Perspectives on organizational accidents and resilient organizations: the Deepwater Horizon accident

Description of the Deepwater Horizon accident. Theoretical framework the part of the process and causes. Analysis of information distribution within BP and contractors. Analysis from different perspectives, its approaches and evaluation. IRGC model.

Рубрика Безопасность жизнедеятельности и охрана труда
Вид курсовая работа
Язык английский
Дата добавления 04.08.2013
Размер файла 412,1 K

Отправить свою хорошую работу в базу знаний просто. Используйте форму, расположенную ниже

Студенты, аспиранты, молодые ученые, использующие базу знаний в своей учебе и работе, будут вам очень благодарны.

Размещено на http://www.allbest.ru/

Размещено на http://www.allbest.ru/

Perspectives on organizational accidents and resilient organizations: the Deepwater Horizon accident

1. Objective and scope

The Deepwater Horizon oil spill, one of the largest marine oil spill in history, was caused by an explosion on the Deepwater Horizon offshore oil platform about 50 miles southeast of the Mississippi River delta on April 20, 2010. Most of the 126 workers on the platform were safely evacuated and 11 persons died. There were number of technical and non technical reasons for this historic incident which led to economic and environmental disaster.

The purpose of this document is to study and analyze the managerial and organizational factors contributing to the largest marine oil spill with the aid of «Six perspectives» report by Rosness et al [1]. In order to perform a detailed analysis and arrive at a good understanding of how organizational factors can influence safety and how theoretical concepts can be used within safety management, we tried to elaborate root causes of the Deepwater Horizon accident with respect from six perspectives wish special focus on information processing perspective. The research question for this paper is «How can the Deepwater Horizon accident be analyzed according to information processing perspective in particular and remaining perspectives in general

2. Description of the Deepwater Horizon accident

accident deepwater horizon

On 20 April 2010 Deepwater Horizon, an offshore drilling platform, owned and operated by Transocean on behalf of BP in the Gulf of Mexico, exploded. Killing 11 persons onboard, it finally caused the vessel to burn and sink on 22 April 2010 and releasing 5000 barrels of crude oil per day. Billions of dollars were spent to clean up the spill.

Several articles, reports and investigations state the following series of events that led to the disaster:

- Improper sealing of the annulus with cement and the malfunction of the shoe track barrier caused the hydrocarbons to flow into the annulus.

- The rig crew accepted the incorrect negative pressure testing of the well integrity and failed to identify that hydrocarbons had entered the annulus until it was seen in the riser and finally failed to take the correct action.

- The fire and gas system did not function as intended. As a result, it could not prevent the fire and explosion.

- The Blow out preventer (BOP) did not function to seal the well, thus allowing the hydrocarbon flow to reach the vessel.

However, the root causes that led to the above were human factors, failure in management, failure in communication and lack of training within BP and its contractors.

3. Theoretical framework

Within the framework of this paper, the objectives are achieved with the aid of «Six perspectives» SINTEF report [1] and Report from the President Commission [2]. A detailed analysis of the Report from the President Commission [2] helped to get a comprehensive picture of the Deepwater Horizon accident while «Six perspectives» report by Rosness et al. provided theoretical means to understand organizational factors contributing to the accident propagation. The causes of the accident were analyzed from different perspectives based on the «Six perspectives» report. These perspectives are energy and barrier perspective, normal accident theory, high reliability organizations, information processing perspective, decision making and resilient engineering.

Within this paper, the focus was on the fourth perspective of «Six perspectives» report - the information processing perspective. It considers the fact that the accident occurs as a result of breakdown and wrong interpretation of the information, which is somehow related to physical events. The accident was studied thoroughly to identify causes related to information processing such as misinterpretation of hazard signals, erroneous assumptions and acceptance of informal norms which are contradictory to existing regulations, suppression of critical information, disregard of important information and distracted attention.

Finally, we have tried to position the findings in this paper within the IRGC-framework. The IRGC's risk governance framework provides means to understand analyze and manage risk issues. The framework comprises five linked phases: Pre-Assessment, Appraisal, Characterization & Evaluation, Management and Communication.

These five phases help to get a deep understanding of a risk, and to develop actions for dealing with it.

4. Analysis of information distribution within BP, Halliburton and Transocean

The resilient organization and information processing perspectives were used to analyze in detail. In order to be a resilient organization, the information flow is a prerequisite requirement. So, in the table 4.1 below, we analyzed the report [2] with regards to the information processing perspective.

Table 4.1

Events of Deepwater Horizon accident

Analysis

In April, BP engineers with Halliburton suggested that long string casing cannot be cemented reliably, so BP design team switched to liner. But that shift had conflicts with BP and BP emphasised that some of the inputs needs to be corrected and forced that long string should be a primary option as casing.

According to the report [1] regarding information perspective, the decision was based on BP's powerful position instead of facts and reality.

BP failed to process information as it seemed to disregard warnings; they were not concerned about immediate causation and were inflexible to make the right decision.

BP's design suggested using more than 16 centralizers. However Weatherford (a supplier) had only 6centalizers in stock.

BP failed to track the stocks of centralizers. This reflects breakdown of information flow within the organisations (BP and its supplier). It also reflects the lack of interest and concern from BP.

BP drilling engineer got permission from senior manager to get 15 additional slip-on centralizers. Gagliano found through simulations that using 21centralizers would cause less severe gas flow. One of the leader assured that custom-built centralizers would arrive, but instead, convention centralizers were delivered. Drilling engineer Cocales, said they would «probably be fine even without the additional centralizers».

Failure in information flow from BP to its supplier. Cocales's overconfidence made him make a wrong judgement on the decision to use less number of centralizers. This emphasises on misperception of the danger involved and erroneous assumption by Cocales.

Guide pointed out that new centralizers were not custom-made as specified. He was also concerned about the time for installation and complained about the addition of 45 more pieces of equipment to the casing could come off during installation. At last, Guide's point of view was prevailed and BP installed only the six centralizer subs on the Macondo production casing.

Attention to use the correct design of centralizers was distracted by a longer time to install the addition of 45 more pieces of equipment. It also reflects on power based decision i.e. «boss is always right».

According to M-I SWACO, drilling-mud subcontractor, 570 psi pressure is required to circulate mud after converting the float valves. However the rig crew reported about only 340 psi. BP Site Leader Bob Kaluza and Transocean crew, using circulating pumps, concluded that pressure gauge was defective.

Wrong interpretation of hazardous signals. No investigation done thus BP ignored hazard signals. The conclusion on the defective gauge was made too fast, based on an erroneous assumption.

BP engineers feared risks of lost-return, so instead of 2760 barrels only 350 barrels of mud was circulated. BP pumped cement at 4 barrels per minute, a lower rate than the optimal rate.

Attention was distracted by the fear of lost-returns, leading to a wrong decision. Moreover, the decision was not based on facts and figures.

BP compromised on the quantity of cement as it ran a risk of exerting more pressure on the formation. In doing so the height of the cement column was in compliance with the MMS regulation but not with BP's internal regulation. BP's own engineers recognized that 60 barrels of cement would provide little margin for error.

Attention distracted by risk of formation fracture.

The decision was contradictory with the internal regulation.

Hazardous signals and opinions of engineers about the cement were disregarded.

Even though Halliburton is an industry leader in foam cementing, BP seemed to have little experience with foam technology for cementing production casing in the Gulf of Mexico

Lack of information in BP about use of foam technology.

Cement blend that Halliburton planned to use at Macondo were laboratory tested. The report was sent to BP as an attachment in an email with some recommendations. However it included only the result of a single foam stability test and did not specify any kind of cement slurry instability. There was no evidence that BP examined the foam stability data.

Important information was neglected and not clearly presented since information on the instability was given only in the attachment and not clearly stated in the email.

Halliburton personnel had conducted other foam stability test under different conditions earlier in February which were not reported and had failed. Halliburton conducted another round of tests in mid-April, just before pumping the final cement job. By then, the BP team had given Halliburton more accurate information about the temperatures and pressures at the bottom of the Macondo well, and Halliburton continued further with cementing plan. The tests in April also concluded that cement slurry was unstable. Authorities believed that Halliburton never reported this information to BP.

No information flow from Halliburton to BP regarding the failed foam stability tests. The suppression of information might have been on purpose to save money and time.

Halliburton did not send the results of the final test to BP until April 26, six days after the blowout.

Negligence of delivering the information by Halliburton.

A 5.5 barrel of flow-back volume was observed, which was within error margin. However the flow details were not presented nor was it clear on how long did the personnel watched for potential flow. Eventually they concluded that the float valves were holding.

Detailed information on the cement back-flow was disregarded.

Wrong interpretation of hazard signals (flow characteristics).

BP and Halliburton informed the rest of the team that the cement job was a success.

Flow of wrong information which was linked to the physical event. The right information was not shared and there was suppression of right information.

In the morning of the accident, BP's onshore team disregarded the cement evaluation and test to be done by Schlumberger and sent them home. This was based on the «decision tree» with the main criteria being `losses while cementing long string'. As there were no lost returns, BP confirmed their decision.

Decisions (not performing cement evaluation test) were made with inadequate information. This also reflects on BP's power-influenced decision.

There were four distinguishing features of the temporary abandonment of the well.

First is the single 300-foot-long cement plug inside the wellbore. MMS regulations required BP to install a cement plug as a backup for the cement job at the bottom of the well.

Second is the location of the cement plug: BP planned to put it 3,300 feet below the ocean floor, or «mud line» (which was deeper than MMS regulations allowed without dispensation, and deeper than usual).

Third is the presence of seawater in the well below the sea floor: BP planned to replace 3,000 feet of mud in the wellbore above the cement plug with much lighter seawater (seawater weighs roughly 8.6 ppg, while the mud in the wellbore weighed roughly 14.5 ppg).

Fourth is the lockdown sleeve-a mechanical device that locks the long casing string to the wellhead to prevent it from lifting out of place during subsequent production operations.

Morel e-mailed an «Ops Note» to the rest of the Macondo team listing the temporary abandonment procedures for the well. It was the first time the BP Well Site Leaders on the rig had seen the procedures they would use that day.

The first two steps clearly indicate violation of regulations and a tacit acceptance of norms which was contradictory to the regulations. Delayed information on the new well abandonment procedure was sent to the team offshore.

From April 12 to April 20, there were numerous changes to the temporary abandonment procedures by BP. But there is no evidence that these changes went through any sort of formal risk assessment or management of change process

Decision on the temporary abandonment procedures were made with inadequate information or any sort of risk assessment.

At BP's direction, M-I SWACO created a spacer out of two different lost-circulation materials left over on the rig. The decision was made by BP in order to avoid having to dispose of them onshore as hazardous waste. This unusually large volume of spacer had never previously been used by anyone on the rig or by BP nor was it thoroughly tested for that purpose.

Decision for creation and use of such spacer was made with inadequate information and no thorough testing.

Kill line was left open for 30 minutes and no flow and 0psi was observed which confirmed the criteria for negative pressure test. But the pressure in drill pipe remained 1,400psi. Site leaders and crew members never reconciled the different pressure values. The Site leaders in consultation with the crew, made a key error and mistakenly concluded that the negative test procedure had confirmed the well's integrity and they declared the test a success.

It is evident that BP and the crew on board neglected the information on the pressure difference on the kill line and the drill pipe. They made an erroneous assumption that the negative pressure test was a success and it confirmed the well integrity.

The annular preventer was opened to displace mud and spacer from the riser. Halliburton was informed that the negative-pressure test had been successful and they should prepare to set the surface cement plug.

After making an erroneous assumption that the negative pressure was a success, BP asked Halliburton to proceed with the cement plug job. The details of the test were not shared with Halliburton which clearly indicates that BP suppressed correct information flow.

While displacing the riser with seawater the crew had to deal with large amounts of returning mud. The driller repeatedly rerouted the mud returns from one pit to another in order to accommodate the incoming volume. At the same time, the crew also sent mud from other locations into the active pit system. It is possible that it would be difficult to monitor active pit volume during that time given all the activity. However, drill-pipe pressure began slowly increasing, despite the fact that the pump rate remained constant.

The crew may have been distracted by other matters, which could be the reason that the above changes were not noticed.

It is understood that the crew's attention was distracted in dealing with the large volumes of mud return. As a result other abnormal parameters were not noticed by the crew.

The increase in pressure was clear in the Sperry Sun data and on the Hitec display, but it was not noticed by BP or its crew and the pump was turned back on. Soon the drill-pipe pressure increased, but so did the pump rate. Minutes later, a pressure-relief valve on one of the pumps blew. At about 9:20 p.m., senior tool pusher Randy Ezell called the rig floor and asked Jason Anderson about the negative-pressure test and the displacement. Anderson responded that, It went good and reassured Ezell that It was going fine and he had it under control.

A breakdown in information flow is observed between the rig floor and the senior tool pusher.

Moreover a suppression of information is seen and a false results or information was circulated to other personnel onboard.

When the Chief Mate enquired about the cement plug job, Revette and Anderson informed him that it would be delayed. He noticed them having a calm discussion on the differential pressure.

After instructing to bleed off the drill-pipe pressure, in an apparent attempt to eliminate the pressure difference, Revette and Anderson left the drill floor. They made no attempts to perform a visual flow check or shut in the well, despite the evidence of a kick.

Revette and Anderson did not feel the need to convey the abnormalities in the information observed, thus resulting in a breakdown of information.

They also disregarded important information/indications despite the evidence of a kick.

5. Analysis from different perspectives

The Normal Accident Theory perspective

The results of President Commission were analysed with regards to Normal Accident Theory. According to this theory it is impossible to avoid occurrence of accidents in tight coupling systems with complex interactions. The analysis in table 5.1 reflects main aspects of the company which contributed to the accident and considered by Perrow as unavoidable.

Table 5.1

Aspects of NAT perspective

Examples from Deepwater Horizon accident

Complex systems are hard to control

For example, cementing was difficult to control due to complexity of technical systems involved in this procedure so it was hard to predict the results of cementing and additional simulation tests were needed in order to be sure that everything goes well.

Tight coupling of socio-technical systems

Technical systems used on the rig were complex and coupled tightly according to design and sophisticated functions. It is a quite demanding task to control these systems and any mistake regarding one system can easily provoke failures in other coupled systems. In this case information processing and decision making are getting more difficult than in linear systems. For example, one erroneous decision about centralizers led to many negative consequences. Correct decisions could have been taken only by trained personal based on risk assessment of the coupled systems.

Improvisation is difficult

With shortage of time and breakdown in information flow all improvised decisions are unlikely to be adequate. Under pressure of time, the crew made a wrong decision sending flow to mud-gas separator instead of sending overboard on the sea

Buffers and redundancy have to be designed

in the tightly coupled systems with complex interaction

It is important to be sure that necessary number of spare parts is always available from the supplier (the problem with centralizers).

It is vital but difficult to implement that all decisions are controlled by authorities or competent personnel. BP did not have adequate control in place to ensure that key decisions were safe. Initial well design decisions were reviewed by management, while changes to drilling procedures made the weeks and days before implementation were not reviewed by management of BP

Denial or lack of responsibility

MMS regulations: many critical or drilling issues were not considered in regulations and were left for industry to decide without agency review.

Neither regulator nor regulations were requiring the demonstration of preparedness. MMS does not have personnel with sufficient expertise and trainings to enforce the regulations on risk assessment effectively.

Safety is always competing with economical objectives.

Decisions taken were less costly and less time consuming but without risk analysis. Obviously, possible risk is often disregarded if some financial benefits can be achieved through unsafe operations.

From the table 5.1 can be concluded that since Deepwater Horizon rig was equipped with modern highly complicated systems it was quite difficult to control such a complex facility. Tightly coupled systems impose more responsibility on a crew, because all decisions are getting more critical and could have more catastrophic consequences. In this situation improvisation is almost impossible and a crew usually does not have time to think of «safety», especially being driven by economical incentives. Furthermore, the fact that governmental regulator did not interfere with demands on risk assessment demonstrates the absence of external support and motivation to be prepared to the disaster. So the complex design of systems and nature of human beings who are tightly coupled with the systems they operate and control makes accident prevention quite difficult to realize.

The Energy & Barrier perspective

This perspective focuses on energy transfer. The main principal here is to separate hazardous energy sources from potential victims by use of barriers or by making the victims more resistant by use of protective equipment or by providing rehabilitation.

Table 5.2

Principles of the perspective

Examples from Deepwater Horizon accident

Failed to implement Haddon's strategy of either eliminating or reducing energy build up. Also indicates breakdown of barriers.

Long string casing vs. liner. A decision to use long string instead of liner should have forced BP and Halliburton to pay more focus on the cement job.

BP wanted to use the long string casing as they had planed earlier even when the analysis suggested that cement job would fail in case a long sting casing was to be used

Failure to examine the risk factors and perform a risk analysis.

Foam cement testing. Ignoring the results from the studies / analysis which indicated that the cement slurry was unstable, and further analyzing the cause of the 3 failed tests performed in February and April, Halliburton still proceeded with its use by modifying the conditions in the report and showing that slurry was stable. The failed reports were not reported to BP.

Failure to implement more than one barrier.

Risk evaluation of Macondo cementing decisions and procedures. Only one barrier prevailed i.e. cementing to prevent hydrocarbon flow to induce redundancy.

Failure in design and to provide alarms or warnings.

Kick Detection. The primary cause was inability to detect signs of kick formation due to human error and fatigue induced due to long working hours.

Failure to implement correct procedure.

Diversion and Blowout Preventer Activation. No or inadequate procedure or training involved in an emergency situation.

Summarizing from the table above, BP and its contractors had failed to implement additional physical barriers for the well in case the primary barrier failed. There were several evidences of failure to examine risk factors by performing a formal risk assessment for a new well abandonment procedure or for the new slurry use. Also hints of design failure are reflected with the inadequacy of kick detection.

High Reliability Organisation perspective

This perspective is different from the other ones: instead of focusing on why accidents happen, the HRO perspective tries to explain why so few accidents occur within such complex organizations.

The theory of HRO lists five different characteristics of High Reliability Organization. Regarding the analysis of Deepwater Horizon accident, we can use four of these characteristics that were lacking and thus not making BP a High Reliability Organization: organizational redundancy, spontaneous reconfiguration of the organization, «mindfulness», and implication for risk reduction.

Table 5.3

Characteristics of a HRO

Examples of lack of HRO characteristics in the case of Deepwater Horizon

Organizational redundancy

During the negative-pressure test, the men interpreting the data hadn't got a full appreciation of the context in which they were performing the test, due to poor communication. Moreover, there was no incentive for personnel to call back to shore for a second opinion about confusing data. Thus, the men interpreting the data of the negative-pressure test were alone in their job, without any supervision or help for detecting unusual data.

Spontaneous reconfiguration of the organization

Even if many unusual working conditions were known (difficult drilling conditions, less than recommended number of centralizers, low volume of cement, new spacer…), it doesn't seems like any particular attention was taken while performing the work and interpreting data. The team failed to adapt their work to abnormal and changing conditions and they kept doing what they were used to do, regardless of the unusual situation and under-estimating the risks of changes (e.g. lower number of centralizers, change in the temporary abandonment procedure).

«Mindfulness»:

- Preoccupation with failure

- Reluctance to simplify interpretations

- Sensitivity to operations

- Commitment to resilience

- Defence to expertise

Some clear examples show lack of «mindfulness» among people involved in the accident. There was low preoccupation with failure, e.g. data coming from the negative-pressure test were not considered as a concern. There was tendency to simplify interpretations: e.g. for the negative-pressure test, pressure in the drill pipe remaining at 1400psi was explained by the «bladder effect»: people were trying to find simple interpretation, without digging further into the problem. This is also a proof of lack of commitment to resilience, since for this «bladder effect» explanation, only one voice was listened (Anderson's).

Implication for risk reduction

It was never mentioned that special caution was taken, or that there was communication about risky situations between members of the team. For instance, the two men interpreting the results from the negative-pressure test were not aware of the previous problems encountered on the rig.

As a conclusion on the analysis of the accident from the HRO perspective, we can say that the companies working for Macondo were obviously not High Reliability Organizations. There was lack of caution and awareness of risks, which is reflected by lack of redundancy, inability to adapt the work to new conditions, and tendency to find quick and «easy» solutions and explanation.

Decision Making - Conflicting objective perspective

This perspective indicates how decision at various levels in an organization affects the outcome of the actions.

Table 5.4

Aspects of the perpective

Examples from Deepwater Horizon accident

Managers make wrong decision

- fail to fully comprehend the implication due to distance from daily operation

Not waiting for more centralizers of preferred design, which was a decision taken by the BP team on shore.

Migration of activities towards unacceptable performance

- warnings were received when a cross over to the boundary of safe performance.

The team on the rig (Transocean) did not perform further well integrity diagnosis when an unexpected negative pressure result was experienced.

Distributed decision making

- not all information is known to one person

- Decision by one actor may affect the decision of the next actor

The decision of not to installing additional physical barriers during temporary abandonment procedure was made by the BP team on shore. The team on board or the MMS authorities were not consulted while making such a decision.

Adherence to rules, culture and resources

- Self correcting organization

- Develop explicit mechanisms to reconcile formal norms with realities of daily work

BP team on shore took the decision to install the cement plug at 3,000feet below mud line that was against the MMS regulations. However they explained that this would be required to maintain well integrity and safety. Without further analysis or understanding this procedure was approved by MMS.

Levels of decision making

- Flow of information from bottom-up can be affected by controlling the amount of information or bypassing information to another level.

The personnel on the rig (BP and Transocean) did not perform any further analysis on the unexplained negative pressure test. Despite this it was informed to the team on shore that the negative pressure test was successful.

It can be confirmed that the rash decision made by BP and its contractors were focused on saving time and money. Such decisions can be taken as long as they do not compromise safety. However, in the case of Deepwater Horizon all the decision taken (e.g. on number of centralizers, negative pressure test evaluation, new well abandonment procedure, new slurry etc) lacked any sort of comprehensive and systematic risk analysis or peer review, where the risks of the available alternatives could have been evaluated. Information flow from the team offshore to the onshore team was also distorted (negative pressure test) and could have affected the decisions made by the team on-shore. Moreover most of the decisions were made by the on-shore team.

6. IRGC model

Figure 6.1 illustrates the deficits within the risk governance process for Deepwater Horizon accident.

Figure 6.1

The tables below show the deficits for the 5 main causes of Deepwater Horizon accident:

1. BP's decision not to run cement evaluation log.

Phase of the RG framework

Deficits

Pre-assessment

Known risk not recognized

Characterization & Evaluation

Impacts of decision not fully considered

Lack of transparency (decision made to save time)

Management

Inadequate information leading to inappropriate decision

Regulation not appropriate

Sustainability

Accountability

Communication

One-way information

Alienation

2. Lack of risk evaluation and risk communication on cementing decisions

- No analysis of combined impact of difficult drilling conditions (use of long string casing), of no bottom-up circulation, of less than recommended number of centralizers, of low rate of cement flow and of low cement volume.

- No special caution before relying on primary cement as a barrier to hydrocarbon flow.

- No communication about vigilance

- No information from Halliburton about instability of foam cement

Phase of the RG framework

Deficits

Pre-assessment

Warning

Scope

Appraisal

Information

Confidence

Characterization & Evaluation

Exclusion

Transparency

Overlooking values

Management

Inadequate information

Regulation

Sustainability

Inflexibility

Indecision

Accountability

Communication

One-way communication

Communication not adapted to category of risk

Alienation

3. Negative pressure test wrongly conducted (spacer used) &wrongly interpreted (pressure data)

Phase of the RG framework

Deficits

Pre-assessment

Warning

Scope

Framing

Black swans

Failure to learn from experience

Appraisal

Information

Confidence

Characterization & Evaluation

Transparency

Overlooking values

Management

Regulation

Sustainability

Inflexibility

Indecision

Communication

One-way communication

Communication not adapted to the category of risk

4. Temporary Abandonment Procedure

- Wrong decision of displacing mud with seawater.

- Wrong decision of setting cement plug 3,300 feet below the mudline (too down).

- Wrong decision of displacing mud before setting up another barrier.

- Procedure made known to the offshore team at last minute.

Phase of the RG framework

Deficits

Pre-assessment

Warning

Scope

Framing

Black swans

Failure to learn from experience

Appraisal

Information

Confidence

Characterization & Evaluation

Transparency

Overlooking values

Management

Regulation

Sustainability

Inflexibility

Indecision

Communication

One-way communication

Communication not adapted to the category of risk

5. Kick Detection: failure to see and interpret signals

Phase of the RG framework

Deficits

Pre-assessment

Warning

Failure to learn from experience

Characterization & Evaluation

Indecision

Management

Ignored information

Indecision

Communication

One-way information

Communication not adapted to the category of risk

Conclusions

Within analysis of the Deepwater Horizon accident, many deviations such as a failure in information processing and incorrect decisions were identified. They illustrated corresponding theories reflected in «Six perspective» report. Detailed analysis of the accident with regards to information processing perspective showed that in complex system information plays vital role providing ground for critical decisions and enabling successful functioning. Equally, the occurrence of the accident demonstrated the fact that BP and contractors failed to be a resilient organization - the organization which capable to withstand disturbances and continue working even being under the stress. Therefore, it can be concluded that in order to be resilient, the company should take into account all five perspectives. It is due to the fact that in a complex system a breach in one perspective such as a failure of the barrier can propagate to problems in different perspectives like information processing and decision making. Failures and successes of an organization in attempt to withstand obstacles are mostly driven by the capability to cope with complexity in everyday activities. So it is critical for the successful safety management to pay attention to «complex interaction» and «tight coupling» which are main components of NAT perspective. Adaptation to variability and preparedness to unexpected surprises, which are in focus in HRO theory, are prerequisite to overall resilience. However, for an organization to be resilient it is not only about adaptation and coping but also about proactive approach to organizational safety. It is always important to have a proactive focus on measuring of coping ability of the organization.

Recommendations

· To develop ability to cope with circumstances - to train personnel to take right decisions in a critical situation, for example, to cope effectively with leaks of hydrocarbons

· To develop understanding of tight couplings in complex interaction within technical systems and human cooperation

· To be able to address the actual. For example, for negative pressure test BP should have investigated further rather than concluding the high drill pressure as bladder effect. They should have developed procedures for abnormal drill pipe pressure.

· To be able to address the critical. For example, BP should improve their monitoring system for the drill pipe pressure by automating it, whereby abnormal pressure conditions should raise an alarm for operators to take action.

· To be able to address the potential. They should have performed risk analysis every time after each change in procedures.

· To be able to address the factual. It is important to learn from previous experience. Transocean management should have circulated the lessons learnt from the accident in North Sea and should have informed the PB. It is crucial to enable proper flow of the information within whole organization

References

1. Rosness, R. et al, 2010. Organisational Accidents and Resilient Organisations: Six Perspectives. SINTEF-report, 2010.

2. DEEP WATER. The Gulf Oil Disaster and the Future of Offshore Drilling. Report to the President. 3. National Commission on Deepwater Horizon Oil Spill and Offshore Drilling, 2010

4. IRGC. An introduction to the IRGC Risk Governance Framework. International Risk

Governance Council, 2007.

5. Deepwater Horizon Accident Investigation Report. Internal BP investigation, 2010

Размещено на Allbest.ru

...

Подобные документы

Работа, которую точно примут
Сколько стоит?

Работы в архивах красиво оформлены согласно требованиям ВУЗов и содержат рисунки, диаграммы, формулы и т.д.
PPT, PPTX и PDF-файлы представлены только в архивах.
Рекомендуем скачать работу.