1
Introduction
The blowout, explosions, and fire at the Deepwater Horizon/Macondo well in April 2010 killed 11 people, seriously injured 17 more, and spilled a record 5 million barrels1 of oil into the Gulf of Mexico (GoM). It subsequently resulted in many recommendations to reform industry practice and regulation to reduce the probability of a similar disaster recurring, some of which have been adopted and others not. In response to the committee’s Statement of Task (SOT), see Box 1-1, this report is an assessment of the systemic risk profile of the offshore oil and gas industry currently and how it has changed since those tragic events of 2010.
In this introduction the committee provides the definitions that it has used for systemic risk and industry systemic risk profile in developing this report. This is followed by a brief history of the offshore industry and its safety record and a brief summary of the multiple investigative reports that have identified the human, organizational, and regulatory failures that led to the Macondo disaster. The penultimate section provides background on the concept of systemic risk on which the committee drew in developing the definitions provided below, and the final section of this introduction includes the committee’s interpretation of its SOT and describes the outline of this report and how it relates to the committee’s charge.
___________________
1 One barrel is equal to 42 U.S. gallons.
DEFINITIONS
As noted above, the committee was specifically directed in its SOT to understand the profile for “systemic risk” in offshore energy operations. The first task was to develop a working definition for systemic risk that
would guide the development of a model for understanding risk and an industry framework for how it is managed, which is described in Chapter 4. Definitions of key terms are provided in this section. A subsequent section of this chapter provides background on the concept of systemic risk and how the committee believes that it applies to the offshore oil and gas industry.
In this regard, the committee agreed on the following definition.
Systemic risk: The overall risk of catastrophic failure associated with the entire system. It includes design, operations, and regulation throughout the life cycle of offshore oil and gas facilities.
Systemic risk is singular in that it is the perception (however quantified or characterized) of the level of risk in operating the system at the rig or facility level. It is not, however, constant. It can change over time as system components change or in response to external events, or as a consequence of the stage of its life cycle (from construction to decommissioning), which leads to the following definition:
Systemic risk profile: The temporal description of systemic risk. A risk profile examines the nature and level of the threats faced by organizations, the likelihood of adverse effects occurring, the level of disruption and costs associated with each type of risk, and the effectiveness of controls in place to manage those risks. This profile changes over time, sometimes abruptly. “In the real world, when our well-designed and well-specified processes and equipment enter service, they are almost immediately subject to change. In reality, day-to-day operations are characterized by a changing dynamic where there are multiple sources of potential risk which typically change daily, hourly, and sometimes by the second” (Jones and Brewer, 2018).
Systemic risk management: The design and operation of barriers, or controls, using the best available engineering and human-systems integration2 to ensure the integrity of physical barriers and that the responsible people have the appropriate competence and support from their organizations to manage system control barriers appropriately in planned and unplanned conditions.
___________________
2 Human-systems integration refers to “providing equal consideration of the human along with the hardware and software in the technical and technical management processes for engineering a system that will optimize total system performance and minimize total ownership costs.” See Proctor and Van Zandt (2018, p. 22).
The primary responsibility for systemic risk management is of necessity vested in the organizations engaged in hazardous activities, but success in doing so also depends on industry standards and the entire offshore regulatory structure for minimizing risk.
As with temporal changes in hazards, complex organizations can change over time in ways that influence systemic risk:
- The effectiveness of barriers or controls can be degraded by economic pressures; conflicting organizational goals and decreased emphasis on safety; changes in leadership; insufficient resources devoted to maintenance, training, and communications; declines in workforce situation awareness (SA); and other detrimental influences on organizational and individual performance (Reason, 1997).
- The effectiveness of organizational management of barriers can also be enhanced through appropriate leadership and emphasis on a culture committed to safety; rigorous implementation and maturity of safety management systems; development of and adherence to rigorous standards; application of technical tools and data collection to improve hazard identification, risk analysis, decisions, and barrier management; and other management and organizational strategies, such as enhanced emphasis on competence and training to improve SA.
BRIEF OVERVIEW OF THE U.S. OFFSHORE INDUSTRY AND SAFETY RECORD
Current Context
Offshore oil and gas currently accounts for a significant share of U.S. production even though breakthroughs in producing oil and gas from tight shale formations have sharply increased land-based production of hydrocarbons in the United States. As of 2019, before the COVID-19 pandemic, U.S. offshore oil and gas production, virtually all of it occurring in the GoM, accounted for about 15 percent of U.S. crude oil production3 and 3 percent of natural gas.4 At this time, GoM crude oil and natural gas production averaged about 2.3 million barrels of crude oil equivalent per day. It was estimated to directly support roughly 70,000 jobs in the GoM region in 2019 (EIAP, 2020), about half of which occur offshore. In mid-2022,
___________________
3 See https://www.eia.gov/special/gulf_of_mexico/data.php#petroleum_fuel_facts.
4 Ibid.
offshore oil and gas exploration and production in the GoM was expanding in response to an economy rebounding from the COVID-19 pandemic.
Future exploratory drilling and production by the U.S. offshore oil and gas industry5 is uncertain because of possible policies to combat climate change, but over the next decade or more the offshore industry is expected to remain a significant source of petroleum production in the United States. The committee’s additional thoughts about the offshore industry during an expected period of energy transition are expressed in Chapter 7.
Brief History of the U.S. Offshore Industry
Offshore drilling and production in the United States dates back more than 120 years. (A brief description of offshore exploration drilling and production processes is provided in Annex A of this chapter.) Offshore drilling from piers at the waterline dates to the 1890s. Drilling for petroleum began occurring in shallow waters of the GoM in the 1930s using barges. By late in that decade the first standing platform in open water was built 1.5 miles (2.4 km) offshore.6 By the late 1940s, there were more than 40 exploratory wells offshore (NASEM, 2016, p. 64). By 1957, there were 446 production platforms in federal and state waters that were responsible for 3 percent, and growing, of total U.S. production (National Commission, 2011, p. 25). These were hazardous work environments as drillers experimented with technologies developed onshore and used untested techniques on small offshore platforms or vessels that placed workers, heavy machinery, and hazardous, flammable gases and liquids in close proximity.
Offshore drilling was interrupted for a period in the mid-1950s while Louisiana and the federal government contested the demarcation of responsibility for offshore production (and revenues from leasing public land), which required a Supreme Court case to resolve. The separation of federal and state responsibility offered in the Offshore Continental Shelf Lands Act (OCSLA) of 1953 ultimately prevailed and generally set federal responsibility beginning at three nautical miles from the shoreline, except in Texas and Florida where federal responsibility begins at 6 miles, with the federal lands being designated as the Outer Continental Shelf (OCS).
Offshore drilling on the OCS resumed afterwards from barges and jack-up rigs, but complete records of injuries and fatalities were not kept. Significant recorded events, however, suggest the hazardous nature of this work. In the late 1950s, for example, three drilling vessels overturned, resulting
___________________
5 Readers unfamiliar with the technical terms used in the oil and gas industry are referred to the Oil Field Glossary, https://glossary.slb.com/en/terms/o/oil_field.
6 Unless otherwise noted, this brief history of offshore drilling, production, and safety draws heavily from NASEM (2016, pp. 64-73).
in 13 fatalities and multiple injuries. After these tragedies, minimal federal regulations were issued, but enforcement was sporadic and lax (National Commission, 2011, pp. 28-29). In 1962, the industry introduced floating drilling rigs that could operate in deeper water than before (National Commission, 2011, p. 25). By 1969, the federal regulator had only 12 staff for the GoM overseeing work on roughly 1,500 platforms. After a series of spills and disasters in the GoM and around the world, industry safety efforts and regulation and enforcement efforts strengthened, but the work remained hazardous. As noted by the National Commission (2011, p. 3),
Drilling for oil had always been hard, dirty, dangerous work, combining heavy machinery and volatile hydrocarbons extracted at high pressures. Since 2001 [and by 2010], the Gulf of Mexico workforce—35,000 people, working on 90 big drilling rigs and 3,500 production platforms—had suffered 1,550 injuries, 60 deaths, and 948 fires and explosions.
By the early 1970s, ambitious exploration in greater than 1,000 feet (300 or more meters)7 of water depth led to discoveries of large hydrocarbon deposits that caused operators to begin exploring for petroleum even farther offshore. Deepwater wells operating in water depths of 1,000 feet or more can produce more than 10,000 barrels per day compared to, at most, a few thousand barrels a day in shallower water. Despite the much higher initial investment required to exploit reserves in deepwater, such projects can produce oil and gas at a lower cost per barrel than shallow-water wells (Chief Counsel, National Commission, 2011, p. 7). However, exploration and production from deepwater wells encounter very high pressures and narrow safety margins that can increase risk if not well managed. Deepwater wells experience pressures that can exceed 10,000 to 15,000 pounds per square inch—up to 1,000 times more than atmospheric pressure at the surface (Chief Counsel, National Commission, 2011, p. 8).
As floating drilling rigs moved farther offshore in the 1960s to explore for crude oil, it became common for platforms to house workers who worked 12-hour shifts in 24-hour operations, and who then spent 1 to 2 weeks offshore before recovering for a few days or 1 week onshore. Today, floating exploration drilling rigs and production platforms in deepwater may house as many as 200 people working 12-hour shifts on a rotation of 14 to 21 days on, 14 to 21 days off. In contrast, older production platforms
___________________
7 Deepwater was historically defined as having a depth greater than 500 feet (150 meters). Over the past couple of decades, deepwater has more often been defined as water depths greater than 1,000 feet (300 meters). The historical definition is used here to maintain consistency with other available statistical data.
in shallow water are staffed by smaller crews with many small platforms totally unstaffed.
Because of the varied geological and reservoir conditions and sources of petroleum and natural gas in the GoM, as well as having dozens of operators from around the world supported by hundreds of different contractors, drilling and production facilities vary considerably. As of the beginning of 2022, there were fewer than 1,700 offshore production platforms in the GoM. This total number of offshore platforms represents a decline of almost 50 percent from about 3,400 such facilities in 2010.8 This downward trend is primarily due to the decommissioning or abandonment of older production platforms located in shallow water that were no longer producing oil or gas profitably. As of the end of September 2020, the number of floating drilling rigs operating in deepwater had declined to about 20 from 42 in 2018 (NASEM, 2021, pp. 11-12). At the time of this writing in 2022, there are more than 50 operators with active production9 in the GoM, several independent drilling contractors, and hundreds of specialized contractors and service providers (NASEM, 2021).
In the early decades of offshore oil and gas activities, oil companies typically owned and controlled all aspects of drilling and production and there were few contractors. In the 1960s and 1970s, the oil companies began to spin off specialty services (e.g., drilling functions). This led to the growth of the oil and gas service industry seen today and thus, drilling and production became a joint effort between operators and contractors. Today, active drilling rigs are leased by an operator, with drilling contracted to an independent or specialized driller using the contractor’s crews and equipment and supplemented with other contractors offering specialized services such as well logging and cementing. Thus, the culture of safety on a drilling rig can be influenced by the cultures and workforces of multiple companies.
Accurate data on injury rates may not be available for the early decades of offshore production (prior to 1970); however, BSEE does provide annual descriptions of most incidents on its website.10 Over the past two decades, industry and regulators have made concerted efforts to steadily reduce occupational injuries (see Figure 1-1). Occupational injury rates11 in U.S. oil and gas drilling and exploration (both land based and offshore) are consistently below that of employment in the rest of the U.S. private sector, and considerably lower than industries such as transportation, mining, and
___________________
8 See https://www.bsee.gov/sites/bsee.gov/files/performance-data-table-2010-2019-12-16-2020.pdf.
9 See https://www.data.bsee.gov.
10 Incident data and reports are available from 1956 to 2020 at https://www.bsee.gov/stats-facts/offshore-incident-statistics. Data from 2013 to 2020 are available in Excel spreadsheets; incident reports for years 1956 to 2000 are available in PDF.
11 See https://www.api.org/news-policy-and-issues/blog. See also API (2021). Note that this report is based on statistics reported by the Bureau of Labor Statistics and BSEE.
SOURCE: Data from the American Petroleum Institute.
manufacturing (API, 2021), although offshore injury rates worldwide are about twice as high as onshore rates (IOGP, 2021, Table 8, p. 27).
These favorable trends in occupational safety, however, are not good indicators of the risk of future disasters. The blowout and explosion on the Deepwater Horizon drilling rig in 2010 occurred at the same time that the crew was receiving a safety award from senior corporate managers to recognize the rig’s exemplary occupational safety record. Occupational safety trends, as reviewed above, are not generally believed by experts to be indicative of risks of disasters such as major blowouts, explosions, fires, and spills from offshore wells (Hudson, 2009). Process safety metrics discussed in Chapter 3 of this report provide better indicators of the risk of major accidents. In the oil and gas industry, process safety focuses heavily on avoiding loss of containment of hazardous materials through controls or barriers. Barriers are formally defined by the International Association of Oil & Gas Producers (IOGP) as a “risk control that seeks to prevent unintended events from occurring or prevent escalation of events into incidents with harmful consequences.”12 Controls can be physical or human or some combination. A more expansive definition used in this report is
[a] disciplined framework for managing the integrity of operating systems and processes handling hazardous substances by applying good design
___________________
12 See https://www.iogp.org/bookstore/product/standardization-of-barrier-definitions.
principles, engineering, and operating practices. It deals with the prevention and control of incidents that have the potential to release hazardous materials or energy. Such incidents can cause toxic effects, fire, or explosion and could ultimately result in serious injuries, property damage, lost production, and environmental impact. (CCPS and SPE, 2021, p. 1)
Process safety is also discussed later in this chapter.
Overview of Offshore Safety Regulatory Authority
In the early years of oil and gas exploration offshore, the U.S. Department of the Interior (DOI) charged the U.S. Geological Survey with responsibility for regulating exploration and production offshore, including safety. These regulatory responsibilities were transferred to the Minerals Management Service (MMS) at its creation in 1982 as a new DOI agency. When the offshore industry began drilling from vessels, and later from deepwater floating platforms, the U.S. Coast Guard’s (USCG’s) regulations applied regarding the safety of life and property. As pipelines were used to transport oil and gas to landside storage, the federal Office of Pipeline Safety (OPS), now part of the Pipelines and Hazardous Materials Safety Administration (PHMSA), applied. Thus, there were three different agencies with fairly distinct oversight of different aspects of offshore safety. MMS had regulatory authority over drilling and production and shared occupational safety responsibility with USCG. USCG’s regulations governed vessel stability, safety of vessel operations, and chain of command. OPS regulations governed pipeline design and operations. One of the post-Macondo reforms, discussed in Chapter 2, reformed MMS into what ultimately became the BSEE.
OCSLA is the main governing statute that grants authority to DOI for administering federal laws governing mineral exploration and development of the U.S. OCS. Statutes such as OCSLA, along with agreements with USCG and PHMSA, provide the framework for BSEE to implement its offshore inspection program. An interagency agreement between the agencies generally involves the division and coordination of inspection duties and other matters. BSEE has jurisdiction over the safe and responsible exploration, development, and production of offshore energy resources and carries out inspections of offshore facilities, including on behalf of the USCG. Because (a) BSEE has the primary role in regulations and oversight that affect catastrophic risk and (b) reform of MMS and its regulations were the primary focus of post-Macondo reports summarized in Chapter 2, this report focuses on BSEE regulation and inspections.
MACONDO WELL BLOWOUT AND EXPLOSION
Background
The Deepwater Horizon was a gigantic, 33,000 ton floating drilling rig that was a testimony to human ingenuity, engineering, and financial investment.13 This $350 million, four-level drilling rig included massive equipment for exploration drilling and space for a 126-person workforce that operated around the clock on 3-week-on and 3-week-off shifts. Its drilling derrick rose 20 stories high above the rig floor. Its massive hull extended 75 feet below the waterline to provide stability, and it was dynamically positioned using GPS and massive engines rather than being moored to the seafloor. The rig crew was drilling the Macondo well in almost 5,000 feet of water (approximately 1,500 meters) roughly 50 miles (80 km) off the Louisiana coastline.
The plan was to drill almost 20,000 feet (6,100 meters) below the seafloor surface to reach the oil and gas reservoirs, but the drilling was terminated at 18,360 feet (5,600 meters) because the well design and complexity of the geologic formations encountered precluded drilling any deeper (CSB, 2016, Vol. 1, p. 25). At that point, in the early morning hours of April 20, 2010, a cement plug was placed at the bottom of the well, and, after allowing the cement to set and testing its integrity, that evening the crew began the process of temporary abandonment so that a smaller, more specialized and less complex rig could complete the well at a later date.
BP held the lease to drill the Macondo Prospect, and under federal regulation, BP was therefore the responsible party for safety even though most of the work on the well was done by contractors under BP’s supervision. Transocean owned the Deepwater Horizon, served as the drilling contractor, and provided most of the workforce on the rig. Other principal contractors involved in the well included Halliburton for conducting the cement job that would plug the well during temporary abandonment, Sperry Sun (a Halliburton subsidiary) for monitoring the pressures in the well during drilling, and Schlumberger companies responsible for managing the mud system and for well logging.
The Events of April 20, 2010
Several post-Macondo investigative reports highlight the principal causes of the blowout and explosion, and whereas the reports offer somewhat
___________________
13 This text relies on the National Commission (2011, pp. 1-3) report unless otherwise noted.
varied emphases on why the disaster occurred, the events leading up to the blowout and explosion are not in doubt.14
At about 8 p.m., the crew began the temporary abandonment process, which included displacing the heavy drilling mud that was maintaining the pressure needed to keep hydrocarbons from flowing into the well and replacing the mud with seawater. At this point, due to the then-unrealized failure of the bottom-hole cement plug, the drilling mud was the only physical barrier left to prevent a disastrous blowout.
Despite available indications that the bottom-hole cement had failed and that the well was actually flowing, the rig crew continued to displace the heavy drilling mud. As mud was displaced, pressures began rising in the well at about 8:50 p.m. and rose for 50 minutes without the staff realizing it. High-pressure gas from the pay zones approximately 18,000 feet (5,500 meters) below the sea surface traveled up the well and entered the riser pipe that connected the blowout preventer (BOP) to the rig and from there, it traveled the 1-mile distance from the seabed to the rig. As gas rose to the surface, it expanded rapidly as the pressure was reduced, and between 9:40 and 9:43 p.m., mud spewed from the rotary table, sprayed onto the rig floor, and shot up and out of the crown of the derrick.
An ignition source caused the entrained hydrocarbon gases to explode violently at 9:49 p.m. and killed several workers on the drill floor, injured many more, and set the rig on fire. The initial and subsequent explosions and fire knocked out the diesel engines providing power to the rig. The emergency disconnect that should have separated the riser from the BOP failed to do so, perhaps due to loss of power, and attempts to seal the well using the blowout preventer failed.
In addition to 11 fatalities, 17 workers were seriously injured. Had a service vessel not been nearby and able to rescue workers who had jumped into the water, the losses could have been greater in the 50-degree weather. The rig burned for 36 hours before sinking. Oil continued to flow from the well for 87 days before being plugged successfully and resulted in the largest spill in U.S. waters. BP is estimated to have paid out $67 billion for cleanup costs, penalties, and damages (Sledge, 2019).
Organizational and Regulatory Failures at Macondo
The subsequent investigations of the blowout and explosion pointed to significant management and organizational failures by BP and its contractors, as well as insufficient regulation and regulatory oversight, as the primary contributing causes of the disaster. The following examples of management
___________________
14 In addition to the National Commission and Chief Counsel’s reports already cited, major investigations include BOEMRE (2011), CSB (2016), and NAE and NRC (2012).
failures are drawn from three independent reports (with more details of their findings in Annex B):
- The Chief Counsel of the National Commission concluded that the failures on the Deepwater Horizon traced back to management errors and lapses by BP and its contractors. For example, BP did not appreciate the risks of the Macondo well, nor did BP’s Temporary Abandonment Plan require an assessment of the risks by on-site BP and Transocean staff. During the abandonment process, management decisions to allow multiple activities to take place simultaneously compromised the ability of the drilling team to recognize rising pressures in the well. Halliburton did not oversee its cement job effectively and missed signals about its potential to fail. Transocean failed to train its crews properly in kick detection, including not sharing recent company experiences with gas-in-riser blowouts (Chief Counsel, National Commission, 2011).
- The National Academy of Engineering and National Research Council report also concluded that BP management failed to appreciate or plan for a well as complex as Macondo. The actions taken during temporary abandonment displayed an inadequate system safety approach by BP and Transocean.15 The multiple flawed decisions that were made also displayed a lack of a strong culture of safety on the rig (NAE and NRC, 2012).
- The Chemical Safety Board (CSB) noted that offshore drilling always involves a degree of difference between work as imagined (WAI) and work as done (WAD), but neither BP nor Transocean bridged the gap between WAI and WAD in their guidance regarding temporary abandonment and neither company enforced its own corporate policies for assessing risks. CSB also concluded that the multiple companies involved in drilling the Macondo well led to flawed communication and decision making; that the drillers fell prey to cognitive biases in accepting the anomalous tests following cementing; and the crews were not sufficiently trained in nontechnical skills to question the temporary abandonment process or communicate concerns they may have had. Both BP and Transocean focused on occupational safety, and did so effectively, but failed to give adequate attention to process safety (CSB, 2016).
The federal government’s investigation of the proximate and immediate contributing causes of the blowout and explosion reaches similar
___________________
15 System safety, as used in the NAE and NRC (2012) report, is comparable to process safety.
conclusions about the failure of the cement plug, flawed decisions made by the drilling team, inadequate directions provided to the drilling by BP and Transocean for temporary abandonment, and other management failures by the companies involved (BOEMRE, 2011).
Regarding regulations and regulatory oversight, all of the investigations of the Macondo well blowout and explosion found that existing regulations and oversight were inadequate.
- The Chief Counsel’s report concluded that
- the existing regulatory structure was inadequate for overseeing a complex well like Macondo;
- then-applicable regulations had little relevance to technical and management problems that led to the blowout; and
- regulators did not have training or experience to adequately evaluate the risk of the project (Chief Counsel, National Commission, 2011).
- The NAE and NRC (2012) report agreed that the regulatory regime in place at the time was ineffective in overseeing the Macondo well.
- The CSB final report, which included testimony from litigation that was not completed until February 2016, and therefore came out 5 years after the earlier reports, agrees with other reports about regulatory inadequacies of the time and, despite reforms made since then, notes inadequacies that persist to this day. In particular, the report concludes that the adopted reforms lack adequate emphasis on process safety (CSB, 2016).16
According to these in-depth investigations, the root causes of flawed decision making at Macondo trace back to failures of management and organizational culture as expanded on next.
Culture That Supports Safety
An organization’s culture is reflective of its shared behaviors, beliefs, attitudes, and values regarding organizational goals, priorities, functions, and procedures. The degree to which an organization’s culture is focused on and supports safety is often considered “safety culture” and can be reflected in the resources available (e.g., training) and behaviors reflected (particularly by leadership) in that organization. As summarized in Annex B, multiple independent reports linked the safety culture experienced on the Deepwater Horizon with decisions and inactions that led to blowout and explosion.
___________________
16 Major recommendations from this and other investigative reports are discussed in Chapter 2.
Furthermore, organizations with weaker safety cultures tend to not put resources into supporting human performance and preventing flawed human decision making (NASEM, 2016, p. 52).
Flawed Human Decision Making
The working environment in offshore oil and gas can be chaotic and involve uncertain risks. It is an environment where managers and workers are individually and collectively making decisions constantly and quickly. Some of the decisions and mistakes made by the managers and drilling crew on the Deepwater Horizon mentioned above provide examples of how concepts from the field of human factors can be applied to decision making and performance in offshore safety beyond Macondo. Although this is not an exhaustive list, three examples of mechanisms associated with individuals’ flawed decision making, referred to in several investigative reports of the Deepwater Horizon, are cognitive bias, interface design, and situation awareness.
Cognitive Bias
One way to understand cognitive bias is described in Daniel Kahneman’s (2011) Thinking, Fast and Slow. Experiments by psychologists such as Kahneman and Amos Tversky have demonstrated that human intuition is subject to inherent limitations and biases that are usually unrecognized by the individuals arriving at these judgments. In some situations, these biases can improve the speed of decision making and do not seriously impede normal human interactions. However, they can also result in incorrect decisions, and when people are wrong because of a cognitive bias, they are often confident that they are right and blind to conflicting evidence (Kahneman, 2011, p. 4). Kahneman characterizes intuition (and thus bias) as “thinking fast,” and it is often considered an evolutionary development that allowed humans to survive in the wilderness when subject to faster and stronger predators. “Thinking slow,” in contrast, involves the cognitive processes of rational analysis and, sometimes, mathematical reasoning and calculation. Thinking slow is not a process to engage in when concerned that a predator is near, and consequently is a process that Kahneman describes as only used with discipline and effort.
Experiments have identified numerous biases regarding people’s ability to understand probabilities and risks. They often rely on intuition and do not take the time and effort to engage their (slower) reasoning ability. Even experts in statistics fall prey to cognitive biases when they rely on their intuition (Tversky and Kahneman, 1974, p. 1130). The challenge for people
working in offshore environments is that, given the need to make decisions quickly, they may engage in “fast thinking” when slow, more deliberate thinking is needed, particularly in novel circumstances (where even experts’ intuition can be wrong) (Kahneman, 2011, pp. 234-244).
Confirmation bias occurs when people privilege information that confirms a preidentified theory and fail to seek out or even acknowledge information that may conflict with the current theory. The CSB investigators concluded that the drilling crew’s decision to accept that the bottom-hole cement plug was sound when the test results were conflicting (i.e., one of which showed pressure in the well and one of which did not) was an example of confirmation bias. The CSB specifically described confirmation bias as “a one-sided case-building process of unconscious selectivity in gathering and using evidence that supports one’s beliefs” (CSB, 2016, Vol. 3, p. 58). That this bias occurred cannot be proven because key participants were among those killed, but the senior staff decided that the well was plugged and, after discussion among the crew, moved on and did not revisit this decision (CSB, 2016, Vol. 3, pp. 54-55). Confirmation bias is something all people regularly experience and it is important to understand its effect in dynamic, high-risk work environments.
Interface Design
Human factors researchers and cognitive scientists have long known that the design of interfaces (both the visual design and the layout) with which a human interacts can have both profound and subtle impacts on performance accuracy and efficiency. Indeed, in World War II, Alphonse Chapanis was able to eliminate pilots’ mistakenly raising the landing gear instead of the landing flaps by changing the layout of these controls (Pew, 2010). And although design guidelines and standards that have been documented to reduce the likelihood of human error exist for the oil and gas industries, they are often not implemented or considered (Peacock et al., 1984, pp. 445-448). This is reflected by one of the statements contained in the National Oil Spill Commission Report to the President regarding the displays of the drill pipe pressure immediately before the blowout on Macondo. They observed,
These individuals sit for 12 hours at a time in front of these displays. In light of the potential consequences, it is no longer acceptable to rely on a system that requires the right person to be looking at the right data at the right time, and then to understand its significance in spite of simultaneous activities and other monitoring responsibilities. (National Commission, 2011, p. 121)
Situation Awareness
One particular way that interface design can affect performance and decision making is through SA. Workers’ levels of SA affect their ability to make decisions quickly and accurately in dynamic environments. The most prevalent model of SA is Endsley’s three stage model which consists of perception, comprehension, and prediction (Endsley, 1995). To make a decision about a relevant task, the worker must perceive the relevant information about that task (e.g., pressure values), comprehend what those values mean (e.g., the pressure in the wellbore is rising), and then, given the current circumstance, predict what will happen if the current trend continues (e.g., there will be a blowout). To have higher SA, organizations must provide workers with sufficient training (on their task and with their team) (Roberts et al., 2015b; Sneddon et al., 2006) and display designs that support task performance and SA (Endsley, 2016). Indeed, there have been numerous studies that have identified important links between poor SA and problematic decision making in offshore oil and gas with specific references to issues surrounding the Macondo explosion (Mehta et al., 2018; Roberts et al., 2015a).
Managers and workers may also engage in flawed decision making that is more directly associated with team performance than individuals’ decision making. Some recent research has identified that crew resource management training (Salas et al., 2006) is an effective tool for improving team performance, SA, and team decision making. Further work on team cognition and performance (Cooke et al., 2004) could likely provide important insights into how decision making could be flawed through team processes, but there is little work in this domain that has been applied to offshore oil and gas.
In Chapter 4 the committee returns to issues of training, certification, SA and performance, and human factors standards in its assessment of offshore systemic safety management.
SYSTEMIC RISK CONCEPT APPLIED TO OFFSHORE SAFETY
The SOT calls for the committee to
Define the current profile of systemic risks of offshore oil and gas operations in the Gulf of Mexico that could lead to disasters. By systemic risks, we mean defining risks associated with the components of the system, the system itself, and how humans interact with the system, in which a failure of any part could lead to failure of the system as a whole.
Although increasingly widely used, the term “systemic risk” is apparently not yet clearly defined or widely enough accepted to appear in the
glossary of the Society for Risk Analysis (SRA, 2018). Several authors point to the origin of the term “systemic risk” in a paper by Cline (1984) regarding the financial risks of international indebtedness and the implications of cascading economic collapses across nations due to globally interconnected financial systems. The concept then began being applied to the risks of collapse of financial systems from unforeseen events, an oft-cited paper being one by Kaufman and Scott (2003). Following an influential report by the Organisation for Economic Co-operation and Development (OECD, 2003), some authors extended the concept of systemic risk to climate change or world economic collapse and threats to major social systems such as infrastructures, telecommunications, and health care because of the problematic nature of transborder governance (Renn et al., 2020; Schweizer, 2021). There appears to be general agreement among these authors that systemic risk has some key features: complex systems characterized by unpredictable interactions among independent agents; complex feedback loops; nonlinear relationships among system components; and tipping points, or phase transitions, from stability to instability in ways that threaten collapse and major societal harm.
In offering one rigorous definition of systemic risk, Bieber (2018) refers to it as
risk that endangers the functioning of a system and originates in the system or its background noise, where a system is conceived of as a set of interdependent, interacting components that form a complex, functionally defined whole … “systemic risk” is particularly suited to characterize some of the most pressing risks faced in an increasingly interconnected world.
Lucas (2020) does not offer a definition, but observes that “Systemic risks, as opposed to conventional risks, bear the danger of destroying entire systems.” He develops a theory of systemic risks based on the nature of complex systems observed in physics and chemistry. Lucas does not contend that such systems necessarily apply in the social sphere, but they could bear instructive lessons about systems behavior.
Whereas authors such as Renn et al. (2020) and Schweizer (2021) focus on very-large-scale, transnational systemic risks, others note that certain complex systems can pose major risks to society at smaller scales. Bieber (2018) includes as possible examples road systems and municipal waste treatment systems, and Lucas (2020) includes
the electrical grid, the water supply, or a complex chemical plant, where the agents may be control and generation units with the systemic risk representing the breakdown of the infrastructure as a whole due to the failure of a single component.
Offshore production platforms and drilling rigs are certainly complex systems; thus, they also could be subject to systemic risks if they have the characteristics of systemic risk generally included as inherent in complex systems. In the engineered systems used offshore, the “agents” would include machine components or controls that could fail and lead to a major accident and/or spill. However, it is worth noting that whereas there have been catastrophic offshore failures, they have typically not led to the collapse of other human systems and infrastructures. However, the Macondo blowout and oil spill, the largest in U.S. waters, did result in a 6-month moratorium on deepwater drilling and significantly disrupted the GoM’s fisheries and tourism industries for at least 1 year (Gohlke et al., 2011; Nadeau et al., 2014). The spill also oiled beaches and marshes in five GoM states and deposited sediments on the ocean floor with undetermined long-term ecosystem impacts.
Other Risk Concepts Associated with Complex Systems
Similar analyses of systems failures described above were developed decades ago from studies of disasters and efforts to keep them from happening. James Reason (1997) popularized the development of multiple barriers, or layers of defense, against catastrophic accidents as well as pointing out how organizational complexity itself can lead to such major failures. Charles Perrow (1984) argued that complex, tightly coupled technical systems operated by complex organizations are prone to failure—what he called “normal” accidents. Normal accidents result from the unpredictability of interactions within complex systems and by “tight coupling,” or the degree to which initial failures cascade throughout the system.17Pidgeon (2011) described failures of such systems as “systemic” in his overview of Perrow’s theory following the Macondo well disaster. Partly in reaction to Perrow’s theory of the inevitability of normal accidents, a group of scholars developed a theory of high reliability organizations (HROs) as models for how organizations can avoid catastrophic failures based on behavioral studies of aircraft carrier crews, firefighters, and air traffic controllers (La Porte and Consolini, 1991; Roberts, 1990; Weick et al., 1999).
Perrow’s view that normal accidents are inevitable in complex, tightly coupled systems is viewed as too pessimistic by systems theorists (Marais et al., 2004). Leveson et al. (2009) argued that Perrow’s broad concept of complex system failure might be sound, but his application of his theory is
___________________
17 In a tightly coupled system, the components tend to be interdependent, such that changes in one component can affect others in potentially undesirable ways, whereas in a loosely coupled system components are designed to operate independently, such that a failure of one component does not necessarily affect others.
incorrect on critically important details. For example, Leveson et al. point out that Perrow, as well as HRO scholars, did not properly define or apply the concept of “tightly coupled” as it is used in systems engineering theory. Air traffic control studied by HRO scholars, for example, is deliberately designed as a loosely coupled system, and aircraft carriers are also loosely coupled systems during peacetime (when the HRO analysis of them was done) (Leveson et al., 2009). Moreover, Leveson et al. (2009) argue that Perrow’s and HRO theorists’ assumption that failures of complex systems are initiated by a single precipitating event, such as an individual component failure (as also cited in ideas about systemic risk described above) are not borne out in experience with most major disasters.
In explaining why catastrophic accidents occur, Leveson (2016) proposes a systems approach that focuses on measures to control the risk of identified hazards in design and operations. Safety, she argues, results from organizations that successfully ensure that complex systems are designed correctly with technical and managerial constraints that prevent accidents and then operate these systems within these constraints, including adapting to changes in technologies and processes as they occur. Her system safety approach applies across all safety-critical, complex organizational endeavors, and her focus on controls is similar to the process safety concept that is applied in the petrochemical, chemical, and other industries dealing with hazardous materials. Leveson’s approach, however, is more comprehensive than process safety in that it includes the entire government-industry system of legislation, regulation, design, operation, and ongoing evolution.
Both process and occupational safety apply the hierarchy of controls concept (see Figure 1-2). The first step is to eliminate hazards through design, if possible. If not, the next step is to substitute for the use of a material to create less exposure to a hazard, if possible. The next step is to use engineering controls to isolate people from hazards. Administrative controls focus on creating safe procedures to protect people, and the final step is to provide barriers from the hazard, such as personal protective equipment.
Process safety management during operations can be illustrated using the Bowtie model that is commonly relied on in the offshore industry. This model relies on barriers (engineering or administrative controls) to prevent an incident from happening as well as to prevent releases that occur from escalating into a fire, explosion, or other event, and recovering if a release occurs (IOGP, 2016, p. 8, Figure 2).18 These barriers are managed through an organization’s safety management system, as discussed in more detail in Chapter 2.
___________________
18 See https://www.iogp.org/bookstore/product/standardization-of-barrier-definitions.
SOURCE: Occupational Safety and Health Administration, https://www.osha.gov/safety-management/hazard-prevention.
The Bowtie model has been extended to include organizational, cultural, and regulatory influences on risk management as follows:
Level 1 (L1) analysis describes barriers implemented at the individual, team and immediate hardware level; Level 2 (L2) describes the organizational factors that support level one barriers; Level 3 (L3) describes the cultural and regulatory environment that ensures that the organization implements L2, thereby ensuring the integrity of L1 barriers. (Hudson and Hudson, 2015)
Summary
In arriving at the definitions for systemic risk and systemic risk profile provided earlier in this chapter, the committee views the overall systems at risk offshore as individual platforms rather than collapse of the industry at large (as might be implied from use of systemic risk in international finance). It accepts that consequences of the failures of barriers can have nonlinear effects, cascade though the system, and lead to system collapse, but, as with Leveson (2016), does not accept the view that such collapses occur because of a single precipitating incident. In drawing from the work of Perrow, Leveson, and Kahneman, the committee views offshore systemic risks as involving the interactions among the physical and operational system controls of complex engineered systems and the cognitive biases
of the humans that operate them. In addition, the committee’s definition of systemic risk management accepts the importance of the organizational cultures and management that exist on offshore facilities and the industry standards and regulations that govern them as important contributors to the success or failure of the individuals and organizations managing these risks.
REPORT ORGANIZATION TO ADDRESS THE STATEMENT OF TASK
This chapter has provided (a) the committee’s definitions of systemic risk and systemic risk profile and (b) brief reviews of the offshore industry, offshore safety, the Macondo disaster, and relevant concepts in process safety management. In Chapters 2 and 3, and using the committee’s definitions of systemic risk and systemic risk management, the committee addresses the second item in the SOT:
Assess how various technological, regulatory, environmental, organizational, and process changes have contributed to increasing or decreasing the systemic risks of the offshore oil and gas operations since the release of the report Macondo Well Deepwater Horizon Blowout: Lessons for Improving Offshore Drilling Safety (2012) and other relevant reports. Identify the numerous recommendations made from these post–Deepwater Horizon reports and detail the ones implemented and major ones that were not.
Chapter 2 reviews major changes affecting systemic risk since Macondo, some of which resulted from adoption of recommendations made in the Macondo Well Deepwater Horizon Blowout: Lessons for Improving Offshore Drilling Safety report and other reports reviewed in the chapter.19 It also mentions other changes that resulted from independent industry actions taken in response to Macondo. The chapter highlights the key recommendations made in several major post-Macondo reports and assesses the extent to which these recommendations have been adopted.
Several post-Macondo reports called for a significant improvement in the reporting of near misses and other leading indicators to help guide risk management. In preparation for the committee’s estimate of the industry’s systemic risk profile in Chapter 4, Chapter 3 reviews progress in developing such data. Although genuine progress in data collection has been made, Chapter 3 demonstrates that publicly available data are insufficient for quantitative estimates of the industry’s systemic risk profile.
___________________
19 The major reports reviewed, and their findings and recommendations, are summarized in Appendix A.
Chapter 4 addresses the first item of the committee’s SOT: “Define the current profile of systemic risks of offshore oil and gas operations in the Gulf of Mexico that could lead to disasters.” Given the inadequacies of available data, the chapter explains the judgment-based process on which the committee relied in developing its estimate. In Chapter 4 the committee also compares its estimate of the current systemic risk profile with its estimate of the risk profile at the time of Macondo. This comparison responds to the first sentence of the SOT, which asks the committee to “provide an assessment of the risk profile of offshore oil and gas operations over time.”
Chapter 5 addresses the fourth item of the committee’s SOT: “Consider how the regulatory structure motivates or incentivizes technological, environmental, organizational, and process changes that could decrease the systemic risks of the offshore oil and gas operations.”
The third item of the SOT asks the committee to “Identify critical gaps and prioritize future needs for increased understanding, communication, and management of systemic risks related to the offshore oil and gas industry.” The committee addresses this item through the conclusions it offers in Chapters 2 through 5 and as summarized in the Summary.
Chapter 6 responds to the fifth item of the committee’s SOT: “If appropriate, assess how activities (including workshops and grants) funded by GRP and other funders have contributed to a better understanding and reduction of the systemic risks in offshore oil and gas operations.”
In Chapter 7, the committee offers its observations about how the ongoing energy transition in response to climate change could affect future systemic risks on the OCS.
Chapter 8 provides a summary of the conclusions reached at the end of each chapter.
REFERENCES
API (American Petroleum Institute). 2021. A Look at U.S. Workplace Safety, 2011-2020. https://www.api.org/news-policy-and-issues/safety-and-system-integrity/workplace-safety-report.
Bieber, F. 2018. Addressing the diversity of risks and accounting for systemic risks: Two proposals for improving clarity in philosophical discussions of risk. Ethical Perspectives 25(3):363-390.
BOEMRE (Bureau of Ocean Energy Management, Regulation, and Enforcement). 2011. Report Regarding the Causes of the April 20, 2010 Macondo Well Blowout. U.S. Department of the Interior. https://www.dco.uscg.mil/Portals/9/OCSNCOE/Casualty-Information/DWHMacondo/BOEMRE-Macondo-Well-Blowout-Report-Vol-II.pdf.
CCPS and SPE (Center for Chemical Process Safety and Society of Petroleum Engineers). 2021. Process Safety in Upstream Oil and Gas. American Institute of Chemical Engineers, New York.
Chief Counsel, National Commission on the BP Deepwater Horizon Offshore Oil Spill and Offshore Drilling. 2011. Macondo: The Gulf Oil Disaster, the Chief Counsel’s Report, 2011. Government Printing Office, Washington, DC. https://permanent.fdlp.gov/gpo4390/C21462-407CCRforPrint0.pdf.
Cline, W. R. 1984. International Debt: Systemic Risk and Policy Response (Policy Analyses in International Economics). Peterson Institute for International Economics, Washington, DC.
Cooke, N. J., E. Salas, P. A. Kiekel, and B. Bell. 2004. Advances in measuring team cognition. In Team Cognition: Understanding the Factors that Drive Process and Performance (E. Salas and S. M. Fiore, eds.). American Psychological Association, Washington, DC, pp. 83-106.
CSB (Chemical Safety and Hazard Investigation Board). 2016. Investigative Report: Drilling Rig Explosion and Fire at the Macondo Well, Volumes I-IV. https://www.csb.gov/macondo-blowout-and-explosion.
EIAP (Energy & Industrial Advisory Partners). 2020. The Economic Impacts of the Gulf of Mexico Oil and Natural Gas Industry. National Ocean Industries Association. https://www.noia.org/wp-content/uploads/2020/05/The-Economic-Impacts-of-the-Gulf-of-Mexico-Oil-and-Natural-Gas-Industry-2.pdf.
Endsley, M. R. 1995. Toward a theory of situation awareness in dynamic systems. Human Factors 37(1):32-64.
Endsley, M. R. 2016. Designing for Situation Awareness: An Approach to User-Centered Design. CRC Press, Boca Raton, FL.
Gohlke, J., D. Doke, M. Tipre, M. Leader, and T. Fitzgerald. 2011. A review of seafood safety after the Deepwater Horizon blowout. Environmental Health Perspectives 119(8):1062-1069.
Hudson, P. T. W. 2009. Process indicators: Managing safety by the numbers. Safety Science 47:483-485.
Hudson, P., and T. Hudson. 2015. Integrating cultural and regulatory factors in the bowtie: Moving from hand-waving to rigor. In Ontology Modeling in Physical Asset Integrity Management (V. Ibrahimapour and S. Yacout, eds.). Springer, Cham, pp. 171-198.
Hyne, N. J. 2012. Nontechnical Guide to Petroleum Geology, Exploration, Drilling & Production, 3rd ed. PennWell Corp.
IOGP (International Association of Oil & Gas Producers). 2016. Standardization of Barrier Definitions. Report 544. https://www.iogp.org/bookstore/product/standardization-of-barrier-definitions.
IOGP. 2021. Safety Performance Indicators—2020 Data. https://www.iogp.org/bookstore/product/safety-performance-indicators-2020-data.
Jones, S., and C. Brewer. 2018. Managing process safety at the dynamic front line. SPE Paper 196393-MS presented at the SPE Annual Technical Conference and Exhibition, Dallas, Texas. https://doi.org/10.2118/191693-MS.
Kahneman, D. 2011. Thinking, Fast and Slow. Farrar, Straus and Giroux, New York.
Kaufman, G. G., and K. E. Scott. 2003. What is systemic risk, and do bank regulators retard or contribute to it? Independent Review 7(3):371-391.
La Porte, T., and P. Consolini. 1991. Working in practice but not in theory: Theoretical challenges of high-reliability organizations. Journal of Public Administration Research and Theory 1(1):19-48.
Leveson, N. 2016. Engineering a Safer World: Systems Thinking Applied to Safety. MIT Press, Cambridge, MA.
Leveson, N., N. Dulac, K. Marais, and J. Carroll. 2009. Moving beyond normal accidents and high reliability organizations: A systems approach to safety in complex systems. Organization Studies 30(2-3):227-249.
Lucas, K. 2020. Theory of systemic risks: Insights from physics and chemistry. Risk Analysis 42(9):1935-1944.
Marais, K., N. Dulac, and N. Leveson. 2004. Beyond normal accidents and high reliability organizations: The need for an alternative approach to safety in complex systems. http://sunnyday.mit.edu/papers/hro.pdf.
Mehta, R. K., S. C. Peres, A. E. Shortz, W. Hoyle, M. Lee, G. Saini, H.-C. Chan, and M. W. Pryor. 2018. Operator situation awareness and physiological states during offshore well control scenarios. Journal of Loss Prevention in the Process Industries 55:332-337.
Nadeau, L., M. Kaplan, M. Sands, K. Moore, and C. Goodhue. 2014. Assessing the Impacts of the Deepwater Horizon Oil Spill on Tourism in the Gulf of Mexico Region. BOEM Report 2014-661. U.S. Department of the Interior, Bureau of Ocean Energy Management. https://digital.library.unt.edu/ark:/67531/metadc955576/m2/1/high_res_d/5451.pdf.
NAE and NRC (National Academy of Engineering and National Research Council). 2012. Macondo Well Deepwater Horizon Blowout: Lessons for Improving Offshore Drilling Safety. The National Academies Press, Washington, DC. https://doi.org/10.17226/13273.
NASEM (National Academies of Sciences, Engineering, and Medicine). 2016. TRB Special Report 321: Strengthening the Safety Culture of the Offshore Oil and Gas Industry. The National Academies Press, Washington, DC. https://doi.org/10.17226/23524.
NASEM. 2018. TRB Special Report 324: Designing Safety Regulations for High-Hazard Industries. The National Academies Press, Washington, DC. https://doi.org/10.17226/24907.
NASEM. 2021. TRB Special Report 338: Modernizing the U.S. Offshore Oil and Gas Inspection Program for Increased Agility and Safety Vigilance. The National Academies Press, Washington, DC. https://doi.org/10.17226/26095.
National Commission on the BP Deepwater Horizon Offshore Oil Spill and Offshore Drilling. 2011. Deep Water: The Gulf Oil Disaster and the Future of Offshore Drilling. Government Printing Office, Washington, DC. https://www.govinfo.gov/app/details/GPO-OILCOMMISSION.
OECD (Organisation for Economic Co-operation and Development). 2003. Emerging Risks in the 21st Century: An Agenda for Action. OECD Publishing, Paris.
Peacock, B., R. Schlegel, and R. Dorman. 1983. Dynamic drilling displays. Proceedings of the Human Factors and Ergonomics Society Annual Meeting 27(6):445-448.
Perrow, C. 1984. Normal Accidents: Living with High-Risk Technologies. Basic Books.
Pew, R. W. 2010. Alphonse Chapanis: Pioneer in the application of psychology to engineering design. APS Observer 23(4). https://www.psychologicalscience.org/observer/alphonse-chapanis-pioneer-in-the-application-of-psychology-to-engineering-design.
Pidgeon, N. 2011. In retrospect: Normal accidents. Nature 477:404-405.
Proctor, R. W., and T. Van Zandt 2018. Human Factors in Simple and Complex Systems. CRC Press, Boca Raton, FL.
Reason, J. 1997. Managing the Risk of Organizational Accidents. Routledge, Oxfordshire, England.
Renn, O., M. Laubichler, K. Lucas, W. Kröger, J. Schanze, R. Scholz, and P. Schweizer. 2020. Systemic risks from different perspectives. Risk Analysis 42(9):1902-1920.
Roberts, K. 1990. Managing high reliability organizations. California Management Review 32(4):101-113.
Roberts, R., R. Flin, and J. Cleland. 2015a. “Everything was fine”: An analysis of the drill crew’s situation awareness on Deepwater Horizon. Journal of Loss Prevention in the Process Industries 38:87-100.
Roberts, R., R. Flin, and J. Cleland. 2015b. Staying in the zone: Offshore drillers’ situation awareness. Human Factors 57(4):573-590.
Salas, E., K. A. Wilson, C. S. Burke, and D. C. Wightman. 2006. Does crew resource management training work? An update, an extension, and some critical needs. Human Factors 48(2):392-412.
Schweizer, P.-J. 2021. Systemic risks—Concepts and challenges for risk governance. Journal of Risk Research 24(1):78-93.
Sledge, M. 2019. A near-decade after BP oil spill, now-public payouts run the gamut. Times-Picayune, July 2. https://www.nola.com/news/business/article_872a7ed6-9cf3-11e9-9055-7b30798f21b4.html.
Sneddon, A., K. Mearns, and R. Flin. 2006. Situation awareness and safety in offshore drill crews. Cognition, Technology & Work 8(4):255-267.
SRA (Society for Risk Analysis). 2018. Society for Risk Analysis Glossary. https://www.sra.org/wp-content/uploads/2020/04/SRA-Glossary-FINAL.pdf.
Tversky, A., and D. Kahneman. 1974. Judgment under uncertainty: Heuristics and biases. Science 185(4157):1130.
Weick, K., K. Sutcliffe, and D. Obstfeld. 1999. Organizing for high reliability: Processes of collective mindfulness. In Research in Organizational Behavior (R. I. Sutton and B. M. Staw, eds.). Elsevier Science/JAI Press, pp. 81-123.
ANNEX A
GENERIC STRUCTURE, FEATURES, AND OPERATIONS OF THE OFFSHORE OIL AND GAS SECTOR20
Exploration Drilling
Most offshore oil and gas development—whether in the United States, the North Sea, or other regions of the world—involves a typical series of industry activities: field evaluation and exploratory drilling; design, construction, and installation of the production system; drilling of additional production wells; hydrocarbon extraction and processing operations; and the eventual decommissioning and plugging of wells. The specific methods and technologies used for each activity can differ among regions and among fields. This variability stems from many factors, which are often related to the location, size, and physical properties of the field and to the technologies available at the time of its development. Characteristics such as reservoir attributes, water depth, distance from shore, and marine and weather conditions combine with projected yield, profitability calculations, and hydrocarbon storage and transportation requirements to influence specific technology choices. Despite this heterogeneity, certain elements are common to each offshore oil and gas activity. For example, exploratory drilling may be undertaken from several kinds of floating or bottom-supported rigs, with rig choice depending on site-specific factors such as water depth. However, the basic steps involved in drilling and completing a well are generic to most offshore fields. The drilling phase usually begins with the hammering of a tube, called a conductor, into the seafloor. A drill bit connected to drill pipe is then lowered into the conductor. As the borehole is excavated, drilling fluids, called “mud,” are pumped at high pressure down the drill pipe. The hydrostatic pressure from the mud keeps formation fluids from entering the borehole. At specific intervals, drilling is suspended while the borehole is lined with more tubes, called casings, and cement is pumped to seal the space between the outside of the casing and formation rock. Several casing strings may be added, one inside the end of the other, until the reservoir is reached. After the first casing string is cemented, a large valve called a blowout preventer is installed at the casing head. Pressure in the mud column is monitored, and heavier fluids are pumped into the borehole during drilling to keep out formation fluids that could cause a blowout that risks explosions, fires, and discharges into the sea. When this drilling work is complete and the wells are properly lined, sealed, and temporarily plugged, the mobile drilling unit moves to other sites while the production system is designed and installed.
___________________
20 Much of this text is from NASEM (2018, pp. 59-60). See also Hyne (2012).
Production Facilities
Production activities likewise involve many site-specific methods and technologies but also have many generic features. A production platform, or a man-made island with production equipment, is usually located above or near the well. Some processes take place on the platform or on ancillary facilities, sometimes including the separation and processing of the oil and natural gas, treatment and disposal of extracted water and gases, and storage of the extracted product before it is exported by underwater pipeline or shuttle tanker. The specific design and configuration of the production installation depend on considerations such as water depth, marine and weather conditions, expected recovery volumes, distance from shore, and the need for oil and gas storage. Nevertheless, most production platforms have common features, such as gas compression, power generation, and piping systems. Most of the larger platforms have rooms and catering facilities for crews, as well as maintenance shops, warehouses, and laboratories. Larger platforms have facilities to accommodate any necessary supporting vessels and activities, along with helipads for the air transport of crews and supplies. Nearly all have systems for monitoring and controlling critical equipment such as heat exchangers, pumps, generators, and compressors, as well as sensors, alarms, and automatic shutdown systems. To protect workers, the facilities have firefighting and lifesaving equipment. All offshore projects face the challenge of ensuring the safety of operations that take place in a physically constrained space; often in harsh environmental conditions; and with a constant risk from volatile hydrocarbon mixes being extracted, processed, and stored under high pressure. Advances in drilling, production, and safety technologies during the past half century have helped the industry meet this challenge. These advances have allowed the development of fields that are more remote, in deeper waters, and in harsher environments such as the Arctic. As the depth of wells and production volumes have increased, installations have tended to become larger, more complex, and costlier. The increasing cost and complexity of drilling and production have in turn led to more specialization among companies supplying the needed services and technologies and thereby have added to organizational complexity and the need to coordinate decisions, diverse workforces, and communications engaged with drilling and production operations.
ANNEX B
MAIN CONCLUSIONS DRAWN ABOUT PRINCIPAL CAUSES OF 2010 MACONDO BLOWOUT FROM THREE MAJOR INDEPENDENT INVESTIGATIONS
| Independent Reports | Principal Causes of Blowout | ||
|---|---|---|---|
| Physical | Organizational | Regulatory | |
| Chief Counsel, National Commission (2011) |
Cement plug failed during temporary abandonment for a variety of reasons (2011, p. 12 of PDF).
BP temporary abandonment plan underbalanced the well. Transocean and Sperry missed signals that hydrocarbons had entered the well in the hour before explosion. Actions to shut in well came too late to avoid explosion but might have mitigated scale of spill. See p. 36 for more detailed summary of findings. |
All technical failures trace back to management errors (2011, pp. 12-13). BP did not appreciate risks of Macondo or effectively supervise contractors (who did not deliver quality). BP personnel were not properly trained or supported. (See more on p. 13.)
BP misinterpreted negative pressure tests (influenced by implausible theory from Transocean crew). BP guidance on temporary abandonment arrived at the last minute and was vague. Time-saving efforts compromised safety. Halliburton did not oversee cement job effectively and missed signals about risk of failure. Transocean did not adequately train personnel in kick detection and response or inform them of lessons from recent similar events. |
MMS regulatory structure was inadequate to task of overseeing well like Macondo (2011, p. 13). Then-applicable regulations had little relevance to technical and management problems that led to the blowout. Regulators did not have training or experience to adequately evaluate risk of the project. |
| Men and women on Deepwater Horizon lacked a culture of single-minded determination to ask questions and pursue advice until certain of proper actions. | |||
| NAE and NRC (2012, pp. 6-7) |
Cement bottom-hole plug failed.
Staff misinterpreted negative pressure test. Flow of hydrocarbons began when mud was displaced by seawater. Efforts to use BOP to seal well failed and could not disconnect the riser. |
Actions during temporary abandonment did not display adequate system safety approach.
Lack of strong safety culture was displayed by multiple flawed decisions. Management failed to appreciate or plan for a well as complex as Macondo. Margins of safety were compromised by the division of expertise and responsibilities of the contractors involved. Flow of hydrocarbons was undetected for 50 minutes. Training for deepwater wells was inadequate. |
Regulatory regime was ineffective in overseeing Macondo well. Regulators were not aware of the very narrow margins of safety. |
| Use of real-time data analysis, data on precursor or near misses, or lessons learned from similar situations to adjust standards and practices was ineffective. | |||
| Independent Reports | Principal Causes of Blowout | ||
|---|---|---|---|
| Physical | Organizational | Regulatory | |
| Chemical Safety Board (CSB, 2016) |
See Executive Summary, p. 6. Bottom-hole cement plug failed during temporary abandonment. Drilling mud was displaced, thinking plug was set. BOP then was the only remaining barrier. Hydrocarbons flowed past the plug for almost an hour without being detected. They exploded onto the rig floor within 2 to 3 minutes of getting into the riser 1 mile below the rig. Human use of BOP to close well may not have avoided blowout but could have mitigated the scope of the disaster (2016, p. 6). |
See pp. 14-15. BP and Transocean personnel misinterpreted test results. The designed process for human intervention to close well with BOP once hydrocarbons were detected was too complex to complete quickly even had rising pressure been detected. No effective testing of the redundant emergency failsafe systems was in use. Elements of the BOP redundant power sources were miswired, but this flaw was not detected. Use of drill pipe during phases of the drilling exceeded the capability of the BOP to shear the pipe. Lack of incorporation of human factors in planning and executing temporary abandonment increased the likelihood of blowout. Transocean had experienced two similar riser unloading events. BP had had several major disasters in preceding years. Offshore drilling always involves a degree of difference between WAI and WAD. Neither Transocean nor BP bridged the gap between WAI and WAD in guidance around TAP. Neither Transocean nor BP enforced their own corporate policies for assessing risks of TAP. Multiple parties involved in drilling led to flawed communication and decision making. |
See pp. 17-23. There was no requirement for as low as reasonably practicable or regulatory review to ensure that operators were meeting it. No safety management system program was required pre-Macondo. No regulatory requirements existed for companies to assess safety culture and carry out corrective action plan when deficiencies were noted. BSEE did not use data about reportable incidents (fires, kicks) to drive safety performance. |
| Explosion should have triggered automatic disconnect shearing of the riser but did not (2016, p. 7). |
Drillers fell prey to cognitive biases in accepting the anomalous tests following cementing.
Drillers were not trained enough in nontechnical skills to question the process or communicate concerns they may have had. Both Transocean and BP were overly focused on occupational safety with inadequate focus on process safety. Failures of cement plugs were well known by the companies involved, but the TAP was not predicated on the assumption that the plug would fail and the risk of having only one barrier (the BOP) when mud was displaced. BP Board of Directors governance was inadequate regarding avoiding process safety risks. |
No provisions existed for BSEE to require contractors to follow rules, and doing so remains ambiguous post-Macondo.
BSEE has BAST requirement per OCSLA, but mandating BAST beyond existing rules requires passing a high bar—a cost–benefit test. Several regulatory reforms and improved consensus standards were put in place post-Macondo, but many gaps remain (see Chapter 2). |
NOTE: BAST = best available and safest technologies; BOP = blowout preventer; BSEE = Bureau of Safety and Environmental Enforcement; OCSLA = Outer Continental Shelf Lands Act; TAP = temporary abandonment plan; WAD = work as done; WAI = work as imagined.
This page intentionally left blank.
