would be responsible for ensuring that all systems, including the thousands of natural gas utilities, comply with the applicable federal regulations. PHMSA’s Office of Pipeline Safety (OPS) administers the federal pipe- line safety program. In this capacity, it establishes the regulatory agenda, administers an enforcement program, provides technical assistance to state pipeline safety programs, sponsors safety-related research, investigates inci- dents, and collects and analyzes reports on releases. OPS is funded by user fees assessed on each regulated transmission pipeline operator on a per mile basis.15 For fiscal year 2016, OPS’s total budget was approximately $150 million, an increase of about 40 percent since 2010.16 In 2016, OPS had a staff of about 270, approximately half of whom were inspectors.17 According to the Congressional Research Service, annual PHMSA budget requests have indicated an OPS staffing shortfall averaging about 25 employees per year from 2000 to 2016, with most of the gap oc- curring among inspector positions.18 PHMSA has reported that its ability to recruit inspectors with the array of engineering competencies it needs to enforce all of its regulations has been hampered because of competition with the higher-paying private industry.19 PHMSA estimates that about 80 percent of all pipeline inspections are conducted by state personnel.20 A reason for this large state enforcement role is that some states not only inspect intrastate gas distribution and transmission pipelines for compliance with federal and state regulations but have also been delegated authority by PHMSA to inspect interstate transmission pipelines. Approximately 400 state personnel are authorized to inspect interstate systems. PHMSA reimburses states for up to 80 per- cent of their total pipeline safety program expenditures.21 The scope of a state regulator’s activity is illustrated again by Indiana, whose public utility commission inspects the facilities of 94 gas distribution systems, 15 intra- state gas transmission systems, and more than three dozen master meter operators.22 15 See https://www.phmsa.dot.gov/org/office-of-pipeline-safety. 16 See https://fas.org/sgp/crs/misc/R44201.pdf. 17 See https://fas.org/sgp/crs/misc/R44201.pdf. 18 See https://fas.org/sgp/crs/misc/R44201.pdf. 19 See https://fas.org/sgp/crs/misc/R44201.pdf. 20 States inspect about 69 percent of regulated gas gathering lines, 35 percent of gas trans- mission lines, and 99 percent of gas distribution lines. They also inspect most liquefied natural gas plants and tanks (https://www.phmsa.dot.gov/pipeline/state-programs). 21 See https://www.phmsa.dot.gov/pipeline/state-programs. 22 Master meter operators are responsible for one meter and its downstream distribution piping for users such as mobile homes and apartment complexes.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 43 Regulation Design Types When federal pipeline safety regulations were first established in the 1970s, they were derived primarily from industry consensus standards in effect at the time.23 Consensus standards are developed by nongovernmental bodies using agreed-on procedures. Industry organizations, such as the American Petroleum Institute (API) and the American Gas Association, are important sources of pipeline standards in the United States. Professional societies such as the American Society of Mechanical Engineers and the National Association of Corrosion Engineers also play an important role in developing consensus standards that apply to pipelines. Since passage of the National Technology Transfer and Advancement Act of 1995, federal policy has favored the use of consensus standards.24 More than 60 con- sensus standards have been “incorporated by reference” in federal pipeline safety regulations, which means that these otherwise nongovernmental standards have been adopted by regulators, placed in binding federal rules, and now must be followed in the same manner as any other government- issued regulation.25 Box 3-1 shows the breadth of the subject matter addressed by hundreds of regulations that make up the federal safety regime for hazardous liquid pipelines. The regime for gas pipeline systems covers many of the same top- ics. State regulations are too numerous and varied to describe here. How- ever, state regulations can apply stricter standards than or address matters not covered under federal regulations. A review of the complete U.S. pipeline safety regulatory regime, as formed by federal and state regulations collectively, is not practical or necessary for the purposes of this study. The federal regime alone contains numerous examples of the regulation design types discussed in Chapter 2. It includes many regulations that are highly targeted, with a micro-level orientation. These regulations have aspects that are means-based (e.g., re- quirements that a pipe be made from a specific grade or thickness of steel) and aspects that are ends-based (e.g., requirements that a pipe pass a pres- sure test). In addition, the federal regime contains several regulations that are more generalized. They are better described as having a macro-level 23 See https://primis.phmsa.dot.gov/comm/inspection.htm. 24 Office of Management and Budget Circular A-119 provides guidance to agencies on the use of consensus standards. 25 Concern about the public’s ability to access and review these standards has at times been an issue when references are made in federal regulations to industry consensus standards that are proprietary. See specifically PHMSA’s implementation of Section 24 of the Pipeline Safety, Regulatory Certainty and Job Creation Act of 2011. Section 24 states that the Secretary “may not issue guidance or a regulation . . . that incorporates by reference any documents or por- tions thereof unless the documents or portions thereof are made available to the public, free of charge, on an Internet website.”

44 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES Box 3-1 Major Provisions of U.S. Hazardous Liquid Pipeline Safety Regulations Title 49 CFR Part 195—Transportation of Hazardous Liquids by Pipeline Subpart C—Design §195.100 to §195.134 Includes pipe and component design require- ments governing design temperature; internal design pressure; external pressure and loads; valves and fittings; closures and connections; and station pipe and breakout tanks. Subpart D—Construction §195.200 to §195.266 Includes construction-related requirements governing material inspection; transportation of pipe; location of pipe; installation and cov- erage of pipe; welding procedures and welder qualifications; weld testing and inspection; valve location; pumping stations; and cross- ings of railroads and highways. Subpart E—Pressure Testing §195.300 to §195.310 Includes requirements governing pressure testing of pipe, components, tie-ins, and breakout tanks. Also contains requirements for risk-based alternatives to pressure testing of older pipelines. Subpart F—Operations and Maintenance §195.400 to §195.452 Includes requirements for an operations, main- tenance, and emergency response manual; maximum operating pressure; inspections of breakout tanks and rights-of-way; valve main- tenance; pipe repairs; line markers and signs; public awareness and damage prevention programs; leak detection and control room management; and integrity management in high-consequence areas. Subpart H—Corrosion Control §195.551 to §195.589 Includes regulations on coatings for exter- nal corrosion control; coating inspection; ca- thodic protection and test leads; inspection of exposed pipe; protections from internal corrosion; protections against atmospheric corrosion; and assessment of corroded pipe.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 45 orientation because they require operators to establish management plans and programs aimed at reducing overall risk. A number of examples of these varied regulatory design types follow, starting with the more numer- ous micro-level regulations. Micro-Level (Prescriptive and Performance-Based) Regulations As noted, many of the federal pipeline regulations require operators to follow refer- enced consensus standards. For example, hazardous liquid pipeline regula- tions state that new steel pipe must comply with the mandatory provisions of API Specification 5L (Specification for Line Pipe),26 that valves must meet the minimum requirements of API Specification 6D (Specification for Pipeline Valves),27 and that welding must be performed by a qualified welder in accordance with API Standard 1104 (Welding of Pipelines and Related Facilities).28 These standards are sometimes means-based in that they require the use of specific designs, materials, or equipment, but many have elements that are ends-based because they establish testing and evalu- ation criteria. Some regulations do not reference consensus standards but instead directly specify a means to be used or a procedure to be followed. For ex- ample, copper pipe used in gas distribution mains must have a minimum wall thickness of 0.065 inch,29 gas service lines must have a shutoff valve in a readily accessible location outside the served building,30 and operators must inspect their mainline valves at least twice per year.31 Other PHMSA regulations with a micro-level orientation can be char- acterized as having an ends-based design because they provide the operator with latitude for selecting compliant pipe designs, materials, and installa- tion procedures as long as pipelines and their installation procedures pass certain tests or have certain qualities. An example is a regulation that es- tablishes a formula for calculating a gas pipeline’s safe maximum operating pressure when choices can be made among design parameters, materials, and fabrication (e.g., welding method) options.32 The pipeline designer is thus given flexibility to combine design, material, and fabrication choices to satisfy other goals, such as accommodating a certain operating environ- ment or meeting a desired throughput capacity. Another example is the PHMSA rule governing pipeline coating systems to prevent external corro- sion, which states that a coating must have sufficient adhesion to the metal 26 §195.106(b)(1)(i); §195.106(e). 27 §195.116(d). 28 §195.222; §195.228(b). 29 §192.125(a). 30 §192.365(b). 31 §195.420(b). 32 §192.105.

46 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES surface to prevent under film migration of moisture, be sufficiently ductile to resist cracking, have enough strength to resist damage due to handling and soil stress, and support any supplemental cathodic protection.33 Any coating system may be used as long as it meets these requirements. Other examples are requirements that compressor stations have emergency shut- down systems “capable of blocking gas” out of the station,34 that pipe be installed with “adequate protection” to withstand anticipated external pres- sures and loads,35 and that pipe materials be “chemically compatible” with any commodity they transport.36 By specifying required qualities rather than mandating particular technologies, these regulations offer operators a degree of flexibility. Macro-Level (Management-Based and Liability) Regulations A number of federal pipeline regulations can be characterized as means-based but at a macro-level because they require operators to establish certain plans, pro- cedures, and management programs. In general, these regulations do not require a specific safety outcome to be achieved by the mandated program. An example is the requirement that all pipeline operators develop a written public awareness program that follows the guidance in API Recommended Practice 1162 (Public Awareness Programs for Pipeline Operators); how- ever, the regulation does not establish a means of measuring the success of the program in raising public awareness.37 Another is the requirement that each operator with a SCADA system establish written procedures that, among other things, define the roles and responsibilities of a controller during normal and emergency conditions and create a recording system for controller shift changes.38 In this case, the regulation gives operators discretion to develop program content, but in other cases the regulations can be highly prescriptive of program content. An example of the latter is the requirement that all operators have a call-before-you-dig notification system as part of the public awareness program.39 Perhaps the most prominent macro-means commands in PHMSA’s regulatory regime are those requiring operators to develop and follow a written integrity management (IM) program.40 These regulations require a program containing risk-based plans and procedures for choosing specific methods to be used for assessing the condition of pipelines, for selecting 33 §192.461. 34 §192.1697(a). 35 §192.103. 36 §195.4. 37 §192.616; §195.440. 38 §192.631. 39 §192.616; §195.440. 40 §192 Subparts O and P; §195.450 and §195.452.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 47 preventive and mitigative measures, and for measuring the program’s ef- fectiveness in managing risks. Operators are given flexibility to choose the methods and processes to be used in complying with the required program elements. The flexibility is intended to recognize the variability among pipe- line system designs, configurations, and operating environments. IM regulations were first applied in 2000 for large hazardous liquid transmission pipelines that could affect environmentally sensitive areas. They were extended to gas transmission pipelines in 2003. In 2006, Con- gress required PHMSA to extend IM program regulations to all gas dis- tribution systems.41 However, as discussed above, the distribution sector differs in many fundamental ways, such as in the presence of many small pipeline operators, from the transmission sector. The inspection of distribu- tion systems is also handled almost entirely by states, and state inspectors are now responsible for ensuring compliance with distribution system IM requirements. To accommodate these differences, PHMSA’s regulations for distribution systems simplify many of the IM requirements that apply to op- erators of transmission systems. For example, the regulations for distribu- tion systems require each operator to prepare and implement a written IM program containing several key elements (e.g., identify threats, assess and prioritize risks, identify and implement appropriate measures to mitigate risks, measure performance, and evaluate effectiveness). The elements are presented in a general manner to facilitate compliance by a diverse set of operators. Even more streamlined IM requirements apply to master meter operators and owners of propane pipe systems. Nevertheless, for reasons explained below, the extension of IM regulations to distribution systems has led to a number of implementation and enforcement challenges. The federal pipeline safety laws and regulations themselves do not contain a macro-ends general duty provision imposing an overarching requirement that pipeline systems be operated and maintained safely.42 Some state regulations may contain such provisions. At the federal level, an ex post liability and penalty regime was created by the Oil Pollution Act of 1990 (OPA 1990), which amended the Clean Water Act of 1972.43 Although it does not address personal injury, the amended act makes the responsible party liable for other damages. In addition, pipeline operators 41 Pipeline Inspection, Protection, Enforcement and Safety Act of 2006. 42 An example of a general duty requirement is Section 5(a)(1) of the Occupational Safety and Health Act of 1970, which requires that employers provide a workplace that is “free from recognizable hazards that are causing or likely to cause death or serious harm to employees.” 43 The penalty regime was established by the Clean Water Act of 1972, which, as amended by OPA 1990, assesses maximum penalties for a harmful discharge of oil from an offshore installation of $25,000 per day or $1,000 per barrel, except where the discharge is the result of gross negligence or willful misconduct, in which case the penalty shall be no less than $100,000 and no higher $3,000 per barrel of oil.

48 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES can be subject to tort laws that impose a liability, strict or fault-based, on anyone whose conduct causes harm to others and the environment. The possibility of a tort action, such as civil suits brought by victims of the Al- lentown gas line explosion and by the State of Michigan for environmental and economic damages caused by oil released into the Kalamazoo River, can create ex ante incentives for operators to take precautionary measures. Implementation, Compliance, and Enforcement Challenges Micro-level regulations, including most references to industry consensus standards, can create a number of implementation challenges for regula- tors and compliance challenges for industry. In briefings to the commit- tee, PHMSA officials acknowledged the difficulty of keeping references to consensus standards current because of their sheer number (consensus standards sometimes incorporate other consensus standards), the need for PHMSA staff to participate on more than two dozen consensus standards committees, and the need to initiate rulemaking proceedings to include references to updated standards.44 The demands of this rulemaking process are discussed in Chapter 4. PHMSA and industry representatives agreed that micro-means stan- dards can be appropriate when a common risk source is well known, is predictable, and can be targeted with a trusted control measure. However, they expressed concern that if the standards are too rigid, they can limit the ability of operators to use alternative but equally or more effective means suited to their individual circumstances. Larger operators in par- ticular questioned whether a collection of micro-means regulations could adequately address the risks that arise from their complex and diverse sys- tems. PHMSA officials expressed similar views. The agency’s rationale for introducing the IM regulations was to place more direct responsibility for safety assurance on pipeline operators, who know the details and presum- ably many of the sources of risk of their systems. In its original justification for the IM rule applied to hazardous liquid pipelines, PHMSA reasoned that “our analyses indicate that many accidents are caused by complex factors involving mechanical and control system failures, previous outside force damage, system design errors and operator error. These accidents indicate the need for operators to address the potential interrelationship among failure causes and to implement coordinated risk control actions to supple- ment the protection of the regulations.”45 Some pipeline operators have exhibited difficulty in complying with the required analytical, procedural, and planning requirements of the 44 See http://onlinepubs.trb.org/onlinepubs/pbr/Mayberry071216.pdf. 45 See https://primis.phmsa.dot.gov/iim/docsr/IMPLgLiq_PublishedFinalRule.pdf.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 49 IM regulations. In 2006—a few years after the first IM regulations were introduced—the U.S. Government Accountability Office interviewed opera- tors concerning their experience in complying with the requirements. Most claimed to be generally satisfied with their ability to comply, but some raised concerns about the regulations’ many documentation requirements.46 In briefings to the committee, PHMSA officials expressed concern about the lack of operator progress in complying with some program requirements, particularly requirements for risk modeling and assessment. The officials reported that many simplistic risk management methods were still being used by operators and that many operators had not developed the ability to improve programs by evaluating their effectiveness in managing risks.47 Deficiencies in the IM programs of operators have also been found in three National Transportation Safety Board (NTSB) investigations of severe pipeline incidents since 2010, including the gas pipeline explosion in San Bruno. NTSB concluded that the development and execution of IM programs requires operators to have the expertise to integrate multiple technical disciplines, including engineering, materials science, geographic information systems, data management, statistics, and risk management.48 NTSB concluded that sufficient expertise was often lacking among opera- tors and recommended that PHMSA increase its guidance to industry on how to develop and implement key elements of IM programs. PHMSA officials noted that they have been working with industry to fill some of these gaps—for example, by forming a risk modeling working group con- sisting of government and industry experts. PHMSA also cooperated with the pipeline industry in the development of API Recommended Practice 1173 (Pipeline Safety Management Systems), which provides guidance on the development of a pipeline safety management system. PHMSA officials expressed a view to the committee that to overcome a “culture of minimum compliance,” operators must have an effective safety management system.49 The application of API Recommended Practice 1173 remains voluntary. Along with these efforts to offer more compliance guidance to in- dustry, PHMSA has been adding more details to its requirements for IM programs—a development that some industry representatives described as increasingly “prescriptive.” For example, revised regulations now explain to operators how they should validate their risk models and prioritize their repairs of defects discovered through IM programs.50 PHMSA officials noted a number of challenges in enforcing compliance 46 See http://www.gao.gov/assets/260/251383.pdf. 47 See http://onlinepubs.trb.org/onlinepubs/pbr/Mayberry071216.pdf. 48 See https://www.ntsb.gov/safety/safety-studies/Documents/SS1501.pdf. 49 See http://onlinepubs.trb.org/onlinepubs/pbr/Mayberry071216.pdf. 50 Hazardous Liquid NPRM (Nov. 2015), 80 FR 61610, and Gas NPRM (March 2016), 81 FR 20722.

50 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES with IM program requirements. They pointed out that some inspector staff- ing positions remain unfilled and that inspectors at the federal and state levels have complained about the difficulty of assessing compliance with “subjective” regulatory requirements. NTSB has previously urged PHMSA to strengthen aspects of inspector training and to develop minimum pro- fessional qualifications for all personnel involved in implementing and enforcing IM programs. PHMSA officials explained that they have sought to fill all of the vacancies in the federal inspection workforce and to make the inspection process more data-driven, risk-informed, and investigative. State regulators also reported that some aspects of the enforcement of IM regulations can be especially challenging for their inspection per- sonnel.51 They described operator compliance with management-based commands, such as IM regulations, as being difficult to assess when state inspectors do not have the requisite auditing skills and training to evalu- ate the content and quality of IM program plans and their execution. The simplified IM requirements coupled with the need for audit-based enforce- ment by dozens of state agencies—encompassing a wide range of inspector resources and capabilities—led PHMSA to issue an 11-page inspection form for state inspector guidance.52 This form is designed to be a checklist verifying documentation and is considerably shorter and less thorough than the 132-page inspection manual53 that PHMSA’s personnel, along with some state personnel, use to review the IM programs of larger interstate transmission systems. State regulators also reported that local gas distribution systems differ in their ability to develop and follow IM programs, an indication of vari- ability in the complexity, size, and staffing of these systems. This problem was confirmed by a representative from a small municipal system.54 The representative also pointed out that PHMSA has been working to help operators of small systems comply, most notably by supporting the develop- ment of software that guides smaller systems in the creation of an IM plan. The software program, known as SHRIMP (Simple, Handy, Risk-Based Integrity Management Plan), creates IM plans that can be customized to small gas pipeline systems. In addition, PHMSA has teamed with state 51 See http://onlinepubs.trb.org/onlinepubs/pbr/Allen071216.pdf. 52 See https://primis.phmsa.dot.gov/dimp/docs/Form_22_PHMSA_DIMP_InspectionForm_192.1005_ Operators.pdf. 53 PHMSA Gas Integrity Management Inspection Manual: Inspection Protocols with Results Forms, August 2013 (https://primis.phmsa.dot.gov/gasimp/documents.htm). 54 See http://onlinepubs.trb.org/onlinepubs/pbr/Crowley071216.pdf.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 51 regulators in the development of inspection methods and guidance for the evaluation of these plans.55 Evaluation Challenges Major pipeline failures have at times led to calls for regulatory evaluation and change. As noted in Chapter 1, several catastrophic failures during the 1990s prompted PHMSA to promulgate its first IM regulations in 2000. The occurrence of catastrophic failures in recent years has tended to have the opposite effect of prompting calls for regulators to target regulations to specific risks. PHMSA has responded with proposals to add detail and specificity to its IM regulations, as noted above. After the 2010 San Bruno explosion, the Office of the Secretary of Transportation commissioned its own evaluation of the effectiveness of the IM regulations in assuring pipeline safety.56 The report, which was released in April 2016, concluded that there has been no clear evidence of the posi- tive safety outcomes expected when the IM rules were first introduced, par- ticularly for gas transmission pipelines. The report attributed safety gains to the effect of other regulations, especially requirements for operators to establish damage prevention programs. Although many of the statistical analyses in this commissioned evaluation of PHMSA’s IM regulations are caveated and qualified, their credibility is not examined here because an assessment of the safety performance of individual regulations was not the purpose of the case studies. Liability concerns have reportedly inhibited operators from sharing safety-related data among themselves and with regulators, which has ham- pered the ability of PHMSA to evaluate its regulatory requirements and aid operators in improving their IM programs. This issue has been recognized by Congress, which in 2016 required the creation of a Voluntary Informa- tion Sharing System Working Group.57 The purposes of this group, which consists of state regulators, operators, safety advocates, and labor represen- tatives, are to advise the agency on ways to encourage operators to share inspection results and other data that can be used to improve the industry’s risk analysis practices and to assess the effectiveness of federal regulations. 55 In a manner similar to personal income tax preparation software, SHRIMP asks users a series of questions about the design, construction, inspection, and maintenance of their piping system. On the basis of the answers, SHRIMP ranks items by relative risks (e.g., exposed pipe with metal loss), proposes actions for addressing them (e.g., upgrading cathodic protection), and suggests performance measures (e.g., tracking the number of low cathodic protection readings). 56 See https://www.transportation.gov/sites/dot.gov/files/docs/IM-PE_Report.pdf. 57 See http://www.phmsa.dot.gov/pipeline/regs/technical-advisory-comm/voluntary- information-sharing-system-working-group.

52 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES During the group’s first meeting in December 2016, participants discussed ways to encourage the exchange of pipeline inspection information and the development of advanced pipeline inspection technologies and enhanced risk analysis.58 Case 2: Canadian Pipeline Safety Regulation The Canadian network of hazardous liquid and gas pipelines spans about 500,000 miles, including transmission, gathering, and distribution pipelines (see Table 3-2). Approximately 270,000 miles are gas distribution lines and 65,000 miles are large-diameter transmission lines, several of which cross the U.S. border. The remaining 165,000 miles are in field gathering and transmission pipeline feeder systems.59 Regulatory jurisdiction over Canadian pipelines is divided among the federal and provincial governments. The federal government regulates about 45,000 miles of pipelines crossing provincial or international bor- ders.60 They typically consist of larger-diameter transmission pipelines that carry oil and natural gas long distances. Provincial governments regulate pipelines operating exclusively within their borders. These usually consist of upstream oil and gas gathering and feeder pipelines and include gas distri- bution pipelines.61 Because of its many production fields, storage terminals, upgraders, and refineries, Alberta alone regulates about 240,000 miles of 58 See https://primis.phmsa.dot.gov/meetings/MtgHome.mtg?mtg=12. 59 Feeder systems transport oil and gas from field storage sites to transmission terminals or gas processing plants. Their mileage is usually included in gathering system mileage in the United States but may also be included in transmission mileage depending on pipe size and system length. 60 See https://www.nrcan.gc.ca/sites/www.nrcan.gc.ca/files/energy/files/pdf/14-0277-%20PS_ pipelines_across_canada_e.pdf. 61 See https://www.neb-one.gc.ca/bts/nws/rgltrsnpshts/2016/01rgltrsnpsht-eng.pdf. TABLE 3-2 Length of Hazardous Liquid and Gas Transmission and Distribution Pipelines in Canada, 2014 Length (miles) Oil and gas gathering and feeder 165,000 Oil, gas, and products transmission 65,000 Gas distribution 270,000 Total 495,000 SOURCE: Pipelines Across Canada (https://www.nrcan.gc.ca/sites/www.nrcan.gc.ca/files/ energy/files/pdf/14-0277-%20PS_pipelines_across_canada_e.pdf).

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 53 pipeline.62 A total of about 450,000 miles of pipelines are provincially regulated. The Regulated Industry The Canadian pipeline industry resembles that of the United States. Ap- proximately 100 companies are subject to Canada’s federal regulations because they operate one or more lines that cross a provincial border.63 For regulatory purposes, the companies are categorized as Group 1 and Group 2. Group 1 companies receive a greater degree of regulatory over- sight than Group 2 companies.64 The former include companies that oper- ate extensive systems and serve many shippers. The latter generally operate smaller, less complex pipeline systems with few or no third-party shippers. Thirteen of the federally regulated pipeline companies are classified as Group 1. A number of them operate transmission systems in the United States. Pipeline companies falling under provincial jurisdiction generally operate gathering, feeder, or distribution pipelines. They can be indepen- dent entities, affiliates of federally regulated companies, or provincial or municipally owned companies. As in the United States, many distribution pipeline systems are operated by local utilities. The Regulators The National Energy Board (NEB) is the Canadian federal regulator with responsibility for pipelines crossing provincial or international borders. It is an independent agency governed by seven permanent board members with 460 full-time staff.65 In addition to pipelines, NEB regulates international power lines, energy exports and imports, and oil and gas exploration and production in certain northern and offshore areas. Its pipeline regulatory responsibility covers the complete life cycle of a pipeline from its siting, design, and construction through its operation, maintenance, and decom- missioning. Funds for NEB’s regulatory regime are appropriated by the federal government; however, industry levies based on company traffic activity recover about 90 percent.66 For intraprovincial pipelines, regulatory oversight is the responsibility 62 See https://www.nrcan.gc.ca/sites/www.nrcan.gc.ca/files/energy/files/pdf/14-0277-%20PS_ pipelines_across_canada_e.pdf. 63 See https://www.nrcan.gc.ca/sites/www.nrcan.gc.ca/files/www/pdf/publications/emmc/14- 0177_Pipeline%20Safety_e.pdf. 64 See https://www.neb-one.gc.ca/bts/whwr/cmpnsrgltdbnb-eng.html. 65 See https://www.neb-one.gc.ca/bts/nws/fs/nbqckfcts-eng.pdf. 66 See https://www.neb-one.gc.ca/bts/cstrcvr/prsnttn/ssntlcstrcvr/ssntlcstrcvr-eng.html; https://www.neb-one.gc.ca/bts/pblctn/dtrrprtndnbfnnclsttmnt/dtrgnrlrprt2015-2016-eng.html.

54 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES of the province and is exercised through a number of mechanisms. Some provinces have created administrative agencies with pipeline regulation and enforcement responsibilities; others have established public review boards or utility commissions with legislated authority.67 Both NEB and provincial regulators rely to a significant degree on the Canadian Standards Association (CSA) for the development of stan- dards for pipeline design, construction, operations, and maintenance.68 CSA is an independent not-for-profit standards development organization. Its overarching standard (CSA Z662) for oil and gas pipeline systems is developed and maintained under the direction of a joint committee com- posed of federal and provincial regulatory authorities, pipeline operators, oil and gas producers, suppliers, fabricators, contractors, and general inter- est participants.69 Because of this involvement by government authorities, CSA standards have traditionally been referenced by Canadian federal and provincial regulators. Types of Regulation Although federal and provincial pipeline regulatory regimes are distinct, they share a common foundation through the adoption in whole or in part of the pipeline standards developed by CSA. Most of these standards are technical (micro-level), with some specifying required means and others specifying required ends. In recent years, both federal and provincial regula- tors have introduced more macro-means, management-based regulations. NEB introduced its first safety management system requirement in 1999 in response to studies of catastrophic incidents and the recognition that a series of highly targeted and detailed regulations could lead to some facility- specific risks not being adequately addressed.70 The agency’s regulations for management programs have expanded over time. They now include requirements that operators establish safety, security, damage prevention, environmental protection, and IM programs.71 Because so many management programs have been called for, NEB has taken the step of requiring that operators have an overarching management 67 See https://www.nrcan.gc.ca/sites/www.nrcan.gc.ca/files/www/pdf/publications/emmc/14- 0177_Pipeline%20Safety_e.pdf. 68 See https://www.nrcan.gc.ca/sites/www.nrcan.gc.ca/files/www/pdf/publications/emmc/14- 0177_Pipeline%20Safety_e.pdf. 69 See http://d1lbt4ns9xine0.cloudfront.net/csa_core/ccurl-zip/218/296/SDP_2-1_Part_1_%20 Participants-and-organizational-structure-2014.pdf. 70 See http://news.gc.ca/web/article-en.do?mthd=tp&crtr.page=1&nid=1060979&crtr. tp1D=1. 71 See http://laws-lois.justice.gc.ca/PDF/SOR-99-294.pdf.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 55 system integrating the many required management programs.72 Operators are provided with guidance on the implementation of this system as well as on the implementation of individual management programs. These guide- lines can be specific in comparison with the generality of NEB regulations. For example, the regulation requiring an IM program states that a company “shall develop, implement and maintain an integrity management program that anticipates, prevents, manages and mitigates conditions that could ad- versely affect safety or environment during the design, construction, opera- tion, maintenance or abandonment of a pipeline.”73 NEB’s Guidance Notes cover management system requirements, condition monitoring, mitigation, and record-keeping expectations in substantial detail.74 CSA standards now also require pipeline operators to establish a num- ber of macro-means, management-based programs. By referencing these standards, provincial regulators have joined NEB in requiring operators to establish programs for IM, damage prevention, emergency management, and the like. CSA issues guidelines to assist smaller, provincially regulated operators in complying with these program requirements.75 Although the standards are usually generalized, the guidelines on implementation can be detailed.76 Many provinces require operators not only to follow the CSA standard but also to comply with CSA’s more detailed implementation guidance. Implementation, Compliance, and Enforcement Challenges In briefings to the study committee, representatives of NEB and Canadian transmission pipeline operators shared their perspectives on the challenges associated with regulatory implementation, compliance, and enforcement. As did U.S. pipeline regulators and operators, they observed that the more technical, micro-level requirements in the CSA standards are more read- ily understood by company staff and agency inspectors, which facilitates compliance with and enforcement of the requirements. They reported that the macro-means, management-based regulations leave openings for inter- pretation that create challenges in achieving an understanding among the regulators and companies concerning expectations and deliverables. Despite these challenges, the NEB official emphasized the importance of management systems for driving safety improvements by inducing opera- 72 See http://laws-lois.justice.gc.ca/PDF/SOR-99-294.pdf. 73 See https://www.neb-one.gc.ca/bts/ctrg/gnnb/nshrppln/gdncntnshrpplnrgltn-eng.html#s40. 74 See https://www.neb-one.gc.ca/bts/ctrg/gnnb/nshrppln/gdncntnshrpplnrgltn-eng.html. 75 See https://www.nrcan.gc.ca/sites/www.nrcan.gc.ca/files/www/pdf/publications/emmc/14- 0177_Pipeline%20Safety_e.pdf. 76 See https://www.nrcan.gc.ca/sites/www.nrcan.gc.ca/files/www/pdf/publications/emmc/14- 0177_Pipeline%20Safety_e.pdf.

56 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES tors to assess and control their risks on a continuing basis. The transmission pipeline industry representatives also said that a strict focus on complying with micro-level standards was too limiting and cited the industry’s “In- tegrity First” initiative as an example of an effort to exceed many of these detailed regulatory requirements. Both regulators and operators mentioned the need for appropriate knowledge and skill sets among agency and company personnel in estab- lishing and enforcing management-based regulations. The NEB official described a transitional requirement for instruction, training, and technical support for enforcement personnel to allow them to conduct management audits, as opposed to the customary inspection of equipment and practices using checklists. The official also noted the challenge of obtaining adequate resources for determining compliance with these macro-means regulations. It was reported that, on the basis of existing administrative resources, nearly a year is needed to audit a company’s management programs, and each audit requires significant support from agency technical personnel. Similarly, regulated companies had to obtain resources and special expertise to develop their management programs, including the capacity to determine key performance indicators and criteria for program audits. Both NEB and industry representatives emphasized the need for collaboration among regulators and industry to facilitate compliance with these macro-means regulations. The committee did not have an opportunity to meet with provincial regulators or with operators of intraprovincial pipelines, such as Canadian gas distribution systems. As a result, the challenges they face in implement- ing, enforcing, and complying with pipeline safety regulations were not documented. Evaluation Challenges The NEB official who briefed the committee noted that administering regu- lations with multiple approaches, such as micro-level technical standards and macro-level management requirements, can become complicated. In addition, the occurrence of major incidents tends to lead to public and political demands for more detailed requirements and prescription in the governing regulations. To assess the performance of its macro-means regu- lations, NEB has developed a set of pipeline performance measures through a consultation process with industry and the public and by drawing from information on program goals and performance measures reported annu- ally by operators. The committee was told that a few reporting cycles may be needed to identify trend information helpful for evaluating the effective- ness of the agency’s management program requirements.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 57 Observations on Pipeline Safety Regulation in the United States and Canada The federal, state, and provincial governments of the United States and Canada administer pipeline safety regulatory regimes that have much in common. Both countries depend to a substantial degree on their juris- dictional partners—states in the United States and provinces in Canada—to develop and enforce regulations that apply to their vast pipeline networks. Regulators in both countries oversee pipeline industries with substan- tial diversity. The pipeline systems vary widely in size and scope, age, technology vintage, design configurations, operating complexity, and envi- ronmental setting. The companies that own and operate the systems also differ significantly in size and sophistication; they range from multinational firms to local utilities. Nevertheless, the pipeline systems of the two coun- tries have many features and conditions in common simply because they carry many of the same commodities and operate in many of the same environments. Regulatory regimes in both the United States and Canada use a com- bination of highly targeted micro-level standards and more generalized macro-means requirements for management programs. Both countries’ regimes reference consensus standards for technical aspects of pipeline construction, operations, and maintenance. Where pipelines share certain features and conditions, these technical standards can have widespread applicability in addressing known risks with trusted means of control. Nevertheless, regulators in both countries indicate that pipeline systems and their operations are sufficiently varied and complex that the identification and reduction of all risk factors through the use of micro-level standards is impractical. They have established a number of macro-means regulations as a way to compel operators to account for the specific risks associated with their individual systems and operations.77 Both the U.S. and the Canadian regulators acknowledged that adoption of macro-means regulations has created enforcement and industry compli- ance challenges. Agency inspectors who had grown accustomed to enforcing detailed, technical standards have had to be retrained to oversee compliance with the less precise and less predictable requirements for management programs. Regulators from Canada’s provinces were not interviewed in this study, but state regulators in particular, who conduct three-quarters of U.S. pipeline inspections, have encountered difficulties in aligning inspector skill sets and competencies with the need to assess operators’ IM programs. The prevalence of small pipeline operators, particularly in the gas distribution 77 PHMSA’s main management-based regulation is its IM requirements. As noted in Chapter 1, footnote 3, the agency has also supported the development of an industry consen- sus guideline (API Recommended Practice 1173) on pipeline safety management systems, but unlike Canada it has not made the use of such management systems mandatory.

58 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES sector, has also led to challenges for industry compliance with macro-means requirements. Operators of smaller systems contend that they do not have the resources and technical capacity to understand, much less meet, some IM requirements. Federal and state regulators have had to work closely with these smaller operators in developing suitable means of compliance. Although macro-means regulations in the United States and Canada are often described as giving operators flexibility to choose implementation means, they are accompanied by substantial requirements and guidance on compliance. The U.S. regulations governing IM programs have become more detailed and prescriptive of program elements and content over time. That trend has been prompted in part by evidence, following major inci- dents, of some operator programs having serious deficiencies or not being properly carried out. Federal regulators have thus taken steps to assist operators in strengthening key elements of their IM programs, such as by promoting the use of more sophisticated risk modeling tools and encour- aging the sharing of best-practice information among operators. Canadian regulators have also supplemented their regulations with extensive guidance on how to comply with the many types of management programs that are required in federal and provincial regulation. Efforts to evaluate the effectiveness of a safety regulatory regime in reducing the occurrence of major pipeline failures are complicated by their rarity. Both U.S. and Canadian pipeline regulators are attempting to gather empirical data to evaluate their macro-means requirements such as IM. However, both have acknowledged that when major incidents do occur, the rationale for these regulations may be difficult to explain to legislators and the public, who may demand more detailed or extensive regulatory prescription as a result. OFFSHORE SAFETY REGULATION IN THE UNITED STATES AND THE NORTH SEA REGION The offshore oil and gas industries of the United States and North Sea coun- tries share many characteristics and are both regulated to prevent routine harms and rarer catastrophic events. The generic aspects of the industry’s structure, features, and operations are described next. The ensuing case studies indicate that the United States, the United Kingdom, and Norway have established regulatory regimes that share certain attributes of regula- tory design and implementation but also exhibit notable differences.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 59 Generic Structure, Features, and Operations of the Offshore Oil and Gas Sector Most offshore oil and gas development, whether in the United States, the North Sea, or other regions of the world, involves a typical series of indus- try activities: field evaluation and exploratory drilling; design, construction, and installation of the production system; drilling of additional production wells; hydrocarbon extraction and processing operations; and the eventual decommissioning and plugging of wells.78 The specific methods and tech- nologies used for each activity can differ among regions and among fields. This variability stems from many factors, which are often related to the location, size, and physical properties of the field and to the technologies available at the time of its development. Characteristics such as reservoir attributes, water depth, distance from shore, and marine and weather conditions combine with projected yield, profitability calculations, and hydrocarbon storage and transportation requirements to influence specific technology choices. Despite this heterogeneity, certain elements are common to each off- shore oil and gas activity. For example, exploratory drilling may be un- dertaken from several kinds of floating or bottom-supported rigs, with rig choice depending on site-specific factors such as water depth. However, the basic steps involved in drilling and completing a well are generic to most offshore fields. The drilling phase usually begins with the hammering of a tube, called a conductor, into the seafloor. A drill bit connected to drill pipe is then lowered into the conductor. As the borehole is excavated, drilling fluids, called “mud,” are pumped at high pressure down the drill pipe. The hydrostatic pressure from the mud keeps formation fluids from entering the borehole. At specific intervals, drilling is suspended while the borehole is lined with more tubes, called casings, and cement is pumped to seal the space between the outside of the casing and formation rock. Several casing strings may be added, one inside the other, until the reservoir is reached. After the first casing string is cemented, a large valve called a blowout pre- venter is installed at the casing head. Pressure in the mud column is moni- tored, and heavier fluids are pumped into the borehole during drilling to keep out formation fluids that could cause a blowout that risks explosions, fires, and discharges into the sea. When this drilling work is complete and the wells are properly lined, sealed, and temporarily plugged,79 the mobile 78 These activities occur after required government permits have been obtained and there are sufficient indications of the presence of oil and gas to warrant the expense of exploratory drilling. 79 A set of valves called a “Christmas tree” may be installed to control well pressure and flow in preparation for the production phase.

60 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES drilling unit moves to other sites while the production system is designed and installed. Production activities likewise involve many site-specific methods and technologies but also have many generic features. A production platform, or a man-made island with production equipment, is usually located above or near the well.80 A number of processes take place on the platform or on ancillary facilities, sometimes including the separation and processing of the oil and natural gas, treatment and disposal of extracted water and gases, and storage of the extracted product before it is exported by under- water pipeline or shuttle tanker. The specific design and configuration of the production installation depend on considerations such as water depth, marine and weather conditions, expected recovery volumes, distance from shore, and the need for oil and gas storage. Nevertheless, most production platforms have common features, such as gas compression, power genera- tion, and piping systems. Most larger platforms have rooms and catering facilities for crews, as well as maintenance shops, warehouses, and labo- ratories. Larger platforms have facilities to accommodate vessels such as anchor-handling tugs, diving support boats, and pipe-laying ships, along with helipads for the air transport of crews and supplies. Nearly all have systems for monitoring and controlling critical equipment such as heat exchangers, pumps, generators, and compressors, as well as sensor, alarm, and automatic shutdown systems. To protect workers, the facilities have firefighting and lifesaving equipment. All offshore projects face the challenge of ensuring the safety of opera- tions that take place in a physically constrained space; often in harsh envi- ronmental conditions; and with a constant risk from volatile hydrocarbon mixes being extracted, processed, and stored under high pressure. Advances in drilling, production, and safety technologies during the past half century have helped the industry meet this challenge. These advances have allowed the development of fields that are more remote, in deeper waters, and in harsher environments such as the Arctic. As the depth of wells and produc- tion volumes have increased, installations have tended to become larger, more complex, and more costly. The increasing cost and complexity of drilling and production have in turn led to more specialization among com- panies supplying the needed services and technologies and thereby added to organizational complexity and the need to coordinate decisions, diverse workforces, and communications. The entity having responsibility for managing and ensuring project safety is the leaseholder. Most governments award fixed-period leases for 80 Subsea production systems are also used. They are located on the seafloor and connected to a platform that may be several miles away. A single production platform can serve as the host for several subsea systems.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 61 the exploration and development of mineral resources under their waters. A single lease can have many owners with various percentages of work- ing interests. One holder is usually designated as the operating company. Operating companies are generally responsible for all of the activities on their leases but seldom carry out all activities by themselves. The operator usually contracts with a company to supply and operate the drilling rig. In turn, the drilling contractor usually hires specialized companies to provide supplies and services such as cementing, maintenance and repair of me- chanical equipment, diving, and helicopter transport. Although operating companies typically own their production platforms, they too hire contrac- tors to handle many of the key production processes and services. Unlike pipelines, which require relatively few workers for their control, maintenance, and operation, the offshore workforce is large and has a di- verse set of skill requirements in specialties ranging from crane and helicop- ter operations to diving, welding, and well engineering. At any given time an offshore facility can have more than 100 workers, including mechanics, electricians, derrickmen, medics, cleaners, painters, and cooks as well as workers in supervisory positions such as an installation manager, a captain, and a chief engineer. Many of these workers are likely to be employed by different companies. Public Safety Interest of Regulation Offshore oil and gas development, especially drilling, is labor intensive, involves hazardous materials, and takes place in environmentally sensi- tive areas. Offshore projects thus pose risks of explosions, fires, and toxic emissions that can kill and injure workers, contaminate ocean and coastal environments, harm wildlife and communities and businesses that depend on these natural resources, and damage oil and gas development and pro- duction facilities. Storms, structural failures, capsizing, and other mecha- nisms can cause serious incidents. The location of facilities miles offshore can create challenges for the evacuation and rescue of workers and for the control and containment of spills. Deepwater (generally considered to be >1,000 feet water depth) projects that require drilling through layers of unknown pressure zones create special risks. Ensuring the safety of projects has long been a public concern in coun- tries that permit offshore oil and gas development. The April 2010 loss of well control by the Deepwater Horizon drilling rig, which caused the death of 11 workers and the release of an estimated 5 million barrels (more than 200 million gallons) of oil, led to major changes in the U.S. regulatory regime as well as to reassessments of regimes worldwide. Earlier disasters, including the 1988 explosion of the Piper Alpha platform in the UK sector of the North Sea (killing 167) and the 1980 capsizing of the Alexander L.

62 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES Kielland rig in the Norwegian sector (killing 123), had prompted similar reevaluations and changes in offshore regulatory regimes abroad (Bennear 2015). Although disasters rightly attract the attention of policy makers and the public, offshore facilities are subject to a wide range of safety and envi- ronmental risks. Far more common than well blowouts and explosions are helicopter crashes, diving accidents, vessel collisions, crane lifting accidents, and equipment and operational failures that cause human casualties, prop- erty loss, and hydrocarbon releases. In the absence of consistent reporting of offshore incidents globally, assessment of the safety performance of the industry and its methods of regulation can be difficult. On an annual basis from 2009 to 2016, the United States averaged nearly 4 fatalities, 241 injuries, and 6 spills of 50 or more barrels of oil from offshore incidents, including the Deepwater Horizon disaster.81 Comparable incident reporting data are difficult to obtain for the multijurisdictional North Sea fields. The UK sector averaged about 0.7 deaths and 40 severe injuries per year from 2007 to 2015.82 However, these incident data do not include helicopter crashes, which are included in the U.S. data. Similarities and differences with regard to the offshore sectors of the United States and the North Sea region and to the design and enforcement of their safety regulatory regimes are discussed after presentation of the case studies below. Case 3: U.S. Offshore Oil and Gas Safety and Environmental Regulation The Department of the Interior (USDOI) is responsible for administering federal laws governing mineral exploration and development of the U.S. outer continental shelf (OCS), which is the region generally more than 3 miles from the coast. The main governing statute is the Outer Continental Shelf Lands Act of 1953. In 2010, USDOI assigned responsibility for ad- ministration of the law to two newly created agencies, the Bureau of Ocean Energy Management, which awards leases, and the Bureau of Safety and Environmental Enforcement (BSEE), which issues and enforces regulations intended to ensure safe and environmentally responsible exploration and production. These agencies were created from the Minerals Management Service (MMS), whose long-standing administration of both leases and 81 Bureau of Safety and Environmental Enforcement database as of September 30, 2016. 82 See http://www.hse.gov.uk/offshore/statistics/hsr2015.pdf.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 63 safety regulations was perceived after the Deepwater Horizon disaster to create a conflict of interest.83 BSEE’s regulatory regime is the focus of this case study. However, the U.S. Coast Guard (USCG) is responsible for regulating the safety of ves- sels, which include mobile drilling rigs and floating platforms. USCG’s regulations, for example, cover the seaworthiness and evacuation and fire protection capacity of these units. The two agencies have agreements on the division and coordination of inspection duties and other matters. This division and coordination, which are not examined here, can complicate ef- forts to make changes in offshore regulations and regulatory approaches.84 The Regulated Industry About 2,100 platforms (including man-made islands) operate on the U.S. OCS along with numerous platforms in state waters near the coastline.85 The installations vary in configuration from single-structure facilities to multiple-structure facilities connected by walkways. Most are in the Gulf of Mexico, which accounted for more than 95 percent of the 565 million barrels of oil and 1.4 trillion cubic feet of natural gas produced from the OCS in 2015.86 Most platforms (2,000 of the 2,100) operate in shallow waters of less than 1,000 feet. They are likely to be older and more lightly manned than the deepwater platforms. A few shallow-water platforms are more than 50 years old, and most are at least 20 years old. Deepwater platforms are usu- ally less than 20 years old. Many shallow-water platforms, which are often located less than 25 miles from shore, are manned only part of the day and thus not equipped with living quarters. Deepwater facilities are frequently more than 50 miles from shore. Thus, they are more likely to have person- nel on board 24 hours per day and to provide living quarters. Despite the much larger number of shallow-water platforms, the 50 or so deepwater installations account for most of country’s offshore oil and gas production. Their deeper wells are more productive but more compli- cated to drill. Accordingly, their designs and operations tend to be more 83 USDOI press release “Salazar, Bromwich Announce Next Steps in Overhaul of Offshore Energy Oversight and Management,” January 19, 2011. (https://www.doi.gov/news/press releases/Salazar-Bromwich-Announce-Next-Steps-In-Overhaul-of-Offshore-Energy-Oversight- and-Management). 84 Federal agencies other than BSEE and USCG having regulatory authority over aspects of offshore oil and gas operations include the Occupational Safety and Health Administration, the U.S. Environmental Protection Agency, the National Oceanic and Atmospheric Administra- tion, and PHMSA (for offshore pipelines). 85 See https://www.data.bsee.gov/homepg/data_center/leasing/WaterDepth/WaterDepth.asp. 86 See https://www.data.bsee.gov/homepg/data_center/production/ocsprod.asp.

64 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES complex, and the companies that own and operate them tend to be large, usually multinational oil and gas production companies. A 2011 study found that of the 132 firms operating production platforms in the Gulf of Mexico in 2010, 117 operated only in shallow waters, some specializing in low-yield, low-capital operations.87 Of the 15 firms that operated deepwa- ter platforms, 10 had a market capitalization of more than $10 billion, and 6 had a capitalization of more than $100 billion. These 10 firms accounted for about 30 percent of all active platforms in the Gulf of Mexico. According to BSEE’s 2016 Annual Report, about 60 mobile drilling rigs were operating in the Gulf of Mexico during 2016.88 Most of the con- tractors operating these rigs compete for business globally and own rigs of various design types. The high cost of owning and operating increasingly sophisticated rigs and the technological demands of designing, drilling, and completing wells in deep water have been factors in a trend toward industry consolidation. Industry statistics show that 10 companies accounted for about 75 percent of the rigs drilling wells in the Gulf of Mexico during 2015.89 The Regulator When it was created in 2011, BSEE inherited responsibility for the offshore safety program from MMS, which had earlier inherited the program from the U.S. Geological Survey. BSEE establishes the regulatory agenda, ad- ministers an enforcement and inspection program, investigates incidents, and oversees industry spill preparedness.90 To fulfill these functions, BSEE is funded in part by rent from OCS leases and fees charged for inspections and reviews of plans and permits. In fiscal year 2016, BSEE’s total budget was approximately $190 million, about one-third of which was funded by service fees.91 BSEE has about 850 employees, including approximately 120 inspec- tors and 130 engineers who review permit applications, facility plans, and company safety programs. Three-fourths of the inspection personnel are stationed in the Gulf of Mexico.92 In 2016, BSEE inspectors carried 87 See http://www.rff.org/files/sharepoint/Documents/oilspillcomission/RFF-DP-10-61.pdf. 88 See https://www.bsee.gov/sites/bsee.gov/files/bsee_2016_annual_report_v6b.pdf. 89 See http://www.offshore-mag.com/content/dam/offshore/print-articles/volume-76/02/ survey.pdf. 90 See https://www.bsee.gov/who-we-are/our-organization/national-programs. 91 See https://www.bsee.gov/sites/bsee.gov/files/budget-justifications//bsee-fy-2017-budget. pdf. 92 See https://www.bsee.gov/sites/bsee.gov/files/fact-sheet/fact-sheet/5-yr-dwh-fact-sheet- final.pdf.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 65 out more than 20,000 inspections of more than 2,000 facilities.93 Annual inspections are required for all production platforms. Mobile drilling rigs are inspected on a monthly basis when they are active. Inspectors use he- licopters stationed at BSEE district offices to travel to offshore facilities. After the Deepwater Horizon disaster, BSEE’s budget was doubled and the agency was authorized to hire more inspectors.94 In its fiscal year 2017 budget request BSEE reported that because of a significant pay gap between the federal government and private industry, the agency has had difficulty in recruiting and retaining qualified engineers and inspectors.95 Types of Regulation BSEE regulations pertain to all phases of offshore oil and gas develop- ment.96 Thus, major parts of the regulatory regime address drilling opera- tions (e.g., casing, cementing, and drilling fluid requirements, as well as special Arctic requirements), well completion (e.g., pressure management), well operations and equipment (e.g., rig and blowout preventer require- ments), production safety systems (e.g., emergency shutdown and firefight- ing systems), platforms and structures (e.g., design and construction), and safety and environmental management systems (SEMS). This regulatory regime has taken shape over the decades following passage of the Outer Continental Shelf Lands Act of 1953. Many existing regulations had their origins in consensus standards and recommended practices developed by API, engineering societies, and other private stan- dards development organizations. For example, when a blowout preventer system is installed, it must meet the requirements of API Standard 53 (Blowout Prevention Equipment Systems for Drilling Wells);97 all cranes must be operated in accordance with API Recommended Practice 2D (Op- eration and Maintenance of Offshore Cranes);98 and production platforms must conform to API Recommended Practice 2A (Planning, Designing, and Constructing Fixed Offshore Platforms).99 In recent years, BSEE has added regulations that have a more macro- level perspective, most notably the requirement for operators to establish a SEMS program. Some of these macro-level regulations also reference consensus standards, including API Recommended Practice 75 for the de- 93 See https://www.bsee.gov/sites/bsee.gov/files/bsee_2016_annual_report_v6b.pdf. 94 Budget of the United States Government, Fiscal Year 2012, p. 101. 95 See https://www.bsee.gov/sites/bsee.gov/files/budget-justifications//bsee-fy-2017-budget. pdf (p. 27). 96 30 CFR Part 250—Oil and Gas and Sulphur Operations in the Outer Continental Shelf. 97 §250.730. 98 §250.108. 99 §250.901.

66 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES velopment and implementation of SEMS programs.100 In total, BSEE’s regulations contain references to more than 100 consensus standards. Micro-Level (Prescriptive and Traditional Performance-Based) Regulations Most BSEE regulations can be characterized as micro-level, either means- or ends-based. Highly targeted means-based regulations are common. For ex- ample, a detailed table in the agency’s regulations prescribes cementing and setting requirements for well casings and liners.101 The regulation further specifies that a pressure test must be conducted below the surface casing and all intermediate casings.102 Many of the agency’s means-based regulations seek to standardize cer- tain facility features and equipage. For example, rules specify the kinds of safety devices, ventilation systems, and gas monitors that must be installed in fluid-handling areas.103 To protect workers from hydrogen sulfide expo- sure, the regulations are highly specific; among other things, they delineate where warning signs should be placed and how they should be designed—by using “a high-visibility yellow color with black lettering.”104 This specificity is intended to provide uniformity of warning devices across installations to ensure a high level of visibility and familiarity among workers. Other micro-level regulations are ends-based. A number of “general requirements” are presumably intended to address situations in which ap- plicable standards cannot be developed for all circumstances. An example is the requirement that all platforms and related structures be designed to ensure their structural integrity, with consideration given to “the specific environmental conditions at the platform location.”105 Ends-based regulations often state that a given practice or component must possess a certain capability. Welding, for example, must be done “in a manner that ensures resistance to sulfide stress cracking.”106 In its 2016 Well Control rule, BSEE states that an operator’s casing and cementing program must provide “adequate centralization” to ensure proper cemen- tation around the casing.107 The regulation implies that operators can use conventional bow-type centralizers as recommended in referenced industry consensus standards but does not specify or limit how centralization should be achieved. Thus, the use of other options brought about by advances 100 §250.1902(c). 101 §250.462(e). 102 §250.427. 103 §250.459. 104 §250.490. 105 §250.900. 106 §250.490. 107 81 Federal Register 25888, 25918 (April 29, 2016).

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 67 in technology and practice to ensure the outcome of centralization is not precluded. An interesting example of a micro-level regulation can be found in the statutory mandate that the Secretary of the Interior “shall require on all new drilling and production operations and, wherever practicable, on existing operations, the use of the best available and safest technologies which the Secretary determines to be economically feasible.”108 On its surface, this provision appears to be ends-based because it stipulates a re- quired attribute of offshore technologies—that is, they must be the “safest available.” However, the condition that the Secretary shall decide which technologies qualify under this standard indicates that the overall provision authorizes a means-based restriction on operators. Operators are bound to use technologies that have been deemed suitable by BSEE. In turn, BSEE is directed by the statute to use safety performance and economic feasibility as the criteria for making its determinations about the means that operators must use. To aid in its decision making, BSEE has established a process for identifying qualifying technologies (National Academy of Engineering and National Research Council 2013). To date, BSEE’s new process has not been implemented beyond identifying a small number of technologies that are candidates for further review.109 Macro-Level (Management and Liability) Regulations The fact that most offshore safety regulations are micro-level led to criticism after the 2010 Deepwater Horizon explosion. The National Commission on the BP Deep- water Horizon Oil Spill and Offshore Drilling characterized the regulatory regime as “consisting of hundreds of pages of technical requirements that could not adequately address the risks generated by the offshore industry’s new technologies and exploration and production activities.”110 A National Academy of Sciences study questioned whether the technical regulations were capable of keeping up with the rapid advances that had enabled a large increase in deepwater drilling in the Gulf of Mexico (National Acad- emy of Engineering and National Research Council 2012). Most of BSEE’s regulations were issued long before the Deepwater Horizon explosion, but several rulemakings since 2010 are described by the agency as being less “prescriptive” and more “performance-based” (BSEE 2015). The most prominent example is the rule requiring operators to implement and maintain a SEMS program.111 BSEE’s SEMS regulation 108 The mandate is contained in amendments to the Outer Continental Shelf Lands Act. 109 See https://www.bsee.gov/what-we-do/offshore-regulatory-programs/emerging-technologies/ BAST. 110 See https://www.gpo.gov/fdsys/pkg/GPO-OILCOMMISSION/pdf/GPO-OILCOMMISSION. pdf. 111 30 CFR Part 250, Subpart S.

68 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES is more accurately described as means-based rather than performance- based, because it requires operators to set program goals and undertake other management-related actions. It does not mandate specific safety or risk-reduction outcomes. Instead, it sets forth a list of elements of a com- pliant program. For example, to be compliant, a program must include a formal hazards analysis of facilities and activities, written management-of- change procedures, written operating procedures that provide instructions for conducting safe activities, a program for training personnel to perform their duties safely, and procedures for investigating incidents. The rule re- quires operators to have their programs audited for compliance with these elements by an accredited third-party agent. Under agreement with BSEE, API’s Center for Offshore Safety is responsible for the development of good practice documents for SEMS programs and for accrediting and ensuring that third-party auditors meet the program’s goals and objectives.112 By requiring management systems, the SEMS regulation has created implementation challenges for BSEE, especially with regard to enforce- ment. It has also presented compliance challenges for an offshore industry long accustomed to a regulatory regime consisting mostly of micro-level, technical requirements. Finally, when they are viewed in isolation, some of the regulations in BSEE’s offshore program have a macro-ends design. An example is the re- quirement that drilling operations be conducted in a safe manner to protect against harm or damage to life, property, and natural resources. However, these regulations are often followed by numerous means-based require- ments that provide little or no discretion to the regulated entity. Perhaps the most significant form of macro-ends regulation, not formally part of BSEE’s program, is the strict liability and penalty regime created by OPA 1990 and referenced earlier with regard to pipelines. Implementation, Compliance, and Enforcement Challenges While BSEE has relied increasingly on regulations that require management programs to fill gaps in its regulatory content and coverage, the regulatory regime within which offshore oil and gas development takes place remains one that is oriented toward micro-level, technical regulations. Keeping these regulations current and compatible with advances in practice and technol- ogy is a continuing challenge, especially as more advanced drilling and production systems allow for the development of deepwater fields. Because the regulations incorporate many consensus standards by reference, BSEE staff must have subject matter experts who can participate on API standards committees addressing offshore matters. 112 See http://www.centerforoffshoresafety.org.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 69 BSEE’s investigation and enforcement group is larger than the one that existed in MMS. Its enforcement efforts usually begin with a review of permit applications. For example, a drilling application will be reviewed to ensure that cementing and drilling fluid programs are designed to conform to applicable requirements.113 Most enforcement resources go to the inspec- tion of existing facilities to check compliance with the agency’s many de- tailed regulations. Inspections usually consist of a facility visit, announced or unannounced, in which the inspection team follows a set of guidelines from the National Office Potential Incident of Noncompliance (PINC) List. One or more inspectors approach the platform by helicopter and view the surroundings for signs of leaked oil and vent gas.114 On landing, the inspector conducts a walk around to check on the general condition of the platform, test safety devices with the operator, and review paperwork in accordance with PINC list guidelines. As reported earlier, there are thousands of installations in the Gulf of Mexico alone. Because BSEE inspectors must visit so many facilities annually, the inspections usually last only a few hours. Inspectors issue a citation on detecting a violation, either a warning to take corrective action in a given amount of time or a notice requiring action before an activity can resume. In 2016, more than 2,100 facilities (rigs, platforms, pipelines, or onshore meters) were inspected by BSEE. The inspections led to nearly 2,400 notices of noncompliance, about one-third of which were warning notices.115 BSEE officials who briefed the committee reported that the agency has been piloting a risk-based inspection program.116 Under the program, poorly performing facilities (e.g., many reportable incidents or notices of noncompliance) or those with distinguishing risk characteristics (e.g., size of facility, production of hydrogen sulfide) would be identified and subjected to more frequent and intensive inspections, which would im- prove deployment of resources.117 Progress with program implementation was not reported. Additional enforcement efficiencies are anticipated from technological developments. For example, advances in the remote monitor- ing of blowout prevention systems and other safety- and environmental- 113 A deepwater production project can take a decade or more to come online. Accordingly, BSEE evaluates information provided by operators in project applications many years in ad- vance of the commencement of production activities. 114 See http://www.rff.org/files/sharepoint/WorkImages/Download/RFF-DP-13-36-REV2. pdf. 115 See https://www.data.bsee.gov/homepg/data_center/company/incs/incs.asp. 116 See https://www.bsee.gov/newsroom/latest-news/statements-and-releases/press-releases/ bureau-of-safety-and-environmental. 117 See http://onlinepubs.trb.org/onlinepubs/pbr/Dwarnick101716.pdf.

70 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES critical equipment are expected to reduce the need for BSEE inspectors to visit facilities when critical systems are being tested.118 BSEE officials explained to the committee that assessing operator com- pliance with the many required elements of a SEMS program is more challenging than assessing compliance with micro-level, technical regu- lations. Enforcing the latter regulations requires familiarity with BSEE’s many detailed standards; enforcing the former requires an assessment of an operator’s compliance with more subjective requirements such as whether appropriate methods are in place to identify and control all significant hazards. Such assessments require enforcement officers to have a strong understanding of offshore operations and their associated risks, a compe- tency that has not been required of the many inspectors conducting PINC checklist reviews. BSEE officials identified several issues related to operator compliance with SEMS requirements. The agency found that its original requirement for self-auditing of SEMS programs was insufficient for ensuring compli- ance. Operators reportedly exhibited more interest in program documenta- tion than in application, as evidenced by a tendency to adopt standardized SEMS programs as opposed to “fit for purpose” ones.119 To address this problem, BSEE replaced the provision for self-audits with a requirement for third-party audits.120 The agency has been working with the offshore industry through API’s Center for Offshore Safety (COS) to improve the ability of third-party auditors to detect weaknesses in SEMS programs and to help operators eliminate them. Because it lacks the capability to accredit third-party auditors, BSEE delegated accreditation responsibility to COS. In a related initiative, BSEE has emphasized the elevation by opera- tors of safety assurance to a core organizational value, as expressed in the agency’s 2013 safety culture policy statement.121 The complexity of offshore operations, including reliance on many contractors, is viewed as a complicating factor in the development of a consistent organizational commitment to safe practices.122 SEMS programs are intended to be a cor- nerstone in the effort to strengthen the offshore industry’s safety culture.123 The committee was interested in learning how the offshore workforce views BSEE’s regulatory approach, including the agency’s reliance on micro- level regulation and its promotion of the macro-means approach of SEMS. 118 As more production is handled by subsea systems, the use of remote sensing technologies will be essential. See TRB 2016. 119 See http://onlinepubs.trb.org/onlinepubs/pbr/Dwarnick101716.pdf. 120 §250.1920. 121 See https://www.bsee.gov/site-page/safety-culture-policy. 122 See http://www.trb.org/Main/Blurbs/174395.aspx. 123 See https://www.bsee.gov/sites/bsee.gov/files/congressional-testimony/regulations-and- guidance/bsee-salerno-testimony-final.pdf.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 71 The size and fragmentation of the U.S. offshore workforce and the lack of labor union representatives to consult about the views of at least some workers proved problematic for eliciting worker perspectives. A labor union official from the petrochemical sector reported that an advantage of detailed, micro-level regulations is that they can be transparent and under- standable to workers. On the basis of his experience with refinery process management programs, he questioned whether the efforts of offshore op- erators to establish SEMS programs have had the level of participation from workers needed to ensure that the programs are effective. Evaluation Challenges MMS first proposed requiring all operators to establish SEMS programs to address safety issues that the agency believed were not being addressed by the regulatory regime’s many detailed regulatory requirements.124 On the basis of incident investigations and evaluations of inspection records, MMS concluded that the latter regulations were not effective in ensuring good communications among operators and contractors, the systematic analysis of job hazards, the development of safe work procedural guidelines, or the rigorous maintenance of facilities and equipment. The first SEMS regula- tion to address these regulatory shortcomings, also known as the workplace safety rule, was eventually promulgated by BSEE, but not until 6 months after the April 2010 Deepwater Horizon explosion. The many years required for promulgation of the SEMS rule illustrates the challenge offshore regulators face in ascertaining the effectiveness of their regulations in bringing about change. Because catastrophic incidents are rare, regulatory effectiveness can be difficult to assess quantitatively (Bennear 2015). MMS concluded that its traditional regulatory regime was inadequate by analyzing incident panel investigation reports, incident reports, and incidents of noncompliance inspections; however, connections between such evidence and major incident risk proved difficult to establish. That such risks are lowered by requiring operators to undertake job hazards analyses, establish procedures to improve communications among opera- tors and contractors, establish work procedural guidelines, and introduce other required elements of a SEMS program can be even more difficult to support empirically. To aid with such evaluations and inform the development of SEMS programs, BSEE has emphasized the collection and analysis of data from incident records, near-miss reporting, and real-time monitoring. For ex- ample, it has enlisted the U.S. Department of Transportation’s Bureau of Transportation Statistics to develop and manage a voluntary and confiden- 124 See https://www.gpo.gov/fdsys/pkg/FR-2006-05-22/pdf/E6-7790.pdf.

72 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES tial near-miss reporting system, called Safe OCS.125 The intention is for information obtained from the Safe OCS database to be shared with BSEE, industry, and the public to help identify incipient safety issues.126 The offshore safety regulatory regimes in the United Kingdom and Norway are reviewed in the next section. After that review, several obser- vations concerning the design of the various offshore regulatory regimes are offered. Case 4: North Sea Offshore Oil and Gas Safety Regulation More than 90 percent of the oil and 60 percent of the natural gas produced in Western Europe is from offshore fields.127 Nearly all of the production is in the North Sea and adjacent waters of the Barents and Norwegian Seas and west of the Shetlands (see Figure 3-2). Denmark and the Netherlands, as well as the United Kingdom and Norway, have territorial waters in the North Sea. This case study con- tains information on the offshore safety regulatory regimes of the United Kingdom and Norway, which account for most of the region’s oil and gas production.128 The Regulated Industry Offshore operations in Norway produce about 600 million barrels of oil and 115 billion cubic meters of natural gas per year.129 This output is com- parable with that from the Gulf of Mexico. The second-largest North Sea producer, the United Kingdom, extracts about 350 million barrels of oil and 40 billion cubic meters of natural gas per year.130 Total North Sea oil and gas output is higher than the output from the Gulf of Mexico but far below the North Sea’s peak production periods during the 1990s and early 2000s. The number of offshore units in the North Sea is difficult to estimate because of different treatments of platform complexes, unmanned facilities, and inactive units in national statistics. Nevertheless, data suggest that the 125 See https://near-miss.bts.gov. 126 See https://www.bsee.gov/sites/bsee.gov/files/congressional-testimony/regulations-and- guidance/bsee-salerno-testimony-final.pdf. 127 See http://ec.europa.eu/eurostat/statistics-explained/index.php/File:Energy_production,_2004_ and_2014_(million_tonnes_of_oil_equivalent)_YB16.png. 128 Most references in this chapter to North Sea production levels, fields, and installations include activity and installations in adjacent waters such as the Barents, Norwegian, and Irish Seas as well as the Atlantic Ocean west of the Shetlands. 129 See https://www.eia.gov/beta/international/analysis_includes/countries_long/Norway/ norway.pdf. 130 See https://www.eia.gov/beta/international/analysis.cfm?iso=GBR.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 73 United Kingdom has about 260 manned and unmanned operational instal- lations and that Norway has about 100.131 Thus, in total the region has fewer than half the number of units in the Gulf of Mexico, where there are more low-yield installations.132 Most North Sea production platforms operate in water not deeper than 300 feet. They include massive structures (which may be freestanding or anchored in place) capable of accommodat- ing hundreds of workers, with some of the largest located in the central and northern waters. Platforms in the southern waters produce mostly gas and are generally smaller, with some used for holding oil and gas for trans- 131 See https://www.ogauthority.co.uk/data-centre/data-downloads-and-publications/infrastructure; http://www.npd.no/en/Publications/Reports/Unmanned-wellhead-platforms/Location-of-platforms. 132 See http://www.npd.no/en/Publications/Reports/Unmanned-wellhead-platforms/ Location-of-platforms. FIGURE 3-2 Oil and gas fields in the North Sea and nearby waters. NOTE: Norway has additional fields in the Norwegian and Barents Seas that are not shown. SOURCE: http://www.crystolenergy.com/assessing-future-north-sea-oil-gas.

74 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES shipment. Although many of the North Sea’s largest fields are located at shallow depths, newer discoveries have been made farther from shore in deeper waters.133 Harsh weather and marine conditions in the North Sea can compli- cate drilling and support activities such as helicopter transport. Project complexities and capital requirements have also increased as more fields have been developed in deeper, high-pressure zones. Because of the invest- ment and technology demands of North Sea production, global oil and gas companies account for most of the region’s development activity. Some of the region’s major producers have large government ownership stakes, such as Norway’s Statoil and Denmark’s DONG. As in the United States, most drilling activity is contracted to international companies. About 60 percent of the region’s drilling rigs are owned by 10 large companies.134 Because of declining oil and gas prices worldwide, the number of active drilling rigs in the region has reportedly declined by more than half during the past decade.135 The offshore workforce in the United Kingdom and Norway fluctuates in response to production activity, which depends on world oil and gas prices. According to industry estimates, during 2016 about 34,000 people were directly employed by UK oil and gas producers and businesses provid- ing support services.136 The Norwegian government estimates that about 50,000 people were directly employed in its oil and gas industry during 2016.137 The Regulators In Norway, offshore safety oversight is the responsibility of the Petroleum Safety Authority (PSA). PSA oversees the activity of about 60 mobile drill- ing units and 80 production platforms.138 The agency has a 170-member staff with expertise in areas such as drilling and well technology, process safety management, structural integrity, emergency preparedness, and oc- cupational health and safety.139 In the United Kingdom, responsibility for 133 Most notable is the 2010 discovery of the Johan Sverdrup oil field located about 90 miles off the shore of Norway. The field is estimated to contain more than 2 billion barrels of oil. 134 See http://www.offshore-mag.com/content/dam/offshore/print-articles/volume-76/02/ survey.pdf. 135 See http://www.worldoil.com/news/2016/10/7/north-sea-drilling-activity-plunges-to-all- time-low. 136 See researchbriefings.files.parliament.uk/documents/CBP-7268/CBP-7268.pdf. The Health and Safety Executive estimates a population of 32,077 offshore full-time equivalent workers in 2015 (http://www.hse.gov.uk/offshore/statistics/hsr2015.pdf). 137 See http://www.norskpetroleum.no/en/economy/employment/#direct-employment. 138 See http://www.ptil.no/map-of-our-area-of-responsibility/category994.html. 139 See http://www.psa.no/employees-at-the-psa/category988.html.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 75 offshore safety regulation lies with the Health and Safety Executive (HSE), which oversees about 20 mobile units and 300 production facilities.140 Its offshore division employs about 125 people. Like those of PSA, HSE man- agers and inspectors have a range of professional expertise, including well engineering, electrical control, diving operations, emergency preparedness, and human and organizational factors. Types of Regulations The offshore safety regulatory regimes of the North Sea region have their origins in reforms introduced in response to major incidents, when inves- tigations led authorities to question the effectiveness of their traditional regulations. After the 1988 Piper Alpha disaster, the Cullen Report rec- ommended that the United Kingdom’s micro-level regulatory regime be replaced by a “goal-setting” regime patterned after the approach used in Norway (Cullen 1990). Parliament responded by assigning HSE responsi- bility for administering regulations that would require offshore operators to develop a “safety case” for each installation. Norway had earlier estab- lished its goal-setting regime in the aftermath of the 1980 Alexander L. Kielland disaster, and in the intervening years other North Sea countries, including Denmark and the Netherlands, had introduced similar regimes.141 Although they are called goal-setting regimes and are sometimes char- acterized as “performance-based,” the UK and Norwegian offshore regu- lations have a macro-means design. They require the operator, or “duty holder,” to establish a number of safety assurance processes and programs intended to reduce catastrophic risk; however, the regulations do not man- date outcomes, such as a demonstrable reduction in incidents or some other end state believed to be indicative of risk reduction. Instead, the regulations require that operators undertake rigorous risk analysis and management planning and act in accordance with the plans. An operator is considered to be in compliance if the quality and execution of the required risk analysis and management plans are substantiated. The occurrence of an incident or series of incidents would not violate the regulation per se but could lead the regulator to investigate whether the operator violated the regulation’s means-based requirement for a rigorous risk management program. Liability for the incident under a macro-ends regulation, such as a general duty provision, could also apply, if the jurisdiction has such a separate obligation. The use of these macro-level regulations does not imply that the United 140 See http://www.hse.gov.uk/offshore/statistics/hsr2015.pdf. 141 In addition to regulating installations, UK and Norwegian regulators assess each opera- tor’s competency and safety performance before granting offshore leases and permits.

76 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES Kingdom or Norway abandoned micro-level regulations. Both regimes have retained many highly targeted safety regulations such as requirements specifying the minimum number of evacuation paths on a platform or the maximum duration of a work shift. Furthermore, as discussed next, opera- tors are advised and in some cases directed to use consensus standards that are mostly micro-level in their design. Micro-Level (Prescriptive and Performance-Based) Regulations The UK regulatory regime consists of three sets of regulations in addition to the safety case regulations142: (a) Prevention of Fire and Explosion, and Emer- gency Response (PFEER);143 (b) Management and Administration;144 and (c) Well Design and Construction.145 These regulations and their accom- panying guidance contain many micro-level requirements. For example, a PFEER regulation states simply that an operator must have physical plant on the installation for the provision of safe evacuation.146 However, guide- lines on methods of compliance are more prescriptive. HSE’s Approved Code of Practice states that “[a]lternative means of evacuation should be provided to take account of scenarios where the normal means of getting people to and from the installation could not operate. . . . In most cases, al- ternative means would be means of evacuation by sea provided by TEMPSC [totally enclosed motor-propelled survival craft]. In these circumstances, there should be sufficient TEMPSC places for 150% of the people on board, unless an alternative standard is justified.”147 An operator following the HSE guidance on the means of compliance (use of totally enclosed motor- propelled survival craft that can accommodate 150 percent of people on board) is considered to be in observance of the PFEER regulation. The UK’s Well Design and Construction regulations offer another ex- ample of how micro-level standards are used. The regulations simply state that operators must ensure that suitable well control equipment is provided to protect against blowouts.148 However, HSE offers more detailed com- pliance guidance in A Guide to the Well Aspects of the Offshore Installa- tions and Wells Regulations.149 Documents outline the “particulars to be included” in a well control system. Among them are a listing of the equip- 142 Offshore Installations (Offshore Safety Directive) (Safety Case, etc.) Regulations. 143 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations. 144 Offshore Installations and Pipeline Works (Management and Administration) Regulations. 145 Offshore Installations and Wells (Design and Construction, etc.) Regulations. 146 PFEER Regulation 15. 147 See http://www.hse.gov.uk/pUbns/priced/l65.pdf (p. 39). 148 See http://www.legislation.gov.uk/uksi/1996/913/regulation/17/made. 149 See http://www.hse.gov.uk/pubns/priced/l84.pdf.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 77 ment, drilling fluids, and cement to be used.150 Conformance with appli- cable consensus standards, such as API Standard 53 on Blowout Prevention Equipment Systems for Drilling Wells, is an example of a listed “particular” that would facilitate HSE acceptance of a safety case. Norway’s offshore safety regulations, which are established by legisla- tion, also contain some requirements that are highly detailed and target- ed.151 PSA officials gave the following example of a regulation: “Facilities equipped or connected to a processing plant shall have a gas release sys- tem. The system shall prevent escalation of situations of hazard or ac- cident by rapid escalation of the pressure in equipment, and it shall be designed so that release of gas does not entail major harm to personnel and equipment.”152 The regulation was characterized by PSA officials as presenting a goal that operators must meet but with their choice of means. However, the officials pointed out that PSA guidelines—called “non-legal supplements”—provide operators with more details on how to comply with this regulation [i.e., by following consensus standards NORSOK S-001 and ISO 13702 (Control and Mitigation of Fires and Explosions on Offshore Production Installations—Requirements and Guidelines)].153 Macro-Level (Management-Based and Liability) Regulations In the belief that offshore operators should assume full responsibility for safety assur- ance, UK and Norwegian regulators demand that firms follow systematic risk management procedures, the essential elements of which are defined in regulation. Duty holders must establish and follow a set of management plans and practices that the regulator confirms will allow them to identify, assess, and manage their operations- and facility-specific risks. As discussed next, operators are required to demonstrate compliance with these require- ments for risk management programs in a document called a “safety case” in the United Kingdom and an application for an acknowledgment of com- pliance (AOC) certificate in Norway. UK’s Safety Case The safety case document is the cornerstone of the United Kingdom’s offshore regulatory regime.154 It is intended to be a compre- hensive document explaining how the duty holder intends to comply with all regulations and applicable statutes. The purpose is to give “confidence 150 See http://www.hse.gov.uk/pubns/priced/l154.pdf. 151 See http://www.psa.no/framework-hse/category403.html. 152 Section 35 Gas Release Systems (http://www.psa.no/facilities/category400.html#_ Toc438215597). 153 See http://www.psa.no/facilities/category405.html%20-%20p35. 154 Offshore Installations (Offshore Safety Directive) (Safety Case, etc.) Regulations. The European Offshore Safety Directive was a driver for an update of the Safety Case Regulation in 2015. It was intended to standardize regulatory approaches across the European Union.

78 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES to operators, owners, workers, and the competent authority that the duty holder has the ability and means to manage and control major accident haz- ards effectively.”155 In a safety case tailored for each offshore installation, the duty holder must demonstrate to the satisfaction of HSE that sound and systematic methods have been used to identify, evaluate, and select suitable measures to control all risks that can lead to major incidents. What quali- fies as an acceptable degree of risk management is not defined in the safety case regulations; the duty holder is expected to make such determinations consistent with all applicable regulations and statutory provisions. In ac- cordance with standard language in UK safety law and regulation gener- ally, not only the offshore domain, risks should be reduced to “as low as reasonably practicable” (ALARP). According to the UK regulations, each safety case must contain certain elements. For example, the document should explain the duty holder’s SEMS program, the minimum contents of which are delineated in regula- tion. A compliant SEMS program description should include an overview of the command and control structure of the company, how the management and control of major hazards will be implemented through the organiza- tion, and the scheme for verifying that safety- and environmental-critical elements have been identified and controls established. The safety case document must contain a summary of worker involvement in the prepara- tion of the safety case and explain the arrangements that have been made to enable ongoing dialogue and cooperation among managers and worker representatives. The law requires duty holders to consult worker safety representatives in the preparation of a safety case. The regulations do not require a specific format for the safety case document. However, HSE recommends a self-contained document that presents the main arguments clearly and includes the supporting details, or “particulars,” to lend conviction to the arguments made.156 The recom- mended structure is similar to the one shown in Figure 3-3. An executive summary and introduction to the main features of the safety case are fol- lowed by factual information about the installation and its environment and activities, the company’s SEMS program, the hazards and risk assess- ment demonstrations, and an explanation of how the installation complies with specific PFEER regulations. The safety case regulations state that the regulator, HSE, should work with operators to ensure that safety case submissions are acceptable. To do so, HSE has developed the aforementioned schedules of particulars that should be included in a safety case to strengthen it. The agency also provides a suite of guidance documents, including guidelines on the applica- 155 See http://www.hse.gov.uk/pUbns/priced/l154.pdf (p. 6). 156 See http://www.hse.gov.uk/pUbns/priced/l154.pdf.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 79 tion of the ALARP principle.157 HSE-approved safety cases are not publicly available (and therefore could not be reviewed by the study committee), but government and industry representatives who briefed the committee esti- mated that most documents are several hundred pages long, largely because of technical appendices that provide justifications and elaborations with regard to risk identification, assessment, and management methods used.158 The representatives also reported that certain sections in a safety case docu- ment will be uniform across an operator’s safety cases. A reason for this uniformity is that some safety case elements, such as the description of a company’s SEMS program, will be the same for all installations. Many of the referenced risk assessment methods and risk control measures will also be uniform because they are based on protocols in consensus standards. Each installation must have an accepted safety case that is revised as necessary to remain current throughout its life. The duty holder must con- duct a thorough review of its safety case every 5 years or when significant events occur, such as changes in ownership. Proposed changes must be submitted to HSE. Although HSE does not require that offshore workers participate in all key decisions in a safety case, they must be consulted during the revision, review, or preparation of safety cases. The regulation’s workforce guidance states that duty holders are not obliged to accept any proposals made dur- ing this consultation, but they must consider them properly.159 157 See http://www.hse.gov.uk/offshore/is2-2006.pdf. 158 The study committee was able to obtain a safety case document for a decommissioned drilling rig that had been prepared for another North Sea country. That document contained many of the same elements required by HSE for safety cases. 159 Offshore Installations (Offshore Safety Directive) (Safety Case, etc.) Regulations 2015, Guidance on Regulations, p. 10 (http://www.hse.gov.uk/pUbns/priced/l154.pdf). 3-3 4-1 FIGURE 3-3 Safety case document format. SOURCE: C. Hawkes, International Association of Oil and Gas Producers.

80 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES Norway’s AOC Certificate In Norway, the offshore operator is responsible for ensuring that its activities and those of subordinate parties are in com- pliance with government safety regulations. A key feature of the regime is a requirement that operators demonstrate compliance by applying for an AOC certificate before commencing an activity such as exploration drilling, production drilling, a change in facility ownership, or modification of a facility.160 Box 3-2 shows the items to be included in an AOC application. The items are similar to those required in a UK safety case. For example, in addition to providing details describing the facility, the application must document the company’s SEMS, all analyses carried out to assess hazards and identify major incident risks, all control measures used, and the analy- ses that guided emergency preparations. The application must affirm that offshore workers have participated in all key decisions. PSA has established guidelines on the format and content of the application that are similar to the guidelines developed by HSE for safety cases.161 PSA’s level of scrutiny in reviewing the AOC application depends on factors such as the agency’s experience with the operator and its contrac- tors, previous knowledge of the facility, and the presence of any special conditions (e.g., an environmentally sensitive location).162 PSA reviews the application’s compliance with all relevant regulations. As discussed above, most of the regulations are presented as goals or principles; how- ever, they are usually accompanied by PSA interpretations and guidelines. The PSA guidelines, for example, state that NORSOK Z-013 and ISO 31000 (Risk Management Principles and Guidelines) should be used to meet the requirements for risk and emergency preparedness analyses and that Norwegian Oil and Gas Guideline 070 should be used as a basis for establishing performance requirements for safety barriers.163 PSA refers to its approval of an AOC as “consent.” A grant of consent indicates that the agency has confidence that the operator can execute the planned activity within regulatory parameters and in accordance with the promises provided in the application.164 Implementation, Compliance, and Enforcement Challenges According to the UK and Norwegian regulators, industry representatives, and a labor union official who briefed the committee, implementation of the North Sea region’s goal-based regulatory regimes is made possible by trust- 160 See http://www.psa.no/consents/category890.html. 161 See http://www.psa.no/getfile.php/136181/Regelverket/SUT-veiledningen_e.pdf. 162 See http://www.psa.no/dealing-with-consent-applications/category950.html. 163 See http://www.ptil.no/framework-hse/category403.html#_Toc438218436. 164 See http://www.psa.no/about-consents/category949.html.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 81 ing and collaborative relations among all three parties. In both countries, offshore operators are required to consult worker safety representatives concerning the preparation, review, and revision of their safety cases and AOC applications. In turn, HSE and PSA officials assist industry by devel- oping guidelines for preparing safety cases and AOC applications and by collaborating in the development of tools for risk-related decision making. Certain relationships that were cited by UK and Norwegian officials resemble those found in some U.S. sectors, where representatives from industry and nongovernmental organizations serve on agency-sponsored regulatory advisory committees. However, important differences in the nature of the collaborative relationships surfaced in the committee’s dis- Box 3-2 Contents for an Application for AOC Certificate All applications for consent shall contain (a) Information on which activities the applicant wants to carry out; (b) A description of the activities covered by the application, and the progress plan for these activities; (c) An overview of governing documents for the activities covered by the application; (d) A description of the management systems for the activities covered by the application; (e) An overview of exemptions granted according to the health, safety, and en- vironmental legislation and an assessment of these in view of the activities consent is applied for; (f) Information on whether agreements have been entered into with contractors, and possibly which enterprise is considered the principal undertaking in con- nection with these agreements; (g) A description of the analyses and assessments that have been carried out in regards to health, safety, and the environment for the activities and offshore or onshore facilities covered by the application, and the results and measures that will be implemented as a result of these assessments; (h) A description of the results from internal and external follow-up; (i) General drawings of the offshore or onshore facility; (j) A statement regarding the application from the employees’ elected representatives; (k) A summary of the results from the environmental risk and emergency pre- paredness analyses, as a description of how the planned emergency pre- paredness against acute pollution will be safeguarded in the areas where the results are also of significance to health, safety, and working environment; and (l) An overview of which other permits for activities have been applied for. SOURCE: P. Bang, Norway Petroleum Safety Authority.

82 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES cussions with government, industry, and labor representatives from the North Sea region. For example, the UK safety case regulations require HSE officials to do more than review document submissions for strict regula- tory compliance. The agency is directed by law to work with operators to improve their safety cases as necessary. HSE officials may challenge specific decisions in a safety case document, but typically they do this by asking for more details and justifications. The committee was told that the two parties—regulator and operator—typically engage in a dialogue in which they identify opportunities to build a stronger safety case. Once a safety case is approved or an AOC certificate is granted, the operator must implement the arrangements promised in the document. Failure to do so is considered a breach of regulation. Regulators may have confidential meetings with duty holders to discuss implementation. Op- erators are expected to monitor compliance though internal or third-party verifications. HSE’s inspectors may visit the installation to seek evidence of compliance. Typically, the operator is notified in advance of these inspec- tions. They may last 2 or 3 days and are conducted by teams of specialists following a series of inspection guides (e.g., on well control, maintenance, and evacuation and rescue).165 HSE officials stated that an important pur- pose of the inspections is to identify opportunities for the duty holder to strengthen compliance where it is deficient or weak. If the inspection team finds a problem that does not pose a safety threat requiring immediate intervention, the team will work with the duty holder as it tries to solve the problem. Inspected installations are rated by HSE as being fully compliant, broadly compliant, or poor or very poor in compliance.166 Duty holders with poor performance ratings are inspected more frequently and in greater depth than duty holders with stronger compliance ratings. In 2015, HSE conducted 135 planned inspections on 104 offshore installations involving 47 duty holders.167 The inspections, as well as 92 investigations, found more than 750 noncompliance issues, but enforcement notices were issued in only 35 instances because other mechanisms were used to resolve the issues. In describing its enforcement program, PSA officials were reluctant to use the term “inspection.” They referred to their reviews of operator docu- ments and periodic announced visits to installations as “supervisions” or “follow-ups” intended to obtain “insights” into an operator’s implemen- tation. PSA officials explained how the agency stations multidisciplinary teams at the onshore facilities of operators, who are required to set up 165 See http://www.hse.gov.uk/offshore/inspection.htm. 166 See http://www.hse.gov.uk/offshore/statistics/topic-performance-scores-2015.pdf. 167 See http://www.hse.gov.uk/offshore/statistics/hsr2015.pdf.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 83 onshore control rooms that replicate those of the offshore installations. The PSA teams integrate with operator personnel and meet with them on a regular basis. The integrated teams help validate the execution of the activities and processes that were promised by the operator as part of the AOC, and PSA team members contribute their engineering skills and pro- cess knowledge to inform safe practice. The UK and Norwegian regulators emphasized that these review and collaboration functions require a highly skilled technical staff. To review about 100 safety cases per year,168 HSE’s offshore division has a team of specialists covering a range of expertise, from well engineering and me- chanical systems to diving and emergency planning. HSE bills the operator for time spent reviewing safety cases, inspecting facilities, and engaging in other consultations.169 A former PSA official familiar with the agency’s transition from micro-level to macro-means regulations reported that the agency also had to retrain personnel and hire many technical experts to fulfill the new review and collaboration functions. As noted above, worker involvement in the development of safety cases and AOCs is required, and operators must have ongoing mechanisms to consult workers on safety matters. The labor union officials who briefed the committee reported that these “tripartite” relations among industry, operators, and workers have been important in overcoming initial skepti- cism among workers about the new regimes. The officials explained that the introduction of macro-means regulations was initially met with concern by workers accustomed to clearly defined requirements in rules. They worried that operators would set risk management priorities and devise manage- ment plans that workers would not be able to evaluate. To build worker trust, PSA has created an ongoing safety forum where government, industry, and labor representatives discuss and follow up safety, emergency prepared- ness, and working condition issues.170 The collaboration and trusting relationships that underpin the North Sea tripartite regimes are not immune to scrutiny. An industry representa- tive from a North Sea country with a regime modeled after those of the United Kingdom and Norway reported political pressure to make relations between industry and regulators more formal and arms-length. Such steps were seen by some as necessary to increase public trust. An invited speaker from a coastal community on the North Sea expressed concern that offshore operators may be given too much responsibility to prioritize risks and make risk control decisions under the ALARP concept. The speaker maintained 168 See http://www.hse.gov.uk/offshore/statistics/hsr2015.pdf. 169 Duty holders are given itemized bills of the number of hours expended by HSE personnel engaged in safety regulatory review and compliance activities. 170 See http://www.ptil.no/safety-forum/category917.html.

84 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES that more public engagement and government oversight of these decisions are warranted. However, the entirety of the committee’s discussions with the region’s government, industry, and labor representatives did not reveal a strong undercurrent of opposition to the region’s collaborative approach. Evaluation Challenges Both PSA and HSE investigate reports of safety incidents, require report- ing of workplace injuries and hydrocarbon releases, and conduct research and analyses that use data from these reports and follow-up investiga- tions.171 PSA also sends questionnaires to workers about safety conditions. These data are used to analyze safety trends and identify areas where im- provements in regulation, collaboration, and enforcement activities may be needed. Because major offshore incidents are rare, empirical assessment of the effectiveness of the program requirements in preventing major incidents can be difficult. PSA’s safety data program, referred to as RNNP,172 uses a formula for weighting certain types of reported incidents (e.g., well control, fires and explosions, gas leaks) to create a composite indicator of major in- cident risk.173 By assessing trends in the indicator over time, PSA estimates that the risk of a major incident in the Norwegian oil and gas sector has been reduced by about 50 percent during the past decade.174 The UK and Norwegian government, industry, and labor representatives who briefed the committee shared the view that the risk of major incidents has been reduced by the shift to a macro-means approach implemented in a collaborative environment, although they acknowledged the difficulty of measuring this effect quantitatively. Their reasoning emphasized that opera- tors needed to be given the latitude to customize risk reduction efforts to the operator’s individual circumstances. These representatives maintained that by putting the responsibility for risk mitigation more squarely on the operator, the use of macro-means regulation has fostered a safety mind-set that was lacking when operators were only expected to comply with de- tailed sets of individual rules. 171 See http://www.hse.gov.uk/offshore/statistics.htm; http://www.ptil.no/rnnp-and-major- accident-risk/category977.html. 172 RNNP abbreviates “Risikonivå i Norsk Petroleumsvirksomhet,” which means “risk level in Norwegian petroleum activities.” 173 See http://www.psa.no/about-rnnp/category911.html. 174 See http://www.ptil.no/rnnp-and-major-accident-risk/category977.html.

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 85 Observations on Offshore Safety Regulation in the United States and the North Sea Both the U.S. and the North Sea offshore oil and gas industries experienced major incidents that prompted changes in government safety oversight and regulation. In general, these changes have led to more macro-means requirements being placed on offshore operators to establish and follow procedures and programs for identifying, assessing, and managing the risks of their activities. Governments in the North Sea, led by those of the United Kingdom and Norway, moved earliest and farthest in this direction by requiring systematic identification of risks by operators and justification of proposed means of managing them. The United States has only recently added regulations requiring that operators establish safety management programs and engage in deliberate and documented risk identification and assessment. In all of these countries, the changes in program requirements were imposed on the basis that traditional, micro-level regulations targeting individual risks have not been sufficient in accounting for and controlling all important risks. Neither the United States nor the North Sea countries have abandoned micro-level regulation. The offshore regulatory regimes depend heavily on such regulations. In all of the countries studied, the required actions are specified directly in regulations or in guidelines that reference consensus standards. The U.S. regime contains hundreds of detailed regulations pre- scribing actions that must be taken to control specific risks. Such detailed regulatory directives are less common in the UK and Norwegian regimes, where micro-level regulations are more generalized and can be described as ends-based. Nevertheless, agency guidelines on how to comply with a regulation refer extensively to more means-based consensus standards, which accord automatic compliance if they are followed. In addition, as a practical matter, operators often make the case that they have identified and controlled risks by promising to follow micro-level consensus standards. The most significant difference between the United States and the North Sea countries concerns the approaches used to encourage and enforce compliance with regulations. The U.S. approach is heavily dependent on inspectors making short, sometimes unannounced, visits to installations. They look for conformity to specific regulatory requirements and issue notices when instances of nonconformity are found. The United States has more than 2,000 offshore installations that, by law, must be inspected at least annually. In 2016, these inspections, which were conducted by a staff of about 120 inspectors, produced 2,400 notices of noncompliance. In over- seeing the safety of several hundred offshore facilities each, UK and Nor- wegian regulators have strong enforcement powers and can use them when necessary; however, they also view themselves as problem solvers. They

86 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES conduct planned but in-depth inspections of facilities or, as in Norway, assign teams to integrate with operator personnel for ongoing verification of and assistance in compliance with regulations and operator promises. When an incident of noncompliance is discovered, regulators work with the operator to find a solution, which reduces notices that result in sanctions. UK regulators in 2015 conducted 135 facility inspections, all announced, and issued 35 notices. The UK and Norwegian approach to compliance is demonstrably more collaborative than the U.S. approach. Collaboration among regulators, operators, and labor representatives is viewed as critical to the successful implementation of regulations requiring operators to establish and follow macro-means management programs for identifying and controlling major incident risks. Operators collaborate with labor to develop and implement programs and with regulators to strengthen and adhere to them. Rather than review each operator’s proposed management plan strictly with re- gard to compliance with regulatory provisions, HSE and PSA review the proposed plans and then meet with operators to offer ideas on how to improve them. Such extensive collaboration requires regulators to have staff with a level of technical competency and industry knowledge that far exceeds what is traditionally needed to enforce compliance with detailed, micro-level regulations. Significantly, North Sea legislators have granted regulators the re- sources and procedural freedoms to make these supportive changes. When economic conditions lead to significant pay differentials between industry and government, hiring and retaining qualified personnel to implement the regulatory programs can be challenging for North Sea regulators, as it is for BSEE in the United States. To help pay for HSE’s skilled personnel, op- erators are required to compensate the agency for the time spent reviewing safety cases and their implementation. Furthermore, officials in these coun- tries were willing to emphasize collaboration even at the expense of public transparency in some aspects of the regulatory process. For example, while operator consultations with offshore workers add a degree of transparency to the process, safety cases are not openly available, and their development offers little opportunity for the general public to consider the duty holder’s application of HSE guidance on determining an acceptable level of safety and environmental risk. The more recent introduction of regulations requiring management programs is testing the ability of the U.S. regulator, BSEE, to develop the requisite staffing competencies and to add a collaborative dimension to what remains largely an arms-length relationship with the regulated indus- try. BSEE’s structuring and implementation of its safety management regula- tions have occurred under legal and institutional conditions different from those of the North Sea countries. In comparison with these countries, the

APPLICATIONS OF THE CONCEPTUAL FRAMEWORK 87 regulatory process in the United States has been described as more adversar- ial than collaborative (Kagan and Axelrad 2000). It provides a number of opportunities for contestation of regulatory design decisions, including the public notice-and-comment provisions of the Administrative Procedure Act, White House regulatory reviews, and the division of responsibilities among government branches (Aubuckle 2009). A high degree of collaboration is not a common feature of the U.S. approach to developing and implement- ing regulations and would be impractical for BSEE to adopt in the same extensive manner as in the North Sea countries. BSEE has thus structured and implemented its macro-means regulations in a different—albeit less collaborative—way that reflects the conditions under which it operates. As illustrated by these differences in the macro-means regulations of BSEE and the North Sea offshore regulators, regulations of the same basic design may be structured and applied in various ways that accommodate a particular set of conditions. In the next chapter, further consideration is given to the choices that regulators face in deciding on the basic design of their regulations as well as the regulation’s structural details in response to underlying circumstances. Such variability in circumstances and in how regulations of the same basic design can be structured differently in re- sponse to circumstances complicates comparisons of the advantages and disadvantages of different regulatory designs. REFERENCES Abbreviations BSEE Bureau of Safety and Environmental Enforcement TRB Transportation Research Board Aubuckle, D. R. 2009. Collaborative Governance Meets Presidential Regulatory Review. Journal of Dispute Resolution, Vol. 2009, No. 2, Article 4. Bennear, L. S. 2015. Positive and Normative Analysis of Offshore Oil and Gas Drilling Regu- lations in the U.S., U.K., and Norway. Review of Environmental Economics and Policy, Vol. 9, No. 1, pp. 2–22. BIO by Deloitte and Stevens and Bolton, LLP. 2014. Civil Liability, Financial Security and Compensation Claims for Offshore Oil and Gas Activities in the European Economic Area: Final Report. European Commission, DG Energy. BSEE. 2015. Annual Report 2015. U.S. Department of the Interior, Washington, D.C. Cullen, W. D. 1990. The Public Inquiry into the Piper Alpha Disaster. Her Majesty’s Statio- nery Office, London, Nov. Kagan, R. A., and L. Axelrad. 2000. Regulatory Encounters: Multinational Corporations and American Adversarial Legalism. University of California Press, Berkeley. National Academy of Engineering and National Research Council. 2012. Macondo Well Deep- water Horizon Blowout: Lessons for Improving Offshore Drilling Safety. The National Academies Press, Washington, D.C.

88 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES National Academy of Engineering and National Research Council. 2013. Best Available and Safest Technologies for Offshore Oil and Gas Operations: Options for Implementation. The National Academies Press, Washington, D.C. TRB. 2016. Special Report 322: Application of Remote Real-Time Monitoring to Offshore Oil and Gas Operations. Transportation Research Board, Washington, D.C.