Events of Deepwater Horizon accident

Analysis

In April, BP engineers with Halliburton suggested that long string casing cannot be cemented reliably, so BP design team switched to liner. But that shift had conflicts with BP and BP emphasised that some of the inputs needs to be corrected and forced that long string should be a primary option as casing.

According to the report [1] regarding information perspective, the decision was based on BP's powerful position instead of facts and reality.

BP failed to process information as it seemed to disregard warnings; they were not concerned about immediate causation and were inflexible to make the right decision.

BP's design suggested using more than 16 centralizers. However Weatherford (a supplier) had only 6centalizers in stock.

BP failed to track the stocks of centralizers. This reflects breakdown of information flow within the organisations (BP and its supplier). It also reflects the lack of interest and concern from BP.

BP drilling engineer got permission from senior manager to get 15 additional slip-on centralizers. Gagliano found through simulations that using 21centralizers would cause less severe gas flow. One of the leader assured that custom-built centralizers would arrive, but instead, convention centralizers were delivered. Drilling engineer Cocales, said they would «probably be fine even without the additional centralizers».

Failure in information flow from BP to its supplier. Cocales's overconfidence made him make a wrong judgement on the decision to use less number of centralizers. This emphasises on misperception of the danger involved and erroneous assumption by Cocales.

Guide pointed out that new centralizers were not custom-made as specified. He was also concerned about the time for installation and complained about the addition of 45 more pieces of equipment to the casing could come off during installation. At last, Guide's point of view was prevailed and BP installed only the six centralizer subs on the Macondo production casing.

Attention to use the correct design of centralizers was distracted by a longer time to install the addition of 45 more pieces of equipment. It also reflects on power based decision i.e. «boss is always right».

According to M-I SWACO, drilling-mud subcontractor, 570 psi pressure is required to circulate mud after converting the float valves. However the rig crew reported about only 340 psi. BP Site Leader Bob Kaluza and Transocean crew, using circulating pumps, concluded that pressure gauge was defective.

Wrong interpretation of hazardous signals. No investigation done thus BP ignored hazard signals. The conclusion on the defective gauge was made too fast, based on an erroneous assumption.

BP engineers feared risks of lost-return, so instead of 2760 barrels only 350 barrels of mud was circulated. BP pumped cement at 4 barrels per minute, a lower rate than the optimal rate.

Attention was distracted by the fear of lost-returns, leading to a wrong decision. Moreover, the decision was not based on facts and figures.

BP compromised on the quantity of cement as it ran a risk of exerting more pressure on the formation. In doing so the height of the cement column was in compliance with the MMS regulation but not with BP's internal regulation. BP's own engineers recognized that 60 barrels of cement would provide little margin for error.

Attention distracted by risk of formation fracture.

The decision was contradictory with the internal regulation.

Hazardous signals and opinions of engineers about the cement were disregarded.

Even though Halliburton is an industry leader in foam cementing, BP seemed to have little experience with foam technology for cementing production casing in the Gulf of Mexico

Lack of information in BP about use of foam technology.

Cement blend that Halliburton planned to use at Macondo were laboratory tested. The report was sent to BP as an attachment in an email with some recommendations. However it included only the result of a single foam stability test and did not specify any kind of cement slurry instability. There was no evidence that BP examined the foam stability data.

Important information was neglected and not clearly presented since information on the instability was given only in the attachment and not clearly stated in the email.

Halliburton personnel had conducted other foam stability test under different conditions earlier in February which were not reported and had failed. Halliburton conducted another round of tests in mid-April, just before pumping the final cement job. By then, the BP team had given Halliburton more accurate information about the temperatures and pressures at the bottom of the Macondo well, and Halliburton continued further with cementing plan. The tests in April also concluded that cement slurry was unstable. Authorities believed that Halliburton never reported this information to BP.

No information flow from Halliburton to BP regarding the failed foam stability tests. The suppression of information might have been on purpose to save money and time.

Halliburton did not send the results of the final test to BP until April 26, six days after the blowout.

Negligence of delivering the information by Halliburton.

A 5.5 barrel of flow-back volume was observed, which was within error margin. However the flow details were not presented nor was it clear on how long did the personnel watched for potential flow. Eventually they concluded that the float valves were holding.

Detailed information on the cement back-flow was disregarded.

Wrong interpretation of hazard signals (flow characteristics).

BP and Halliburton informed the rest of the team that the cement job was a success.

Flow of wrong information which was linked to the physical event. The right information was not shared and there was suppression of right information.

In the morning of the accident, BP's onshore team disregarded the cement evaluation and test to be done by Schlumberger and sent them home. This was based on the «decision tree» with the main criteria being `losses while cementing long string'. As there were no lost returns, BP confirmed their decision.

Decisions (not performing cement evaluation test) were made with inadequate information. This also reflects on BP's power-influenced decision.

There were four distinguishing features of the temporary abandonment of the well.

First is the single 300-foot-long cement plug inside the wellbore. MMS regulations required BP to install a cement plug as a backup for the cement job at the bottom of the well.

Second is the location of the cement plug: BP planned to put it 3,300 feet below the ocean floor, or «mud line» (which was deeper than MMS regulations allowed without dispensation, and deeper than usual).

Third is the presence of seawater in the well below the sea floor: BP planned to replace 3,000 feet of mud in the wellbore above the cement plug with much lighter seawater (seawater weighs roughly 8.6 ppg, while the mud in the wellbore weighed roughly 14.5 ppg).

Fourth is the lockdown sleeve-a mechanical device that locks the long casing string to the wellhead to prevent it from lifting out of place during subsequent production operations.

Morel e-mailed an «Ops Note» to the rest of the Macondo team listing the temporary abandonment procedures for the well. It was the first time the BP Well Site Leaders on the rig had seen the procedures they would use that day.

The first two steps clearly indicate violation of regulations and a tacit acceptance of norms which was contradictory to the regulations. Delayed information on the new well abandonment procedure was sent to the team offshore.

From April 12 to April 20, there were numerous changes to the temporary abandonment procedures by BP. But there is no evidence that these changes went through any sort of formal risk assessment or management of change process

Decision on the temporary abandonment procedures were made with inadequate information or any sort of risk assessment.

At BP's direction, M-I SWACO created a spacer out of two different lost-circulation materials left over on the rig. The decision was made by BP in order to avoid having to dispose of them onshore as hazardous waste. This unusually large volume of spacer had never previously been used by anyone on the rig or by BP nor was it thoroughly tested for that purpose.

Decision for creation and use of such spacer was made with inadequate information and no thorough testing.

Kill line was left open for 30 minutes and no flow and 0psi was observed which confirmed the criteria for negative pressure test. But the pressure in drill pipe remained 1,400psi. Site leaders and crew members never reconciled the different pressure values. The Site leaders in consultation with the crew, made a key error and mistakenly concluded that the negative test procedure had confirmed the well's integrity and they declared the test a success.

It is evident that BP and the crew on board neglected the information on the pressure difference on the kill line and the drill pipe. They made an erroneous assumption that the negative pressure test was a success and it confirmed the well integrity.

The annular preventer was opened to displace mud and spacer from the riser. Halliburton was informed that the negative-pressure test had been successful and they should prepare to set the surface cement plug.

After making an erroneous assumption that the negative pressure was a success, BP asked Halliburton to proceed with the cement plug job. The details of the test were not shared with Halliburton which clearly indicates that BP suppressed correct information flow.

While displacing the riser with seawater the crew had to deal with large amounts of returning mud. The driller repeatedly rerouted the mud returns from one pit to another in order to accommodate the incoming volume. At the same time, the crew also sent mud from other locations into the active pit system. It is possible that it would be difficult to monitor active pit volume during that time given all the activity. However, drill-pipe pressure began slowly increasing, despite the fact that the pump rate remained constant.

The crew may have been distracted by other matters, which could be the reason that the above changes were not noticed.

It is understood that the crew's attention was distracted in dealing with the large volumes of mud return. As a result other abnormal parameters were not noticed by the crew.

The increase in pressure was clear in the Sperry Sun data and on the Hitec display, but it was not noticed by BP or its crew and the pump was turned back on. Soon the drill-pipe pressure increased, but so did the pump rate. Minutes later, a pressure-relief valve on one of the pumps blew. At about 9:20 p.m., senior tool pusher Randy Ezell called the rig floor and asked Jason Anderson about the negative-pressure test and the displacement. Anderson responded that, It went good and reassured Ezell that It was going fine and he had it under control.

A breakdown in information flow is observed between the rig floor and the senior tool pusher.

Moreover a suppression of information is seen and a false results or information was circulated to other personnel onboard.

When the Chief Mate enquired about the cement plug job, Revette and Anderson informed him that it would be delayed. He noticed them having a calm discussion on the differential pressure.

After instructing to bleed off the drill-pipe pressure, in an apparent attempt to eliminate the pressure difference, Revette and Anderson left the drill floor. They made no attempts to perform a visual flow check or shut in the well, despite the evidence of a kick.

Revette and Anderson did not feel the need to convey the abnormalities in the information observed, thus resulting in a breakdown of information.

They also disregarded important information/indications despite the evidence of a kick.

Aspects of NAT perspective

Examples from Deepwater Horizon accident

Complex systems are hard to control

For example, cementing was difficult to control due to complexity of technical systems involved in this procedure so it was hard to predict the results of cementing and additional simulation tests were needed in order to be sure that everything goes well.

Tight coupling of socio-technical systems

Technical systems used on the rig were complex and coupled tightly according to design and sophisticated functions. It is a quite demanding task to control these systems and any mistake regarding one system can easily provoke failures in other coupled systems. In this case information processing and decision making are getting more difficult than in linear systems. For example, one erroneous decision about centralizers led to many negative consequences. Correct decisions could have been taken only by trained personal based on risk assessment of the coupled systems.

Improvisation is difficult

With shortage of time and breakdown in information flow all improvised decisions are unlikely to be adequate. Under pressure of time, the crew made a wrong decision sending flow to mud-gas separator instead of sending overboard on the sea

Buffers and redundancy have to be designed

in the tightly coupled systems with complex interaction

It is important to be sure that necessary number of spare parts is always available from the supplier (the problem with centralizers).

It is vital but difficult to implement that all decisions are controlled by authorities or competent personnel. BP did not have adequate control in place to ensure that key decisions were safe. Initial well design decisions were reviewed by management, while changes to drilling procedures made the weeks and days before implementation were not reviewed by management of BP

Denial or lack of responsibility

MMS regulations: many critical or drilling issues were not considered in regulations and were left for industry to decide without agency review.

Neither regulator nor regulations were requiring the demonstration of preparedness. MMS does not have personnel with sufficient expertise and trainings to enforce the regulations on risk assessment effectively.

Safety is always competing with economical objectives.

Decisions taken were less costly and less time consuming but without risk analysis. Obviously, possible risk is often disregarded if some financial benefits can be achieved through unsafe operations.

Principles of the perspective

Examples from Deepwater Horizon accident

Failed to implement Haddon's strategy of either eliminating or reducing energy build up. Also indicates breakdown of barriers.

Long string casing vs. liner. A decision to use long string instead of liner should have forced BP and Halliburton to pay more focus on the cement job.

BP wanted to use the long string casing as they had planed earlier even when the analysis suggested that cement job would fail in case a long sting casing was to be used

Failure to examine the risk factors and perform a risk analysis.

Foam cement testing. Ignoring the results from the studies / analysis which indicated that the cement slurry was unstable, and further analyzing the cause of the 3 failed tests performed in February and April, Halliburton still proceeded with its use by modifying the conditions in the report and showing that slurry was stable. The failed reports were not reported to BP.

Failure to implement more than one barrier.

Risk evaluation of Macondo cementing decisions and procedures. Only one barrier prevailed i.e. cementing to prevent hydrocarbon flow to induce redundancy.

Failure in design and to provide alarms or warnings.

Kick Detection. The primary cause was inability to detect signs of kick formation due to human error and fatigue induced due to long working hours.

Failure to implement correct procedure.

Diversion and Blowout Preventer Activation. No or inadequate procedure or training involved in an emergency situation.

Characteristics of a HRO

Examples of lack of HRO characteristics in the case of Deepwater Horizon

Organizational redundancy

During the negative-pressure test, the men interpreting the data hadn't got a full appreciation of the context in which they were performing the test, due to poor communication. Moreover, there was no incentive for personnel to call back to shore for a second opinion about confusing data. Thus, the men interpreting the data of the negative-pressure test were alone in their job, without any supervision or help for detecting unusual data.

Spontaneous reconfiguration of the organization

Even if many unusual working conditions were known (difficult drilling conditions, less than recommended number of centralizers, low volume of cement, new spacer…), it doesn't seems like any particular attention was taken while performing the work and interpreting data. The team failed to adapt their work to abnormal and changing conditions and they kept doing what they were used to do, regardless of the unusual situation and under-estimating the risks of changes (e.g. lower number of centralizers, change in the temporary abandonment procedure).

«Mindfulness»:

- Preoccupation with failure

- Reluctance to simplify interpretations

- Sensitivity to operations

- Commitment to resilience

- Defence to expertise

Some clear examples show lack of «mindfulness» among people involved in the accident. There was low preoccupation with failure, e.g. data coming from the negative-pressure test were not considered as a concern. There was tendency to simplify interpretations: e.g. for the negative-pressure test, pressure in the drill pipe remaining at 1400psi was explained by the «bladder effect»: people were trying to find simple interpretation, without digging further into the problem. This is also a proof of lack of commitment to resilience, since for this «bladder effect» explanation, only one voice was listened (Anderson's).

Implication for risk reduction

It was never mentioned that special caution was taken, or that there was communication about risky situations between members of the team. For instance, the two men interpreting the results from the negative-pressure test were not aware of the previous problems encountered on the rig.

Aspects of the perpective

Examples from Deepwater Horizon accident

Managers make wrong decision

- fail to fully comprehend the implication due to distance from daily operation

Not waiting for more centralizers of preferred design, which was a decision taken by the BP team on shore.

Migration of activities towards unacceptable performance

- warnings were received when a cross over to the boundary of safe performance.

The team on the rig (Transocean) did not perform further well integrity diagnosis when an unexpected negative pressure result was experienced.

Distributed decision making

- not all information is known to one person

- Decision by one actor may affect the decision of the next actor

The decision of not to installing additional physical barriers during temporary abandonment procedure was made by the BP team on shore. The team on board or the MMS authorities were not consulted while making such a decision.

Adherence to rules, culture and resources

- Self correcting organization

- Develop explicit mechanisms to reconcile formal norms with realities of daily work

BP team on shore took the decision to install the cement plug at 3,000feet below mud line that was against the MMS regulations. However they explained that this would be required to maintain well integrity and safety. Without further analysis or understanding this procedure was approved by MMS.

Levels of decision making

- Flow of information from bottom-up can be affected by controlling the amount of information or bypassing information to another level.

The personnel on the rig (BP and Transocean) did not perform any further analysis on the unexplained negative pressure test. Despite this it was informed to the team on shore that the negative pressure test was successful.

Phase of the RG framework

Deficits

Pre-assessment

Known risk not recognized

Characterization & Evaluation

Impacts of decision not fully considered

Lack of transparency (decision made to save time)

Management

Inadequate information leading to inappropriate decision

Regulation not appropriate

Sustainability

Accountability

Communication

One-way information

Alienation

Phase of the RG framework

Deficits

Pre-assessment

Warning

Scope

Appraisal

Information

Confidence

Characterization & Evaluation

Exclusion

Transparency

Overlooking values

Management

Inadequate information

Regulation

Sustainability

Inflexibility

Indecision

Accountability

Communication

One-way communication

Communication not adapted to category of risk

Alienation

Phase of the RG framework

Deficits

Pre-assessment

Warning

Scope

Framing

Black swans

Failure to learn from experience

Appraisal

Information

Confidence

Characterization & Evaluation

Transparency

Overlooking values

Management

Regulation

Sustainability

Inflexibility

Indecision

Communication

One-way communication

Communication not adapted to the category of risk

Phase of the RG framework

Deficits

Pre-assessment

Warning

Scope

Framing

Black swans

Failure to learn from experience

Appraisal

Information

Confidence

Characterization & Evaluation

Transparency

Overlooking values

Management

Regulation

Sustainability

Inflexibility

Indecision

Communication

One-way communication

Communication not adapted to the category of risk

Phase of the RG framework

Deficits

Pre-assessment

Warning

Failure to learn from experience

Characterization & Evaluation

Indecision

Management

Ignored information

Indecision

Communication

One-way information

Communication not adapted to the category of risk