This chapter assesses the extent to which the actions, policies, and procedures of corporations involved in the Macondo well–Deepwater Horizon incident failed to provide an effective system safety approach commensurate with the risks of drilling the well. The chapter also assesses the education, training, and certification of key personnel and the extent of industrywide learning from past incidents. Finally, the chapter provides recommendations for improving various aspects of industry management.
Offshore drilling in the United States is currently carried out through an aggregation of drilling contractors, service companies, and consultants brought together by an operating company, which is the company designated to conduct the operations of the well. Deepwater operations are some of the most complex and most risky ventures conducted by commercial enterprises. This is particularly true in regions, such as the Gulf of Mexico, where wells are drilled in water depths of up to 10,000 feet, drilling depths can exceed 20,000 feet, and geologic formation pressures can exceed 20,000 pounds per square inch. Many of the formations are prolific and can produce thousands of barrels of oil and millions of cubic feet of gas per day. As with other complex industrial systems, the safe and efficient functioning of offshore drilling operations depends on the culture of the organizations involved, which includes interactions among human, organizational, and technological subsystems (Meshkati 1995).
Each organization and person involved in offshore drilling operations is expected to maintain a strong focus on safety. Many operating companies adhere to a rigorous safety checklist and in many cases perform safety audits of their contractors, service companies, and others. However, over the course of time, offshore accidents occur that are attributable to the lack of one or several elements of an integrated safety management system or to a lack of diligence in executing those elements that are part of the contractor’s systems.
The aspect of safety management addressing hazards that lead to accidents on the scale of one or a few workers, such as slipping and falling or injuries that occur during a crane-lifting activity, is commonly termed occupational safety (also referred to as personal safety or worker safety). In contrast, other offshore drilling hazards can lead to accidents on a much larger scale, potentially involving multiple fatalities, substantial property loss, and extensive environmental damage. Hazards that can cause catastrophic effects are within the realm of system safety.1 This term refers to an engineering and management approach used to ensure that safety is built into a system with the objective of preventing or significantly reducing the likelihood of a potential accident. [See Rasmussen (1997), Rasmussen and Svedung (2000), and Leveson (2011) for additional discussion of system safety.]
The Ocean Ranger mobile offshore drilling unit (MODU) incident in 1982 involved a failed ballast control system and a ballast control operator who was not properly trained to respond to this particular event (Hickman 1984). The MODU sank and all personnel were lost—most, if not all, because of the harsh cold conditions. Industry’s response to the Ocean Ranger disaster resulted in a major shift in ballast control training and the introduction of simulators to train ballast control operators. The disaster also led the offshore industry to improve the training of rig personnel in survival skills and the procedures for abandonment of a drilling vessel. Those efforts encouraged the worldwide development of survival schools. Industry’s response to the event also demonstrated the need for a preemptive overall safety strategy. Even though the Ocean Ranger disaster was not a well blowout event, it demonstrated the importance of understanding the ramifications of the total system safety of an offshore operation.
Another example is provided by the Piper Alpha platform disaster, which occurred in the North Sea in 1988. A gas leak resulting from a faulty maintenance operation ignited and exploded on the platform, causing a large-scale fire and a disaster that resulted in 167 deaths. The incident showed what damage could occur essentially from an accumulation of management errors (Cullen 1990; Paté-Cornell 1993); it became a turning point in the way industry addressed the safety of its offshore operations. Furthermore, the U.K. government changed the way it regulated the offshore oil and gas industry by moving to a performance-based form of regulation, sometimes referred to as a safety case approach (see Chapter 6).
Although a company’s fundamental approach to safety can affect both occupational and system safety, an effective occupational safety program will not necessarily be indicative of an effective approach for managing system safety. Larger-scale accidents can arise from many different causes that are mostly unrelated to the factors targeted by occupational safety programs. However, an effective system safety program can result in reduced injuries and save lives (CCPS 1992). Therefore, both types of safety are of value to workers. Given the
1 In some industries (e.g., chemical) the term is also referred to as process safety.
charge to the committee, this chapter and the following one focus on system safety.
The steps taken by the nuclear power and other safety-critical industries to improve system safety are reminiscent of the challenges presently confronting the offshore drilling industry. Although there are significant differences between the oil and gas industry and other industries (as discussed in this chapter), the safety framework and perspectives developed by those other industries can provide useful insights. According to the Swedish Radiation Safety Authority, an organization has good potential for safety when it has developed a safety culture that shows a willingness and an ability to understand risks and manage activities so that safety is taken into account (Oedewald et al. 2011). Other industries, regulatory agencies, trade associations, and professional associations have also addressed safety culture (for example, see Reason 1997; U.S. NRC 2009, 2011; NEI 2009; CCPS 2005; IAEA 1992).
The U.K. Health and Safety Executive defines safety culture as “the product of individual group values, attitudes and perceptions, competencies and patterns of behavior that determine the commitment to, and the style and proficiency of, an organization’s health and safety management.” Creating safety culture means instilling attitudes and procedures in individuals and organizations ensuring that safety issues are treated as high priority, too. A facility fostering strong safety culture would encourage employees to cultivate a questioning attitude and a rigorous and prudent approach to all aspects of their jobs and to set up necessary open communication between line workers and middle and upper management (Meshkati 1999).
An effective safety culture embodies the following generic traits:2
• Leadership safety values and actions: Safety is treated as a complex and systemic phenomenon. It is also a genuine value that is reflected in the decision making and daily activities of an organization in managing risks and preventing accidents.
• Personal accountability: All individuals take personal responsibility for safety and contribute to overall safety.
• Problem identification and resolution: Issues potentially affecting safety are readily identified, fully evaluated, and promptly addressed and corrected.
• Work processes: The process of planning and controlling work activities is implemented so that system safety is maintained. The most serious safety issues get the greatest attention.
2 The traits are adapted from the U.S. Nuclear Regulatory Commission Safety Culture Policy Statement (U.S. NRC 2011).
• Continuous learning: Opportunities to learn about ways to ensure safety are sought out and implemented by organizations and personnel. Hazards, procedures, and job responsibilities are thoroughly understood. Safety culture strives to be flexible and adjustable so that personnel are able to identify and react appropriately to various indications of hazard.
• Environment for raising concerns: A safety-conscious work environment is maintained, where personnel feel free to raise safety concerns without fear of retaliation, intimidation, harassment, or discrimination. They perceive their reporting as being meaningful to their organizations and thus avoid underreporting.
• Effective safety communication: Communications maintain a focus on safety. Knowledge and experience are shared across organizational boundaries, especially when different companies are involved in various phases of the same project. Knowledge and experience are also shared vertically within an organization.
• Respectful work environment: Trust and respect permeate the organization.
• Questioning attitude: Individuals avoid complacency and continuously challenge existing conditions and activities to identify discrepancies that might result in unsafe conditions. A subordinate does not hesitate to question a supervisor, and a contractor employee does not hesitate to question an employee of an operating company.
Investigations of several large-scale accidents in recent years provide clear illustrations of the consequences of a deficient safety culture. A collision of two trains of the Washington Metropolitan Area Transit Authority (WMATA) Metrorail that occurred in June 2009 resulted in nine deaths and multiple passenger injuries. The National Transportation Safety Board found that WMATA failed to implement many significant attributes of a sound safety program (NTSB 2010). As another example, explosions and fires at the BP Texas City Refinery in March 2005 killed 15 people and injured 180 others. The U.S. Chemical Safety and Hazard Investigation Board concluded that the disaster was caused by organizational and safety deficiencies at all levels of the BP Corporation (CSB 2007). These accidents underscore the importance of organizations being proactive and appropriately focused on system safety.
Technically complex organizations that are designed and managed to operate safely in environments where a system failure can result in a catastrophic accident are referred to as high-reliability organizations (HROs) (Roberts and Rousseau 1989; Weick and Sutcliffe 2001; Carnes 2011). HROs repeatedly accomplish their missions while avoiding catastrophic events despite significant hazards, dynamic tasks, time constraints, and complex technologies (Hartley et
al. 2008). Personnel training is usually provided in a team setting and is facilitated through simulators to provide realism and improve the team’s work process and ability to handle unexpected occurrences.
HROs are involved in the design, testing, operation, and maintenance of nuclear power plants, air traffic control systems, military submarines, and other systems. In a study of the U.S. Navy nuclear submarine fleet, Bierly and Spender (1995) concluded that “the nuclear submarine illustrates how culture, as a higher level system of knowledge and experience, can interact with and support a bureaucracy to transform a high risk system into a high reliability system.”
HROs often rely on risk assessment to inform their decision-making and planning processes for carrying out operations. The two key elements of risk in this context are the likelihood of a catastrophic system failure occurring and the consequences of such an occurrence. According to Bea et al. (2009), proper problem definition for risk analysis of complex systems considers all the variables of a system including psychological, social, organizational, and political processes as well as technological and engineering practices. Probabilistic risk assessment can be used to assess safety within a complex technologic organization by relating failure probability to performance within various aspects of the organization (Paté-Cornell 1990).
When business considerations (e.g., cost and schedule) come in conflict with minimizing risk, a disciplined approach is needed to weigh process effectiveness against the level of risk for an upcoming action or series of actions. A sound safety culture ensures that the organization can address conflicting objectives without compromising system safety and can keep the likelihood of a system failure as low as practicable (see Chapter 6). In its publication HSE and Culture (PSA 2004), the Petroleum Safety Authority of Norway provides petroleum exploration and production companies with a set of useful questions that guide a company in dealing with conflicting objectives:
• Are conflicting objectives discussed in a specific and constructive manner?
• Have clear, realistic, and accepted criteria been established for the way operational personnel should deal with normal conflicts between objectives?
• Are procedures and job descriptions adjusted to ensure a balance between safety and efficient performance of the work?
• Who decides the procedures? Do operational personnel participate in maintaining procedures and job descriptions?
• Is HSE monitored on a par with production, quality, and economics?
System Safety in Offshore Drilling Operations
Over the past 20 years, an offshore industry has evolved to meet the technical challenge of discovering and producing oil and gas under hostile conditions. Land-based drilling operations have been standardized to a great extent over the past 50 years because well control equipment placed on site is accessible and there is substantial capacity for rapid escape from an out-of-control well. However, the complexity and unique nature of offshore drilling did not develop similarly robust standardized operations commensurate with the risks involved. Offshore drilling in deeper water incorporates the complexity of controlling subsea blowout preventer (BOP) systems that must withstand the hostile environment of water depths of up to 10,000 feet, as well as control systems, seals, connectors, and valves that all must function flawlessly, with minimal need for preventive maintenance, for the BOP to work properly. In addition, a riser system that is used to connect the rig’s circulation system to the well and carry the choke and kill lines necessary for well operation must perform reliably.
Sophisticated firmware3 and software provide much of the control functionality. To maintain their position over the well, MODUs increasingly rely on dynamic positioning by using multiple thrusters that are computer controlled. In the event of thruster failures or power outages and blackout, each rig has an automated disconnect system that, on manual initiation by rig personnel, is designed to release the MODU from the well. The sequence of actions to activate the subsea BOP system, shear the drill pipe, shut in the well, and release the riser from the BOP involves commands and functionality that are highly automated and complex (see Chapter 3). However, the BOP and its components are rarely, if ever, field-tested as a full system because of logistical difficulties, concerns about degradation of future performance capabilities, the expense associated with conducting such a system test, and lack of a regulatory requirement. Instead, tests of individual components of the BOP technology, riser, and riser disconnect are assumed to constitute effective tests of the entire system.
In addition, the drilling equipment is highly automated, with a sophisticated system for mud circulation, heave compensation, top drives, automated pipe-handling equipment, and sensors positioned on most of the equipment to detect rig activities and sense hydrocarbons.
Well operations typically include personnel from multiple contractors involved in monitoring and operating the complex system. There are drilling contractor personnel (some of whom may be subcontractors or consultants) and support service personnel for running casing, cementing, maintaining the drilling fluids, and monitoring the downhole progress of the drilling operation. In addition, there are specialty contractors for logging, running wellheads, directing remotely operated vehicles, and conducting a plethora of other services and activities. The drilling contractor—focused on running the MODU, the subsea operation, and drilling equipment—relies on the operating company to provide
3 Firmware is fixed software used to control electronic devices.
the basic well plan, which includes formations to be drilled, mud weights needed, and casing string and cementing designs. The operator relies on suppliers, and in many cases consultants, to design the casing strings and on other companies to design the cementing composition and the procedures for cementing the casing. In general, the running of the MODU and the downhole activities is complex, and certain activities are often implemented separately from the others. Furthermore, the committee has observed from presentations made by industry representatives4 that the level of safety training, experience, and knowledge of the overall operation for drilling the well tends to be uneven for personnel of operating companies and their contractors. However, as the entity that created and oversees the plan for the well, the operating company holds the overall decision-making responsibility.
A fundamental aspect that should be common to all companies is effective system safety that embodies the safety culture traits discussed earlier in this chapter. Despite the complexity of deepwater offshore drilling, the committee has observed from presentations made by industry representatives (as mentioned above) that the parties involved tend not to exhibit an overall systems approach for addressing the multiple interacting safety issues involved in the subsea, MODU, and drilling activities. One indication of the lack of appreciation for an overall system safety view is the limited level of system safety training provided by the operators and contractors. Although differences among various types of industries and other organizations do not allow for exact comparisons, the extent of system safety training provided by the oil and gas industry appears to be modest compared with that provided by the military, nuclear power, and aerospace industries, which also face complex challenges and hazardous conditions.
The offshore industry evolved over the past 20 years. During that period, significant industry change occurred. Some exploration and production (E&P) companies merged and consolidated (see Figure 5-1), sometimes divesting their research and development (R&D) capacity and delegating many of the responsibilities and shedding expertise they once held. Some E&P companies that previously had in-house capacities to design a complete well plan and supervise the various operations became more reliant on third-party service companies and consultants to take over those key roles. Some companies have in-house cementing expertise and many do not. Some companies train and develop their supervising personnel, and some companies hire consultants to provide this service. Although relying on outside expertise to deal with the increasing complexity of offshore drilling may be more cost-effective, doing so tends to reduce the level of consistency across the industry with regard to who does the well planning,
4 Members heard presentations from industry representatives during various committee meetings held over the course of this study. In addition, committee members heard presentations from industry representatives at meetings of the Marine Board of Investigation, the National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling, and the U.S. Chemical Safety Board.
FIGURE 5-1 Selected major petroleum mergers (1996-2002). Source: GAO 2004, p. 37.
what a well plan should be, what type of experience is required for complex deepwater operations, and who monitors and is responsible for the overall integrity of the well.
In essence, the offshore industry is fragmented into a large number of service providers and independent agents with specific roles for drilling offshore wells. This arrangement tends not to allow for recognition of the system-level challenges of handling a multitude of service providers, often with different goals, safety practices, experience levels, and training. This functional diversity among team members may lead to differences in interpretations of what is needed for a team to be successful (Cronin and Weingart 2007). Also, regulators in the United States did not keep up with the technological advances made by the operating companies in dealing with the complexity of deepwater operations (see Chapter 6). Hence, the checks and balances supposedly provided by the regulators did not evolve in proportion to the complexity of offshore operations.
The multiple companies involved in drilling the Macondo well exhibited the complex structure of the offshore oil and gas industry and the division of technical expertise among the contractors engaged in the drilling effort. BP, an E&P company, leased Mississippi Canyon Block 252 in 2008 for oil and gas
exploration.5 BP later sold interests in the lease to Anadarko Petroleum, an independent exploration company (25 percent share) and MOEX, a subsidiary of Mitsui Oil Exploration (10 percent share). BP was the majority owner of the lease (65 percent share). As the operator, BP designed the well and specified how it was to be drilled, cased, completed, and temporarily abandoned. BP employed various contractors to perform the work of drilling and constructing the well. BP’s well site leaders were the personnel on the Deepwater Horizon rig who supervised operations and coordinated the activities of contractors.
Transocean, a contractor of offshore drilling rigs, was hired by BP to perform services for the Deepwater Horizon rig. As part of this arrangement, Transocean provided personnel for drilling, marine operations, and maintenance. Transocean supervisory personnel included the offshore installation manager (OIM), who coordinated rig operations with BP’s well site leaders and managed the Transocean crew; the master, who was responsible for all marine operations when the rig traveled from one location to another; and a senior tool pusher, who supervised the tool pushers, who in turn coordinated drilling operations carried out by the drillers and assistant drillers.
Other contractors and manufacturers involved in the Macondo well included the following:
• Cameron, a manufacturer of well drilling equipment and well construction components, manufactured the Deepwater Horizon’s BOP.
• Dril-Quip, a manufacturer of components used in the construction of oil wells, manufactured the wellhead assembly used at the Macondo well, including the casing hanger, seal assembly, and lockdown sleeve components.
• Halliburton is an oil field service provider. BP contracted with Halliburton to provide cementing services and related expertise. Halliburton designed and pumped the cement for the casing strings in the well.
• M-I SWACO is a subsidiary of Schlumberger. BP contracted with M-I SWACO to provide specialized drilling mud and mud engineering services on the Deepwater Horizon; its personnel operated the rig’s mud system.
• Schlumberger is a provider of a variety of oil field services. BP contracted with Schlumberger to deliver specialized well and cement logging services on the Deepwater Horizon. Schlumberger provided well logging services used in the evaluation of the well.
• Sperry Sun is a subsidiary of Halliburton. BP contracted with Sperry Sun to install a well monitoring system on the Deepwater Horizon. Sperry provided mud loggers to monitor and interpret the data it generated.
• Weatherford is a manufacturer of well construction components. BP contracted with Weatherford to provide casing accessories, including centralizers, the float collar, and the shoe track on the Deepwater Horizon. Weatherford
5 See Chief Counsel (2011) for additional information on the roles of companies involved in drilling the Macondo well.
also provided personnel to advise on the installation and operation of its equipment.
As discussed in Chapters 2, 3, and 4, the Macondo well-Deepwater Horizon event was precipitated by multiple flawed decisions, leading to an uncontrolled blowout that caused loss of life, injuries, and severe negative public and environmental impacts. Involved in those decisions were the operator, drilling contractor, and service companies.6 The complex interaction of the corporations and government agencies was not managed at a systemic level to anticipate the possible safety shortfalls that ultimately led to the well blowout. This was evidenced by a substantial number of decisions and actions that are inconsistent with the characteristics of a robust safety culture and HRO discussed earlier in the chapter:
• While the geologic conditions encountered in the Macondo well posed challenges to the drilling team, alternative completion techniques and operational processes were available that could have been utilized to prepare the well for temporary abandonment safely (see Chapter 2).
• The design and execution of a cementing program were flawed (see Chapter 2).
• The execution and interpretation of the negative pressure test of the well were flawed. The test was deemed a success even though the pressure buildup actually meant that the test had failed (see Chapter 2).
• No cement bond log was run to investigate the condition of the cement. The well design placed the float collar above the bottom of the deepest reservoir and would have prevented the log from investigating the lower sections of the well in which cement had been pumped (see Chapter 2).
• Evidence available prior to the blowout indicated that the flapper valves in the float collar probably failed to seal, but this evidence was not acted on at the time (see Chapter 2).
• The approach chosen for well completion failed to provide adequate margins of safety and led to multiple potential failure mechanisms. Drilling mud was replaced with seawater, and the annular preventer in the BOP was opened on the assumption that the well was under control (see Chapter 2).
• The crew did not recognize the signs of the impending blowout in time to take the appropriate action. Several signs were missed that should have indicated to the crew that hydrocarbons from the reservoir were flowing into the well (see Chapter 3).
6 As mentioned in the preface, this report does not attempt to assign responsibility for the incident to specific individuals or corporations, nor does it attempt to make a systematic assessment of the extent to which the parties involved complied with applicable regulations.
• The BOP system was neither designed nor tested for the dynamic conditions that most likely existed at the time that attempts were made to recapture well control. Furthermore, the design, test, operation, and maintenance of the BOP system were not consistent with a high-reliability, fail-safe device (see Chapter 3).
• The decision was made to defer maintenance on the annular preventers of the BOP following the March 8th “well control event” (see Chapter 3).
• The rig crew was ill prepared for the scale of this disaster. Alarm and indication systems, procedures, and training were insufficient to ensure timely and effective actions to prevent the explosions or respond to save the rig (see Chapter 4).
• Confusion existed about decision authority and command. Uncertainty as to whether the rig was under way or moored to the wellhead contributed to the confusion on the bridge and may have impaired timely disconnect (see Chapter 4).
• Once the fire started on the rig, it took more than 7 minutes until an attempt was made to activate the emergency disconnect system, which should have closed the blind shear ram and disconnected the lower marine riser package (see Chapter 3).
Previous reports have evaluated the performance of the companies involved in the Macondo well-Deepwater Horizon incident (BOEMRE 2011; Chief Counsel 2011; DHSG 2011; Presidential Commission 2011; USCG 2011). The reports have found that technical failures, such as those discussed in this report, can be traced back to management processes that did not provide adequate controls over the uncertainties of human decision making, particularly given the potential consequences as evidenced by the Macondo blowout. Management processes failed to adequately identify and mitigate risks created by operational decisions before the blowout, communicate critical information, train key engineering and rig personnel, and ensure that measures taken to save time and reduce costs did not adversely affect overall risk. A substantial compilation and discussion of witness testimony, written communications, and other information concerning management performance are presented in those reports. While the available evidence does not indicate a specific circumstance in which an explicit decision was made to accept risk to save costs, the committee notes that such trades are an inherent part of drilling operations and that processes to evaluate such trades properly are essential.
The committee’s findings presented in this report and the findings of other related reports indicate that industrial management involved with drilling the Macondo well had not adequately understood and coped with the system safety challenges presented by offshore drilling operations. This raises questions concerning industry’s overall safety preparedness, the ability to handle the complexities of deepwater operations, industry oversight to approve and monitor well plans and operational practices, and personnel competency and training.
Questions have also been raised as to whether a process is in place to give adequate consideration to the overall risks associated with drilling a Macondo-type well in the Gulf of Mexico.
Summary Finding 5.1: The actions, policies, and procedures of the corporations involved did not provide an effective system safety approach commensurate with the risks of the Macondo well. The lack of a strong safety culture resulting from a deficient overall systems approach to safety is evident in the multiple flawed decisions that led to the blowout. Industrial management involved with the Macondo well–Deepwater Horizon disaster failed to appreciate or plan for the safety challenges presented by the Macondo well.
Summary Observation 5.1: The ability of the oil and gas industry to perform and maintain an integrated assessment of the margins of safety for a complex well like Macondo is impacted by the complex structure of the offshore oil and gas industry and the divisions of technical expertise among the many contractors engaged in the drilling effort.
Observation 5.2: Processes within the oil and gas industry to assess adequately the integrated risks associated with drilling a deepwater well, such as Macondo, are currently lacking.
Observation 5.3: As offshore drilling extends into deeper water, its complexity increases. However, in-house technical capabilities within many operating companies for well drilling operations have diminished in favor of reliance on multiple contractors. This, in turn, diminishes the capacity of operations companies (the “operator”) to assess and integrate the multiplicity of factors potentially affecting the safety of the well.
Observation 5.4: The operating leaseholder company is the only entity involved in offshore drilling that is positioned to manage the overall system safety of well drilling and rig operations.
The rapid evolution of deepwater drilling operations has challenged management of E&P companies to have in-house expertise in the complexities, risk, and system safety of deepwater operations and with monitoring capabilities for supporting the decision-making levels in a timely manner.
The operating company is typically recognized as the party responsible for the drilling and production of a well.7,8 This is a long-term practice of leaseholders and, through a formal contract, all owners of the lease agree to authorize one of them as being the operator. The responsibility of the designated operator is to conduct a safe operation. This responsibility requires that the operator have the capacity to understand the complexities of the system safety issues and the ability to integrate these issues into coherent and executable operations.
Education, Training, and Certification of Personnel Involved with Offshore Drilling
During the mergers and consolidations in the 1990s, E&P companies saw that the service sector and contractors could provide much of the required expertise and that the companies could downsize their technical staffs and R&D organizations. This change in philosophy by the operating companies had the effect of converting experienced and trained personnel into outside consultants working for service and contracting companies. In essence, much of the in-house expertise was transferred out of the E&P companies, which made the standardization and easy coordination of safety and operational training almost impossible.
As the E&P industry moved toward greater reliance on contractors, consultants, and service company support, a major challenge arose for operators: assessing the experience levels, training, and ability of the personnel to execute an integrated safety program for an offshore drilling operation.
Training requirements, including those for well control, vary among companies. While many companies outsourced all of their training, others attempted to provide in-house well control training.
Because contractor personnel control subsea systems, they have become the implementers of well control. However, knowledge of geological conditions and well architecture resides in the operating companies. Such a divergence presents the need for team integration, but rig crews tend not to be trained as a team for activities such as well control, subsea problem solving, and other safety issues. Team exercises for emergencies tend to consist mainly of periodic drills to muster at lifeboat stations, which leaves much uncertainty as to how the crew will respond in an emergency.
Also, there is a need to educate technical and managerial personnel in system risk assessment and management. In its accident investigation report, BP indicated that “a formal risk assessment might have enabled the BP Macondo well team to identify further mitigation options to address risks” with respect to
7 Report of the Society of Petroleum Engineers Gulf of Mexico Deepwater Drilling and Completions Advisory Summit to NAE/NRC Committee, March 2011, http://www.spe.org/industry/docs/SPESpillSummit.pdf. Most recently accessed Jan. 17, 2012.
8 Responses of International Association of Drilling Contractors to questions from the committee, March 2011.
cementing the well during the temporary abandonment process (BP 2010, 34). More broadly, no evidence was found to indicate that any of the critical operational decisions made while drilling the Macondo well were subjected to a formal risk assessment process (BOEMRE 2011; Presidential Commission 2011).
Summary Observation 5.5: The extent of industry training of key personnel and decision makers has been inconsistent with the complexities and risks of deepwater drilling.
Observation 5.6: There are too few standardized requirements across companies for education, training, and certification of personnel involved in deepwater drilling.
Gathering and disseminating near-miss information can play an important role in avoiding accidents. Worldwide, governments have different requirements for recording and retaining drilling information, including near-miss well-control incidents. Current and past efforts in the United States to collect and disseminate relevant data on well drilling generally rely on the mandatory reporting of accidents resulting in pollution events, injuries, or fatalities. There is no program analogous to the Aviation Safety Reporting System (ASRS) in U.S. civil aviation, which allows airline pilots and other crew members to provide near-miss information on a confidential basis. ASRS, which is based on voluntary reporting and is administered by the National Aeronautics and Space Administration, analyzes the information and makes it available to the public and across the aviation industry for educational purposes to lessen the likelihood of aviation incidents and accidents.
For years, companies and contractors in the oil and gas industry have collected drilling data on all offshore wells. Information on kicks, well pressures, and other aspects of wells is included. Shell, Statoil, and several other companies have developed real-time drilling monitoring centers to collect that information, and on-shore personnel oversee the data streams. The sophistication of these centers varies, and how the data are used differs from company to company. However, many offshore operations do not have real-time monitoring centers.
In a report from the Society of Petroleum Engineers, members indicated that the drilling industry is generally not willing to “publicly share information about all errors, omissions, and questionable results because of the potential for liability, legal partner issues, competitive pressures, and unpredictability of court
rulings and public interpretation”.9 According to members of the International Association of Drilling Contractors, so long as legal liabilities exist, it is unlikely that efforts to share near-miss information across companies will be fruitful.10
Summary Observation 5.7: Overall, the companies involved have not made effective use of real-time data analysis, information on precursor incidents or near misses, or lessons learned in the Gulf of Mexico and worldwide to adjust practices and standards appropriately.
Research and Development
For decades, a significant majority of R&D investments were made by individual oil and gas companies. However, about 20 years ago, as deepwater exploration and development was evolving into a major activity in the Gulf of Mexico, many companies were reducing R&D spending (NPC 2006). The move to outsource R&D in general had begun. The research that was being carried out had more to do with facilities and deepwater exploration, drilling, and production technologies than with system safety. R&D focused on system safety includes aspects such as better safety software, real-time data monitoring and interpretation, and systems simulations that could assess the risk levels of a given deepwater drilling system. R&D that is focused on system safety should also involve the ability to assess effects of environmental conditions on MODU operation, which includes the drilling unit.
Summary Observation 5.8: Industry’s R&D efforts have been focused disproportionately on exploration, drilling, and production technologies as opposed to safety.
Responsibility and Accountability
Summary Recommendation 5.1: Operating companies should have ultimate responsibility and accountability for well integrity, because only they are in a position to have visibility into all its aspects. Operating companies should be held responsible and accountable for well design, well construction, and the suitability of the rig and associated
9 Report of the Society of Petroleum Engineers Gulf of Mexico Deepwater Drilling and Completions Advisory Summit to NAE/NRC Committee, March 2011, http://www.spe.org/industry/docs/SPESpillSummit.pdf. Most recently accessed Jan. 17, 2012.
10 Responses of the International Association of Drilling Contractors to questions from the committee, March 2011.
safety equipment. Notwithstanding the above, the drilling contractor should be held responsible and accountable for the operation and safety of the offshore equipment.11
Recommendation 5.1a: Coordination of multiple contractors should be reinforced to maintain a common focus on overall safety.
Recommendation 5.1b: Operating companies should develop and maintain the proper oversight of contractor work.
The operating company assumes the responsibility for (a) understanding the environment of well drilling, including characteristics of the marine surface, subsurface, seafloor, and local weather; (b) selecting the equipment to drill a well and ensuring that it is safe, reliable, certified, and capable of executing the well drilling program; (c) creating the well design and a program that adheres to safety standards; and (d) managing all the parties involved in executing the well plan. Because offshore operations require a high level of technical competencies, any organization that would assume the role of operator needs to have the readily available and internal capacity to be able to access the technical and operational competencies of the contractors and service providers.
However, drilling contractors (being the operators of the MODU and the drilling equipment) have the duty of ensuring that their equipment and personnel are capable of executing a well plan and that personnel are properly trained and certified.
Operating companies generally rely on one of their representatives, often referred to as “the company man” (or more formally as the well site leader), to coordinate all of the contractors and to have responsibility for the drilling activities. It is important that a system be in place allowing—before changes in the shifts of the company man—an appropriate transition of knowledge, information, and responsibilities concerning the coordination of the contractors and activities.
Research and Development
Summary Recommendation 5.2: Industry should greatly expand R&D efforts focused on improving the overall safety of offshore drilling in the areas of design, testing, modeling, risk assessment, safety culture, and systems integration. Such efforts should encompass well design, drilling and marine equipment, human factors, and management systems. These endeavors should be conducted to benefit the efforts of industry and government to instill a culture of safety.
11 This recommendation is also presented in Chapter 6 as Recommendation 6.20.
Some R&D for general safety that is not necessarily tied into specific operating companies can be done by outside organizations. The Electric Power Research Institute (EPRI)12 and SINTEF13 provide possible analogs of how outside organizations can successfully contribute to safety improvement in industry. Creation of industry, academic, and government consortia and collaborative R&D centers of excellence can also significantly contribute to accomplishment of this goal.
As research efforts focused on the safety of offshore drilling operations have been relegated to manufacturers, contractors, and service providers, much less of that research is done by the operators. Furthermore, there is little coordination of system safety research associated with offshore drilling operations. Improved approaches are needed for assessing various safety-related scenarios and the associated risk levels before the occurrence of a relevant incident. Industrywide standards should be developed for quantitative risk assessment to be used explicitly as a management tool for evaluating the risks of alternative choices.
Education and Training
Summary Recommendation 5.3: Industry should undertake efforts to expand significantly the formal education and training of industry personnel engaged in offshore drilling to support proper implementation of system safety.
Recommendation 5.3a: Education of rig personnel early in their careers can be provided through a system similar to community or technical colleges.
Recommendation 5.3b: In addition to rig personnel, onshore personnel involved in overseeing or supporting rig-based operations should have sufficient understanding of the fundamental processes and risks involved.
12 EPRI is an independent company that conducts R&D relating to the generation, delivery, and use of electricity for the benefit of the public. For example, EPRI’s Risk and Safety Management Program conducts research for the development of a risk-informed framework for nuclear power plants. http://portfolio.epri.com/default.aspx. Most recently accessed Jan. 17, 2012.
13 SINTEF (Stiftelsen for Industriell og Teknisk Forskning) is an independent research organization based in Scandinavia that conducts research on technology, medicine, and the social sciences. One of SINTEF's primary objectives is to provide a better in-depth understanding of how to assess, monitor, and control safety and reliability. http://www.sintef.no/home/. Most recently accessed Jan. 17, 2012.
Recommendation 5.3c: A research process is needed for establishing standardized requirements for education, training, and certification of everyone working on an offshore drilling rig. Additional standardized requirements should be established for education, training, and certification of key drilling-related personnel working offshore and onshore.
Specific education for drilling operations, especially offshore drilling, is lacking. There are a variety of related engineering disciplines such as petroleum, mechanical, chemical, and industrial engineering, but only a few programs offer introductory courses in drilling. Therefore, individuals receive training in drilling engineering through programs designed within a company, which generally include some type of apprenticeship program providing drilling experience under the oversight of experienced drilling personnel. Offshore drilling engineering tends to rely on principles developed for onshore operations while gaining experience from offshore operations. Some offshore drilling engineers working for contractors change roles and work for operators.
Drilling personnel come from all walks of life. They usually start in the onshore drilling industry, learning by experience with hardly any formal education in key areas such as the overall drilling system, geology, fluid flow, and chemistry. Offshore drilling personnel can be recruited from a variety of institutions and organizations, including technical schools and general colleges, and from those with specialized naval backgrounds. Few recruits are likely to have even a fundamental understanding of the overall drilling system and the environment into which the system is deployed. Training is mostly done by contractors and is focused on a specific job. There are commercial organizations that provide required training, such as for well control and survival (e.g., helicopter underwater egress training), but little else. Different companies have training and career paths that vary greatly. There are few industry standards for the level of education and training required for a particular job in drilling.
Incident Reporting Systems
Summary Recommendation 5.4: Industry and regulators should improve corporate and industrywide systems for reporting safety-related incidents. Reporting should be facilitated by enabling anonymous or “safety privileged” inputs. Corporations should investigate all such reports and disseminate their lessons-learned findings in a timely manner to all their operating and decision-making personnel and to the industry as a whole. A comprehensive lessons-learned repository should be maintained for industrywide use. This information can be used for training in accident prevention and continually improving standards.14
14 This recommendation is also presented in Chapter 6 as Recommendation 6.14.
Thousands of offshore wells have been drilled, some with extreme difficulty. However, information on near misses or the events that might have caused near misses is rarely exchanged through the trade literature or professional meetings. The committee is unaware of any publicly available database on near misses and their causes, specifically for the Gulf of Mexico. There appears to be an industrywide reluctance to disseminate information on such events; most companies retain the information for internal use, except when they are required to reveal it.
Fostering Safety Culture
Summary Recommendation 5.5: Industry should foster an effective safety culture through consistent training, adherence to principles of human factors, system safety, and continued measurement through leading indicators.
Leading indicators provide ongoing assurance that risks are being adequately controlled. An example of a leading indicator would be a measure of preparedness to manage an emergency situation. One component of that measure would be the training sessions conducted by an offshore team. [See HSE (2006) and OECD (2008) for other examples.]
Recommendation 5.5a: The committee endorses the concept of a “center for offshore safety” to train, monitor the work experience of, and certify (license) personnel. Leadership of the center should involve persons affiliated with one or more neutral organizations that are outside of the petroleum industry.
Recommendation 5.5b: Effective response to a crisis situation requires teamwork to share information and perform actions. Training should involve on-site team exercises to develop competent decision making, coordination, and communication. Emergency team drills should involve full participation, as would be required in actual emergency situations, including a well blowout. Companies should approach team training as a means of instilling overall safety as a high priority.
Recommendation 5.5c: Use of training simulators similar to those applied in the aerospace industry and the military should be considered. Approaches using simulators should include team training for coordination of activities in crisis situations.
Each operating company, service provider, and drilling contractor has been viewed by the oil and gas industry as responsible for its own training.
Training in such areas as well control and survival in harsh environments could be obtained from a variety of sources with certified training programs.
Each company, whether an operator or contractor, specifies its level of training and experience for a particular job function and how much training per year is required. There is little industrywide uniformity in the amount or the type of training required for a particular job. Testing after training has not been standardized, nor has follow-up to assess competency levels. Overall, in the drilling industry there is little uniformity in the type, amount, and frequency of training. Furthermore, there is a noticeable lack of team training and training of management personnel who make critical decisions for offshore drilling operations. (See recommendations in Chapter 4 on education and training of rig personnel.)
Capping and Containment Systems
Summary Recommendation 5.6: Efforts to reduce the probability of future blowouts should be complemented by capabilities of mitigating the consequences of a loss of well control. Industry should ensure timely access to demonstrated well-capping and containment capabilities.
The Macondo well–Deepwater Horizon event, in which the BOP system failed to contain the hydrocarbons that escaped thousands of feet below the surface of the water, presented a challenge to the offshore industry as a whole that it was not immediately prepared to address. No primary well containment system was available. The operator was compelled to use what equipment was readily obtainable in or near the Gulf of Mexico and to adapt various makeshift designs (on the basis of trial and error) of risers, caps, and other equipment to contain the hydrocarbon flow, direct it to floating production facilities, and eventually stop the flow out of the well. This process took months, during which millions of barrels of hydrocarbons flowed into the gulf waters. The incident dramatically showed the vulnerability of subsea BOP systems. Therefore, access to a containment system that can be rapidly deployed to a well is an essential aspect for offshore drilling in the near future while BOP system reliability is improved.
The committee endorses industry’s recent initiatives to establish highly capable containment systems in the event of future well blowouts. One such initiative is the well containment response system developed by the Helix Well Containment Group,15which is a consortium of deepwater operating companies in the Gulf of Mexico with the objective of expanding capabilities to respond to a subsea spill. Each member company contributes expertise and resources to help the group develop the capability of rapid intervention, response, and containment. This system is now operational.
Also, the Marine Well Containment Company is an organization set up for the purpose of containing an underwater well control incident in U.S. Gulf of Mexico. Membership is open to all oil and gas operators in the U.S. gulf waters, and the group is funding and building a containment system intended to be more flexible than the Helix system. It will be compatible with a wide range of well designs and equipment, oil and natural gas flow rates, and weather conditions.16
Industry or other organizations should support the further development of containment systems with R&D efforts, field tests, risk analysis, simulations, and so forth to improve preparedness, reliability, and the effectiveness of future containment.