Professional Documents
Culture Documents
Case Study - Human Factors Analysis
Case Study - Human Factors Analysis
Background
On 20 April 2010, a catastrophic oil well blowout occurred onboard the Deepwater
Horizon oil rig which resulted in eleven deaths, the demise of the rig, and the largest
oil spill in history. The uncapped well impacted both local wildlife and the fishing
industry within the Gulf of Mexico. The events which led to the accident and
immediately after the explosions and fire have since become a landmark case in
process safety, law and politics. There are several important process safety
management (PSM) lessons to be learned from this incident. If the lessons learned
are diligently followed by the industry, mistakes can be avoided and the chances of a
similar accident happening again will be greatly reduced.
The Deepwater Horizon drilling rig was owned by Transocean, on hire to BP, in order
to drill the Macondo field, estimated to contain over 50 million barrels of oil, two and
a half miles below the seabed. The Deepwater Horizon was an ultra-deepwater,
semi-submersible drilling rig. It had been under contract to BP in the Gulf of Mexico
for approximately 9 years. Such a drilling rig was necessary at this location, as the
water was almost 5,000 feet deep, creating enormous pressures at the well. To
prevent the hydrocarbons (i.e., oil and gas) from rising upwards in the well to the
surface, a heavy fluid (known as drilling ‘mud’) is injected into the shaft.
The role of the Deepwater Horizon was to drill into the reservoir, then seal the well –
known as temporary abandonment – ready for a future production unit to recover the
oil. Drilling rigs such as these are mobile, moving around the world for contracts with
major oil companies such as BP. A production unit (which may be a floating facility,
or a semi-permanent unit fixed to the seabed) then connects to the well to recover
the hydrocarbons, possibly staying on location for decades. Delays meant that the
Deepwater Horizon was overdue to leave the Macondo well by six weeks. The
Macondo well had proved to be challenging, earning it the nickname “the well from
hell”.
Drilling for oil had always been hard, dirty, dangerous work, combining heavy
machinery and volatile hydrocarbons extracted at high pressures.
Since 2001, the Gulf of Mexico workforce – 35,000 people, working on drilling
rigs and production platforms – had suffered 1,550 injuries, 60 deaths, and 948
fires and explosions.
At the time, Transocean was a major offshore drilling rig contractor with over a
hundred of these drilling rigs under contract. The fees for such a rig (and the
specialist crew) could be up to $1 million per day. This contractual relationship
between Transocean and BP was to become a key issue in the legal proceedings
that followed the incident.
Drilling the Macondo well was exploratory in nature, the objective was to collect data
about the geology and quality of the oil and gas at its location. The crew of
Deepwater Horizon were in the process of sealing the well (known as ‘capping it off’)
before getting ready to move the drilling rig to a new location. As part of this process,
the pressure balance in the well is tested to see whether pressure is increasing. This
activity, planned in advance, was high-risk in terms of process safety (or ‘major
hazard’ safety). However, the BP and Transocean executives were discussing
occupational safety issues, such as working at height, hand-injury awareness and
the hazards of dropped objects.
During their tours of the Deepwater Horizon, the executives could not fail to witness
the ongoing discussions around how to perform the pressure tests and how to
interpret the results. They expressed some concern but were informed that all was
going well. A blowout had occurred on another Transocean rig in the North Sea four
months earlier, but the executives later testified that they were unaware of this or the
internal advisory note produced.
Incident summary
During the afternoon, the process of replacing the heavy fluids in the well with
seawater commenced. Unknown to the crew, oil was leaking into the well. As they
removed the heavy ‘drilling mud’, they were unknowingly replacing it with a lesser
volume of seawater due to the oil collecting at the bottom of the well. The imbalance
of heavy drilling mud and lighter seawater occurred 43 minutes before the blowout.
Due to several simultaneous operations (e.g., setting a cement cap on the well,
easing tension on the drilling risers), and the drilling mud being transferred to an
adjacent supply vessel, the crew were not closely monitoring the volumes of
mud/seawater flowing in the well.
As the drilling mud was removed, the only physical barrier still in place was the
Blowout Preventer (BOP). This is a huge mechanical device that can close around
the pipe, or as a last resort shear through and clamp the pipe, preventing
hydrocarbons from reaching the rig. However, this barrier requires a timely response
from a person on the rig.
Pressure continued to rise and that evening, methane gas expanded in the well,
pushing the drilling mud up onto the rig. The high-pressure gas followed the mud
onto the rig, where it found a source of ignition and exploded. The explosion and
fires took the lives of eleven men, whose bodies were never recovered. The four
executives and 111 workers were rescued, although there were many injuries.
The Deepwater Horizon rig burned for 36 hours and finally sank on 22 April 2010. Oil
flowed from the Macondo well for 87 days. It is estimated that at least 4 million
barrels of oil were spilled into the Gulf of Mexico before the well was controlled.
The Macondo well blowout is the worst offshore oil spill in history. Claims,
settlements and clean-up costs have risen to more than $42 billion. Nearly 800km of
coastline in Louisiana, Mississippi, Alabama and Florida was impacted.
The investigations
There were many investigations into this disaster, including by the Chemical Safety
and Hazard Investigation Board (CSB), National Commission, National Academy of
Engineering, Department of Interior, Joint Investigation Team (US Coast Guard and
Bureau of the Ocean Energy Management), Deepwater Horizon Study Group, BP
and Transocean. Some commentary below on the key human and organisational
factors.
Investigations found that the disaster was preventable, and was caused by failures in
risk management, technology, mechanical equipment, procedures, spill response
planning and human factors.
There were failures in three categories of barriers:
People (e.g., competency, leadership, culture)
Plant (e.g., the hardware, control systems and the facility layout)
Process (e.g., risk management systems).
History shows us that catastrophic events occur if there are failures in each of these
three barriers. The investigations show that risks were taken with every barrier, partly
on the assumption that other barriers would pick up any problems.
The loss of Deepwater Horizon was preventable. We can, with the benefit of
hindsight, identify a series of mistakes that were made by the various organisations
involved.
In order to prevent a blowout, there were several technical barriers in place, and I
have attempted to summarise hundreds of pages of analysis in a few paragraphs
below:
Cement job: The cement barrier did not isolate reservoir hydrocarbons. The quality
of the cement slurry was not adequate.
Cement evaluation: An independent evaluation of the cement job was neglected,
on the assumption that the cement job had been a success.
Well integrity test: BP and Transocean personnel determined that the well integrity
test was successful, even though the results were not conclusive.
Monitoring: The Macondo team did not properly monitor the well in the final hours
leading up to the blowout (mainly because of the earlier declaration that both the
cement job and the well integrity test had been successful).
Blow-Out Preventer: the BOP failed on two accounts. The pipe rams failed to seal
the well and the shear ram failed to shear the drill pipe. Given that the BOP was
designed to operate most effectively if activated long before hydrocarbons flowed
onto the rig, the monitoring failure above contributed to the failure of the BOP.
The incident response was certainly an unprecedented effort, with the clean-up
involving 6500 vessels and approximately 47,000 people. The incident response was
based around containment, dispersion and removal of oil. Initial plans were
insufficient to seal the flowing well. Several containment measures were attempted
but failed, and the well wasn’t sealed until 15 July 2010, almost three months after
the blowout.
In his book Disastrous Decisions, Hopkins stated that the original spill response was
“written to satisfy regulatory requirements rather than with any real concern about
how effective it might be” (Hopkins, 2012).
The Swiss Cheese fallacy
The Swiss Cheese model (Reason, 1997) is a neat way of showing how several
barriers must fail for an incident to occur. However, if some barriers are reliant on a
previous barrier, then these barriers are not independent. Therefore, as in this case,
the failure of one barrier (the inadequate cement job) led to the failure of other
barriers. Although the Swiss Cheese model gives the impression that there are
multiple layers of protection against an incident, this is not the case if the barriers are
inter-related.
The Macondo well was planned to cost BP around $96 million. But the well cost
much more than BP anticipated, having to seek additional funds from project
partners on several occasions. At the time of the blowout, BP had spent over $142
million on the well, which was more than 38 days behind schedule.
It is unclear to what extent these cost and time overruns impacted the decisions
made or behaviours at head office, or on the rig itself, but we do know that it was a
concern to at least some personnel on the rig.
“The Macondo disaster was not, as some have suggested, the result of a
coincidental alignment of disparate technical failures. While many technical
failures contributed to the blowout, the Chief Counsel’s team traces each of
them back to an overarching failure of management”
Although actions by the offshore crew onboard the Deepwater Horizon directly
contributed to the event, the crew had been set up to fail by much wider issues.
Confirmation bias
The well integrity test was a key barrier, but analysis of this shows that it was
misinterpreted. The purpose of the well integrity test is to check that the cement seal
was working prior to moving the rig away from the location. The crew knew from
experience that it is very unlikely the well would fail the test and so the test was seen
as a box-ticking exercise. The cement engineers declared the test a success, but
they were looking for confirmation that the well was sealed, not investigating whether
it was, or was not.
“Once the test had been declared a success, the driller and tool pusher appear to
have put any concerns about the test behind them rather than increasing their
vigilance” (National Commission on the BP Deepwater Horizon Oil Spill and Offshore
Drilling, Chief Counsel’s Report, p.244).
There were some indications that the well had failed the integrity test: that oil and
gas were passing the seal. However, these unexpected test results were explained
away the with ‘bladder effect’. The team then applied another technique to find the
confirmation that they were seeking, and once declared a success, the team moved
on from any concerns about the test. It appears that the team were looking for
feedback that confirmed the view that they had already made about the integrity of
the well. It didn’t help that there were simultaneous activities and other distractions.
“Once these processes are taken into account, the faulty decisions made
by the Macondo group become entirely understandable, terrifyingly so”
HOPKINS, 2012
Non-Technical skills
I have defined Non-Technical Skills elsewhere on this website as “the cognitive,
social and personal resource skills that complement technical skills and contribute to
safe and efficient task performance” (International Association of Oil and Gas
Producers, IOGP, 2014). In this incident, there were failures of several Non-
Technical Skills, including inaccurate Situation Awareness and Decision-Making
failures.
Gaining good situation awareness in a team revolves around three key questions:
For example:
Crew members on the drill floor were not aware of dynamic and substantial changes
in the status of the Macondo well.
‘Kicks’ from the well that signalled a blowout was imminent were not detected.
Over a 45-min period, various data indicating an impending blowout were not acted
upon (e.g., increases in drilling-pipe pressure, pressure differences between the drill
pipe and kill line).
The mud logger was separate from the well operations crew and unaware of
activities that impacted his understanding of the data he was meant to monitor.
There was an 80-minute period when the Tool pusher, Driller, Well Site Leader, and
others discussed pressure discrepancies between the drill pipe and the kill line. This
suggests that the crew recognised issues and had concerns. However, they did not
appear to consider the possibility of well integrity loss.
Their incomplete understanding of the situation led the crew to falsely interpret the
Negative Pressure Test (NPT) as successful. This misunderstanding influenced their
subsequent decisions, which ultimately led to the blowout.
The crew appear to be confused and were having difficulty interpreting the situation
as it developed. They had concerns but did not appear to understand the
significance of the developing situation in the well. The crew’s mental models (“the
picture that you have in your mind”) were not updated: and certainly, some of the
crew would not have the experience to be able to form an accurate mental model.
Therefore, the increasing pressure in the well was recognized as a concern but was
not interpreted as the well flowing.
In order to understand why the crew erroneously concluded that the well was stable,
the investigation reports show that:
The positive pressure test for the cement job of the casing conducted earlier in the
shift (approximately 11am), had been deemed a success, thus providing a strong
expectation that the forthcoming negative pressure test would also be successful.
The 3pm pre-job safety meeting did not mention any contingency procedure should
the test fail, thus priming the crew that the test would pass (i.e., setting an
expectation).
Information was not shared between the drill crew and the mud logger.
As late as 9.20pm, the senior Tool pusher was assured by the crew that “Everything
was fine”. But 20 minutes later, drilling mud was flowing out of the well onto the
Deepwater Horizon. At 9.49pm, high-pressure gas from the well reached the rig and
ignited.
The investigations suggest that “group think” may have influenced the crew’s
decision making. The crew were wanting to arrive at a consensus decision. There is
considerable research to show that a feature of small groups is they seek a
unanimous decision – everyone must agree. We also know that decisions made by
groups are more likely to be risky than decisions taken by individuals (known as the
“risky shift”).
As group consensus was that the Macondo well was safe, and therefore activities
could continue, no individual was required to take responsibility for the decision to
proceed.
Psychological safety
Psychological safety includes a belief that the workplace is safe for speaking up with
ideas, questions, concerns and even mistakes. It’s a sense of confidence that your
voice is valued. However, a survey of Transocean crew working on the Deepwater
Horizon rig a few weeks before the disaster highlighted that 46% of crew members
surveyed felt that the workforce feared reprisals for reporting unsafe situations
(National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling,
2011, p.224).
Communications
Critical information was not communicated from one organisation to another (there
were several contractors working on the Deepwater Horizon at any one time), or
even within an organisation. For example, the offshore crew were not informed that
the cement job might be more likely to fail at the Macondo well than elsewhere and
to be extra vigilant. There are several cases of key decisions being made without
complete information. The National Commission Report refers to these issues as
“information compartmentalisation”.
During the unexpected results from well testing, the rig crew did not seek advice or
support from experts onshore. The guidance as to when offshore personnel should
consult the onshore team was not clear (and we know from other disasters that there
may be a reluctance to seek help from remote engineering teams).
Organisational change
There was confusion amongst leadership as to who was accountable for key
decisions.
Besides the changes to reporting relationships, the reorganisation meant that many
of the managers overseeing the Macondo project had only a few months of
experience in their positions at the time of the disaster.
“the companies failed to provide the rig crew and well site leaders exercising that
judgment with adequate training, information, procedures, and support to do their
jobs effectively” (Chief Counsel’s Report, p.235).
However, procedures for such safety critical operations would outline agreed
practices and provide guidance for potential events, such as a loss of well control.
Procedures facilitate human performance by documenting the intended steps of a
task.
Key rig procedures, such as the Temporary Abandonment plan were updated on
several occasions during April 2010. The CSB investigation notes that this plan
occurred without a formal process. The changes to this plan had the potential to
negatively affect well control barriers, but the impact of those changes was not
assessed.
“Changes to the well design and procedures made in the month prior to the blowout
created risks that were not adequately addressed by the Macondo team” (Staff
presentation to the National Commission, December 2010).
In fact, it appears that the onshore team were struggling to keep up with operations
on the Deepwater Horizon. Much-needed procedures were provided to the rig at the
last minute. The crew had little time to digest these prior to undertaking the critical
activities.
“Thus, at Macondo, the operator [BP] and drilling contractor [Transocean] each
presumed the other was responsible for a proper negative test procedure. The crew
was left to put together something to get the work done”
The response to the well control event prior to the explosion suggests that the crew
were insufficiently prepared to manage an escalating well control situation.
Fatigue
The Transocean crew of Deepwater Horizon worked offshore for 21 days at a time (a
‘hitch’, or ‘tour’), working 12-hour shifts. Although it’s not possible to make robust
links between their working pattern and the incident, we do know that performance
decreases as the periods of consecutive shift work increases. We also know that the
ratio of fatalities and severe injuries to less severe injuries is markedly higher for
hitches longer than 14 days.
At the time of the incident, the Driller and one Assistant Driller were on shift number
20 of 21; the second Assistant Driller was on shift 19 of 21; and the day shift Tool
pusher was on day 20.
A safety culture survey conducted a few weeks before the incident contained
comments from the crew that the 21-day pattern was causing fatigue. Comments
from the crew included “On their last week, they seem like they are in another world”
and “On the last week, you are so tired that you feel like a robot”.
Engineering design
The Mud-Gas Separator (MGS) is able to remove small amounts of gas from the
drilling mud. This gas is then vented to atmosphere at a safe location. During the
event, the rig crew diverted the high flow of hydrocarbons to the MGS, which
overwhelmed the system.
The crew had the alternative option of diverting hydrocarbons overboard, which may
have vented the majority of the gas safely. This diverter option may have given the
crew more time to respond, reduced the likelihood of ignition, or may have reduced
the consequences of the event. However, the design of the MGS allowed fluids from
the riser to be diverted to the Mud-Gas Separator when the well was in a high flow
condition (i.e. during a blowout).
Unfortunately, when the increasing flow of gas, oil, mud and water was diverted to
the MGS, it vented hydrocarbons directly back onto the rig. Within minutes, large
areas of the Deepwater Horizon were enveloped in a flammable mixture.
We must also consider the design of the well itself. For example, the office-based
engineers who designed how the well would be plugged with cement made several
decisions based on financial risks, without fully understanding the impact on safety.
Decisions were made that increased the risk of cement failure. Chapter 4 of the
Report to the President begins with a quote from a Macondo engineer’s email: “But,
who cares, it’s done, end of story, [we] will probably be fine and we’ll get a good
cement job.”
Final thoughts
Operations related to the Macondo well required a heavy reliance on people: on
human judgement in particular.
It would be wrong to focus on the actions and decisions of those people on the
Deepwater Horizon drilling rig, or those staff onshore who were closely linked to the
Macondo well. Hindsight is a powerful tool, and it’s easy to find fault, especially given
the benefit of time and the huge resources applied to these detailed investigations.
But even so, the failures of the various organisations involved are not unique to
those organisations. If you conclude that somehow these organisations are different
to yourselves, then you will fail to learn the lessons. And there are many lessons
here – not just for the oil and gas industry – but for all organisations.
The Macondo disaster echoes those disasters that have gone before, across many
industries. The recurring themes are missed warning signals, failure to share
information and an inadequate appreciation for the risks involved. If, as the Columbia
Accident Investigation Board concluded, “complex systems almost always fail in
complex ways”, then where do we go from here?
When organisations operate at the very frontiers of technology, we can’t allow an
understanding of the human factors involved to lag behind. Unfortunately, for all of
those touched by this tragedy, in this case it did.
The Senior Tool pusher is the senior drilling operations supervisor, second only to
the OIM in the chain of command.
Tool pushers are drilling managers who direct and supervise day-to-day drilling
operations on a drilling rig.
Drillers and assistant drillers work in the drill shack and are responsible for
operating drilling machinery and monitoring and controlling the well.
Floor hands and roustabouts provide the labour force for drilling operations.
https://humanfactors101.com/incidents/macondo-deepwater-horizon/
Investigation reports