To provide context for the subsequent discussion of safety in the offshore oil industry, each day of the workshop began with a detailed description of one of the industry’s worst disasters: on day 1, the 1988 explosion of the Piper Alpha oil production platform in the North Sea, and on day 2,
the 2010 blowout and explosion of the Deepwater Horizon drilling rig at the Macondo Prospect in the Gulf of Mexico.
“You are free to choose, but you are not free from the consequences of your choice,” said Steve Rae, business consultant and survivor of the Piper Alpha disaster that occurred on July 6, 1988. In the explosion and subsequent fire on the oil platform, 167 workers died, while only 61 survived. Rae drew the same conclusions about its cause as those cited in the final report of the Deepwater Horizon Study Group, produced more than two decades later: the “disaster was preventable had existing progressive guidelines and practices been followed. This catastrophic failure appears to have resulted from multiple violations of the laws of public resource development, and its proper regulatory oversight.”1
The Piper Alpha, which was located approximately 120 miles northeast of Aberdeen, Scotland, was one of the first oil production platforms in the North Sea, Rae explained. Occidental Petroleum commenced operations on the platform in 1976, first producing only oil. According to Rae, Occidental pushed Piper Alpha’s systems to their maximum capacity from the outset. A pipeline network connected the Piper Alpha to the Tartan and Claymore production platforms, to the MCP-01 gas pumping station, and to the Flotta oil terminal on the Orkney isles. The MCP-01 pumping station was also connected directly to the St. Fergus gas terminal in Scotland. This pipeline network, Rae noted, more than 200 miles in length, was maintained under constant pressure. At its peak in 1979, he reported, the Piper Alpha was the most productive platform in the world, producing 320,000 barrels of crude oil a day, which equated to $5 million a day.
Originally, Rae continued, the platform had been designed so that the most dangerous operations were kept at a distance and segregated from the personnel areas by firewalls. But in 1980, he said, Occidental decided to install a gas compression module directly adjacent to the control room and living quarters. According to Rae, the change failed to recognize the additional risk introduced to this area by the gas compression modules and assumed that the existing firewall would continue to provide the necessary protection. The Tharos—described by Rae as “the world’s largest floating fire engine”—was approximately 1,500 feet away from the Piper Alpha. Its intended purpose, he said, was to provide security and emergency response services to the Piper Alpha in the event of a well blowout or fire. The crew
1Deepwater Horizon Study Group. (2011). Final Report on the Investigation of the Macondo Well Blowout. Available: http://ccrm.berkeley.edu/pdfs_papers/bea_pdfs/DHSGFinalReport-March2011-tag.pdf [March 2018].
of the Tharos had been trained to respond to emergency situations, he added, and the Tharos could pump 40,000 gallons of water a minute over a distance of more than 300 feet.
Rae was transferred to the Piper Alpha in May 1988 as an electrician, arriving on July 6 by helicopter with 16 other crew members. On arrival, they received no safety induction but instead were sent to bed so they could work the night shift, which started at 6:00 PM. During his time as a member of the drilling crew, Rae said, he interacted with few of the other onboard teams. The drilling crew brought with them their own culture and had their own work areas and sleeping quarters, he added. He characterized them as a close-knit team that worked separately from the other work teams onboard.
Although his time on the Piper Alpha was brief, Rae continued, it felt different from his stints on the other production platforms he had worked on. He explained that there appeared to be a lack of motivation and spirit in the workforce, and design flaws went unaddressed. When the gas compression facility was added, Rae said, the firewall was incapable of protecting workers from an explosion. To gain access to the external areas of the platform, he added, workers had to navigate their way through multiple doorways as a result of the addition of living quarters over time. A pressurized door that provided access to and from the living quarters was always left swinging open because the differential pressure was higher than required, so that shutting it was difficult, although possible with enough force. According to Rae, the habitual disregard for shutting this door revealed a general lack of commitment and engagement in the safety culture onboard. There were times when he would go to the control room to get an operator’s signature on an electrical isolation permit but find no one there to assist. Instead of addressing this troubling situation, he would go to get some coffee and wait until an operator returned.
Rae was unaware that multiple scopes of work were being carried out on the platform—in particular, the recertification of the safety relief valves. He explained that the platform would typically be shut down for 3 to 6 weeks during the summer for this operation; the safety valves would be removed, tested, and recertified; and any necessary construction work would be completed to ensure the safety of the platform. But in 1988, he said, the demand for oil and the cash flow associated with the Piper Alpha’s operation were too high for Occidental to consider shutting the production process down, so the company was attempting to do the recertification of these valves onboard.
By July 6, 1988, Rae continued, the Piper Alpha’s oil production had fallen to 138,000 barrels a day, but it had added production of around 94 million cubic feet of natural gas to its total output. On the day of the disaster, full drilling operations were in effect, together with the ongoing
installation of the Chanter field production riser, structural modifications to the process modules, overhaul of the physical metering skids, maintenance work on the gas lift lines, and nighttime diving operations. It was also noted in a later public enquiry, Rae added, that a number of the production team members responsible for running the Piper Alpha at the time had been temporarily promoted and thus were not fully conversant with their increased responsibilities.
During the day shift on July 6, 1988, an engineer who was undertaking the safety valve recertification work removed Pump A’s pressure safety valve for inspection and maintenance. The work could not be completed by 6:00 PM, Rae explained, so the temporary “blind flange” that had been fitted remained in place. The engineer in question had completed a permit stating that Pump A had to remain under isolation and lockoff. Unfortunately, Rae said, this permit had not been placed in the appropriate filing tray, so the on-duty permit controller had no way of knowing the status of the safety valve for Pump A.
As Rae prepared to start his shift that night, his coworker told him, “Take it easy, keep your head down, it’s your first shift, you must be tired, there is nothing big going on tonight.” That was the last time Rae saw his colleagues on the maintenance team alive. At 9:00 PM, he took a coffee break, returning to the drill floor 45 minutes later to help two vendors install equipment. He was there just before 10:00 PM when one of the production operators attempted to start Pump A in an effort to prevent the failure of the offshore platform’s entire power supply. When the pump was activated, the gas pressure it created started to leak out from the blind flange, resulting in a significant gas leak that was audible throughout the platform. Before anyone could react, the gas ignited, resulting in the initial explosion.
From the drill floor, where Rae was located, the explosion felt like a dropped object causing considerable vibration. An experienced coworker’s face registered surprise as the drill floor shook, and he immediately began to safeguard the well they were drilling. Unbeknownst to Rae at the time, the blast immediately destroyed part of the control room, ruined the electrical power and alarm systems, rendered the firewater system inoperable, damaged the firewall between modules B and C, ruptured several oil lines, started multiple oil fires, and engulfed the platform in smoke that blew across the helideck and lifeboats.
Seconds after the explosion, Rae’s manager arrived from the office block situated in the living quarters. He assembled the drill crew and told them that they needed to abandon the drill floor. He said they needed to form a human chain because the smoke was so dense that it was blinding. The crew grasped each other’s collars and began to file along the deck toward the living quarters. As they approached the door to the living quar-
ters, Rae decided to separate from the drill crew and went instead to his workshop close by. Holed up in the workshop, he escaped the acrid smoke for a short time. Once he had caught his breath, he returned to the drill floor, where he met a colleague named Vince who had worked on the Piper Alpha for some time and knew his way around the platform very well. Vince told Rae they needed to go out the back of the drill floor and down the stairs, in the opposite direction from the lifeboats and living quarters.
Rae followed Vince, and by 10:15 PM they were on a tiny platform right beneath the flareboom on the platform’s northeast corner. Jumping into the sea was the only remaining option for escape. They removed their boots, emptied their pockets, and looked at the height of the drop. Just then, another explosion erupted on the platform. Vince jumped, and Rae followed. When Rae hit the sea, its 43-degree temperature took his breath away, and he thought he would never surface. Finally, he made it back to the surface and gasped for breath. He turned toward the platform and saw a huge gas fireball racing toward him, which had been caused by the rupture of the Tartan production riser. He dove beneath the water and began swimming away from the platform. When he looked up, he saw two supply vessels steaming his way. The crew aboard had seen him jump and threw him a rope as soon as they neared and pulled him on deck.
Aboard the supply ship, Rae watched as more survivors, many of whom had been burned by the fire, were pulled from the water. He managed to call his mother and assure her that he was okay. Rae would soon come to realize that only 10 of his 35 drill crew friends and work colleagues had survived that night.
Meanwhile, the Tharos was proving ineffective for its task. The crew aboard had their own challenges to attend to, as the Tharos had lost all power. The vessel’s design specifications stated that it should be capable of responding to an emergency within 4 minutes of being informed, but it took 45 minutes for the pumps to start running. Since the Tharos had never been used for a disaster of this nature, it was unable to function according to its design. Five minutes after the Tharos began pumping water on the Piper Alpha, the main gas export line to MCP-01, located on the Piper Alpha, ruptured, engulfing a fast rescue craft. At 11:20 PM, the Tharos was told to pull back to 300 feet because of the risk of hydrogen sulfide. “Effectively, it had not performed in accordance with its intended design,” Rae said.
By 10:00 the next morning, 60 percent of the Piper Alpha platform had melted beneath the sea, Rae continued. The inventory from ruptured pipes and leaking wellheads was still burning. Thirty people were unaccounted for and presumed dead. Although air and sea searches continued throughout the day, no more survivors were found. It took 4 months for the bodies from the living quarters to be recovered.
Errors in human management significantly added to the death toll,
said Rae. After the explosion, at least 84 crew members aboard the Piper Alpha sat in the accommodation waiting to be told what to do. The installation manager failed under pressure and offered no instruction. The public address system had been destroyed by the first explosion, so there was no means of instructing the crew to evacuate. Occidental’s emergency procedures instructed personnel to head toward the lifeboat stations; unfortunately, however, the ensuing fires made the route impassable. According to Rae, those who survived that night did so because they did not follow procedures. “They took control of their own lives and decided that jumping was the only way to get off,” he said.
Rae added that the fire on the Piper Alpha might have burnt out had it not been for the continued supply of hydrocarbons from both the Tartan and Claymore platforms. The manager on the Claymore chose to wait until he had received permission from the Occidental onshore Emergency Control Center before shutting down the Claymore’s production. This, Rae said, coupled with the lack of leadership on the Piper Alpha, resulted in the ongoing escalation of the disaster and ultimately the loss of 167 lives and the platform.
To prevent such incidents from occurring in the future, Rae insisted that the workforce must be engaged, empowered, and committed to a safety culture in oil production. Employees need to feel comfortable enough to report potential hazards, unsafe conditions, and errors in the process to their superiors, he said, and the oil production industry must adopt safety standards that protect and engage its workers. Rae asserted that these safety standards should encompass six factors vital to safety culture:
- commitment—the presence of intellectual and emotional buy-in;
- change management—the ability to recognize and respond to change;
- control of work—effective process discipline and robust task assurance;
- competence—the application of knowledge, demonstration of skill, and mastery of the task;
- complacency—acute focus and a conscious engagement; and
- communication—the desire and intention to share critical information at the worksite.
According to Rae, the investigation and public enquiry that followed the Piper Alpha disaster led to 106 recommendations for preventing a similar event in the future. All of these recommendations were accepted by industry in the United Kingdom and acted upon, and they have been subject to further refinement and remain in place to this day. In today’s industry, Rae noted, safety procedures are detailed in a dynamic document that allows for continuous correction and improvement. Even so, he sug-
gested, the industry remains in a vulnerable place. He pointed out that the oil production business is currently recovering, which will mean a rush to hire people, drill wells, and complete construction projects. At the same time, however, much of the previous competence in the industry has been lost, he observed. To prevent future disasters, he concluded, leaders must continually reflect on the technical and human factors required to maintain and improve safety performance.
Lillian Espinoza-Gala, LEG Exploration Education LLC, began by telling the audience that when she dropped out of college after 2 years of premedical education, her parents suggested that she earn money for college by working for an offshore catering company. She was recruited to work in production by Ocean Drilling & Exploration Company (ODECO) while earning an associate’s degree from Nicholls State University in the 7 On & 7 Off Petroleum Technology Program. Upon graduation in 1977, she worked in supervisory positions until 1981, when a near-fatal accident ended her offshore career. Since then, she reported, she has worked in journalism and on television documentaries, and served as a member of the Deepwater Horizon Study Group formed by members of the Center for Catastrophic Risk Management.
Espinoza-Gala cited three requirements for improving process safety in the drilling industry: learning to listen to the well, learning to listen to each other, and two-way communication between executive management and employees. The Macondo drilling disaster, she stated, the largest accidental oil spill in the history of the petroleum industry, was characterized by an environment that lacked all three of these requirements—the well was misread, and communication was poor among and between rig crew members who worked for multiple companies and shore superiors and middle and top management. Among the 126 men and women on the Deepwater Horizon the night of April 20, 2010, 11 people died as a result of the blowout, and 63 survivors sustained physical injuries requiring multiple surgeries. The well flowed uncontrolled for 87 days, spilling nearly 5 million barrels of oil into the Gulf of Mexico. Pat Campbell, professional well killer for Wild Well Control, described the disaster as the “most complex engineering crisis since Apollo 13.”
According to Espinoza-Gala, financial pressures to complete the operation quickly and efficiently set the stage for the Macondo disaster during the well design phase in June 2009. She described this economic pressure as a “disaster spear,” with the CEO and members of management at the “blunt end of the financial and safety spear” and front-line drilling engineers and geoscientists and the rig crew at the sharp end. She added that managers
bear the brunt of the financial pressure from investors and shareholders to show profit from each well, but the front-line supervisors and those who live and work on the rig suffer the most direct consequences of cutting corners.
Espinoza-Gala went on to say that in the Macondo tragedy, the first group of victims were the 11 rig crew members who died as a result of the blowout, while the second group of victims “were the people charged with manslaughter.” In 2012, she noted, BP pled guilty to 22 counts of voluntary and involuntary manslaughter on behalf of well site leaders Robert Kaluza and Donald Vidrine. In 2012, Kaluza and Vidrine were arraigned on the 22 counts in the 11 deaths and on 1 count of violating the Clean Water Act, and they faced 110 years in prison. Although both men escaped the blowout without injury, they would spend until late 2015 facing criminal charges. In December 2015, the Department of Justice dropped the manslaughter charges. Vidrine pled guilty to 1 count of violating the Clean Water Act, paid a $50,000 fine, and agreed to do 10 months of community service and to testify against Kaluza in his criminal trial, which he did in February 2016. Espinoza-Gala reported that the jury found Kaluza innocent, while Vidrine was sentenced to 10 months of community service in April 2016, which he completed just before his death in June 2017.
As Espinoza-Gala pointed out, drilling operators are pressured by the investment community and shareholders to provide profits by accelerating operating schedules, which sometimes compromises process safety. But, she added, as Trevor Kletz, renowned author on the topic of process engineering safety, has said, “If you think safety is expensive, try an accident.” As of 2018, the Macondo disaster had cost BP approximately $70 billion.
Of the 11 who perished aboard the Deepwater Horizon, Espinoza-Gala focused on a particular member of the offshore drilling crew: 35-year-old Jason Anderson, a father of two from Bay City, Texas. Anderson began his career in 1995 and moved up quickly, she noted, helping to bring the Cajun Express from South Korea into the Gulf of Mexico in 2000. She pointed out that because of project concerns, however, he and a number of other crew members left that drilling contractor. They were quickly hired for a new fifth-generation dynamically positioned state-of-the-art rig—the Deepwater Horizon.
In 2008, financial markets had been rocked when the price of oil rose to $148 a barrel, Espinoza-Gala continued, and they were rocked even more when the price plummeted to $40 a barrel by February 2009. BP CEO Tony Hayward’s “Every Dollar Counts” program mandated that operating budgets be decreased by 22 percent. He also noted in a BP press release that 20 percent of top management globally would be retired early by December 2009.
Espinoza-Gala went on to report that Anderson and his coworker
Dewey Revette were on duty aboard the Deepwater Horizon when it almost sank on May 26, 2008. A mechanic failed to document a partially changed ballast valve, she explained, and the operation was saved only when Anderson and Revette swam underwater to close the valve. Subsequent repairs required 96 hours of nonproductive time before the rig could resume drilling. She added that the issues aboard the Deepwater Horizon mirrored those on the Piper Alpha 20 years before, but that instead of being used as a case study, this near miss was not reported. The Minerals Management Service and the U.S. Coast Guard learned of the incident after the Macondo blowout.
In January 2008, the Deepwater Horizon began the Tiber well, which it completed drilling in September 2009. Espinoza-Gala characterized this as a historic accomplishment, since according to Oil & Gas Journal, the Tiber set the record for deepest offshore well ever drilled. That same month, Anderson was promoted to the position of senior toolpusher, but there were no openings for this position, so his rig manager offered him a position teaching well control in Houston. According to Espinoza-Gala, Anderson declined because he was convinced that he would not have credibility as an instructor unless he had worked as a senior toolpusher.
Espinoza-Gala continued by reporting that the Macondo well had been spudded by Transocean’s Mariannas rig on October 6, 2009, and drilled to just under 9,000 feet before Hurricane Ida took the rig out of commission in November 2009. As soon as the Deepwater Horizon had finished the Kodiak drilling operation, it relocated to Macondo in an effort to drill the last 11,000 feet quickly before moving on to the next two wells for which it had contracts. The deadline for finishing Macondo was March 8, 2010.
The Macondo prospect, located 50 miles off the coast of Louisiana, presented a number of technical challenges from the start. Espinoza-Gala stated that these included deep water, high formation pressures and temperatures, and the need to drill through multiple geologic zones of various pore and fracture pressures. The well was intended for exploratory purposes, she stated, but when deemed successful, BP elected to have the Deepwater Horizon run the production tie back, hoping to increase efficiency.
The Deepwater Horizon latched on to the Macondo wellhead on February 6. In the first month, Espinoza-Gala noted, the well incurred $20 million of cost overrun as the result of lost drilling fluids and unexpected problems. That month, she continued, according to Bloomberg Energy and NBC evening news, Anderson called his father to tell him, “BP is going to get every one of us killed,” and on March 7, Anderson and Revette were instructed to “ramp up the ROPs [rate of penetration]” on the operation. According to Espinoza-Gala, Anderson expressed his concerns to the senior engineer and BP well site leader about how fragile the well bore had proved to be in February and early March. Emotions flared, she said, but Anderson
and Revette nonetheless increased the ROPs and the well took a kick the following day.
The kick caused the crew’s confidence to falter, Espinoza-Gala continued, and according to survivor testimony at the Marine Board Hearing and testimony before Congress by his widow and father, Anderson requested reassignment to another rig as soon as he returned to shore. He blamed himself for missing the March 8 kick, she added, and knew his anger at being pushed to ramp up the ROPs had perhaps prevented him from catching the kick. A senior toolpusher position opened up on the Discoverer Spirit, set to begin on April 21, but the transition would take a few weeks.
By the first week of April, the Macondo well had lost 16,000 barrels of expensive drilling fluid, which required additional days and far exceeded the budget. By April 9, Espinoza-Gala reported, BP decided to halt drilling operations early, after commercial hydrocarbons were found, and prepare for its temporary abandonment. At this time, Espinoza-Gala said BP decided to change the abandonment procedure and perform a long completion string it normally did not do.
Most of the Transocean crew who would die went out on April 1 for their 21-day hitch. According to Espinoza-Gala, Anderson did not join them since he was waiting for his new assignment on Discovery Spirit. However, when Anderson’s assistant driller got promoted to a new build in South Korea, his shore rig manager requested that Anderson complete one final 7-day hitch on the Deepwater Horizon to help his crew transition to their new roles, and he reluctantly agreed. Family members reported that he started to work on his will, instructing his wife on how to maintain the house, back in March.
On April 14, Anderson began his final crew change on the Deepwater Horizon. On April 16, the long-time well site leader, Ronnie Sepulvado, left for well control school. BP replaced him with Robert Kaluza for 5 days. Espinoza-Gala noted that Donald Vidrine, the BP well site leader who began working on the Deepwater Horizon in January, expressed his frustration over all the last-minute engineering changes during the last 3 weeks of operations. By April 17, she said, Vidrine’s concerns were relayed in an e-mail noted in all formal Macondo reports that well site leaders “had finally come to their wits’ end and all the last minutes engineering changes were driving fear and paranoia.” There was a total loss of confidence on the rig. “The right information could not get to the right people at the right time,” she observed.
On April 20, Anderson had to clean out his locker for the first time since bringing the Deepwater Horizon into the Gulf of Mexico in 2001, preparing for his departure on April 21. He was scheduled to board a chopper for the Discoverer Spirit at 7:00 the next morning. For those who had made the journey into the Gulf of Mexico 9 years before, it was a
bittersweet day. Everyone felt happy that Anderson was finally fulfilling his 15-year dream of becoming a senior toolpusher, but they also felt sad to know he would be gone. In just 24 hours Jason Anderson would no longer be a part of the Deepwater Horizon family.
On that same day, Espinoza-Gala continued, the crew was only a few days away from finishing the Macondo well. Unfortunately, instead of finishing the well, 11 workers died and 16 others were seriously injured aboard the Deepwater Horizon. Jason Anderson was among the dead.
Espinoza-Gala concluded that the failures to listen to the well and listen to each other, as well as distractions and emotions led to a loss of situational awareness and loss of focus. Every one of the Deepwater Horizon’s many defenses failed—some were never engaged, some were engaged too late, and some simply did not work as designed. The chain of events between February and the disaster could have been interrupted at many points, she asserted, but a lack of preparation and experience and an unclear chain of command prevented key decisions at every step. She stated that all the human and technical decisions made in planning and executing the drilling plan combined in a disaster that had immense consequences for the families of crew members, for the companies involved in the drilling operations, for the Gulf of Mexico, for the world environment, for the global offshore upstream industry, and for the economy of the region. Overall, she concluded, the actions, policies, and procedures of the corporations involved in the Macondo operation failed to provide an effective process system safety approach.
This page intentionally left blank.