The BP Gulf Oil Spill: A Risk Management Debacle
The BP Gulf oil spill is the worst risk management story, and the best risk management story. It is the best risk management case study: it illustrates vividly how a working risk management program could have (would have) prevented the debacle — not in a “hindsight” manner, but rather in a factual and clearly observable way.
BP appears to have violated all of the following:
- Government regulations
- Safety and loss control standards for the oil exploration industry
- BP’s own safety and loss control standards
- Core risk management principles
The event also showed how BP personnel fell into the traps set by the psychology of risk. Human instincts are flawed when it comes to risk management. For example we focus on the frequent loss, but ignore the vastly more important severe loss. Our minds pay attention to the apparent risks while ignoring the severe remote ones. Ironically BP was, about the time of the blowout, receiving a safety award for the project. They were able to concentrate on the likely events and prevent them (the easy part of loss control), while ignoring the less likely catastrophe.
Even with this mindset, BP was given the gift of warning after warning that a disaster was brewing. Since there was apparently no risk management culture at the company, all were ignored.
In most companies risk management falls under the domain of the CFO. CFOs take note: this event should have been prevented; and it would have been prevented– not with heroic risk management efforts, but with a reasonably competent risk management effort. This story shows how risk management can, and does, work.
A series of investigative reports have just been released. This article is based in part on information contained in the following reports:
- Bureau of Ocean Energy Management (BOEM) September 14, 2011 report
- BP Deepwater Horizon Accident Investigation Report, September 8, 2010
- National Commission on the BP Deepwater Horizon Oil Spill – Report to the President, January, 2011
BP’s own report, released shortly after the incident, stated the following:
“The team did not identify any single action or inaction that caused this accident. Rather, a complex and interlinked series of … failures, human judgments, engineering design, operational implementation and team interfaces came together….”
We don’t know if BP thought this statement was some form of exoneration, as if a whole series of things went wrong, therefore it was an unexpected and overwhelming deluge over which they couldn’t possibly have gained control. In fact, from a risk management standpoint, it was a damning statement. Complex systems fail in complex ways. Usually, as in this BP case, many things need to go wrong for such a disaster to occur; thus, the company has many opportunities to break the chain of failure. It takes a culture that gives little respect to the concept of risk management for so many disastrous mistakes to be possible.
What Happened On Board the Drilling Rig Deepwater Horizon?
Here is a timeline of the events:
- 10/07/09 drilling begins
- 10/09/09 experience a “kick”
- 03/08/10 experience another kick
- 04/14/10 reach the target zone
- 04/19/10 begin procedures to “plug and abandon”
- 04/20/10 10:00 pm – blowout
The rig was floating in 5000 feet of water in the Gulf of Mexico, and was about to drill another 13,000 feet below the ocean floor, for a total depth of 18,000 feet. As they drilled, certain problems were encountered, some to be expected, some unusual and problematic. In October of 2009, the crew experienced a “kick” from the well, an indication of a problem controlling the pressure to which a well is constantly subject. This might be considered a precursor to a blowout, one that is not so severe that it can’t be brought under control, but indication of a problem that has to be understood.
Again on March 8, 2010, a kick was encountered, this one more severe than the one the prior October. BP staff were concerned. One BP manager emailed to headquarters that the well site leaders “are not well control experts … especially at 1200 feet off the bottom with many unknowns.” BP did not investigate the causes, a violation of its own policy.
A Nightmare Well
On 4/14/10 drilling was stopped in a certain spot called a “sand-shale interface.” They were forced to stop there because drilling any further would cause the pressure to increase to too great a level. Per the BOEM report:
“By terminating the well where it did, BP set the total depth of the well in a sand-shale interface. BP internal guidelines…specify that drilling should not be stopped in [this kind of area because it] increases the likelihood of cement channeling or contamination.”
On the same day a BP drilling engineer emailed to supervisors that “[Macondo is] a nightmare well that has everyone all over the place.”
It is good at this point to stop and consider components of a good risk management program, so that BP’s actions can be evaluated in comparison.
“Risk Management” is a broad practice that includes, among other different components, loss prevention, loss reduction, loss mitigation, safety, all of which we will put in the category of Loss Control. The elements of Loss Control can be listed as follows:
- Management commitment and involvement
- Communication – both ways, up and down
- Accountability – for loss control results
- Training – in both technical aspects of the work and in loss control rules and policies
- Complete integration – creation of a loss control culture
- No fear environment – freedom to slow production or stop the project if a safety concern warrants it, without reprisal
At this point in the timeline notice what has already happened:
There is no indication of a risk management culture at all aboard the Deepwater Horizon. Although there are several players in this project including the rig owner from whom BP was leasing the rig (Transocean), and the oil service contractor Halliburton, BP was in charge. For our purposes, it is ok to think of them as the “general contractor” on the job, for whom all the other parties worked. BP leased the well from the federal government, and was in charge of the project.
From the standpoint of risk management, BP so far is missing in action. Already, by April 10, BP has had sufficient warning of problems brewing, yet has taken no action whatsoever. Management commitment and involvement is nowhere to be seen, communication has gone up the ladder, but nothing has come back down, and no one has stepped forward to say “slow down.”
On April 14 there was communication between BP and Halliburton indicating more problems. Halliburton was the company involved in providing the cement for the project. Cement seals the space between the drill pipe and the outside of the hole, preventing “hydrocarbons” from rising up to the rig, and also is what seals the well at the end of the drilling process, so the well can be temporarily “abandoned” until actual oil production begins at a later point.
On the 14th Halliburton recommended a “liner” instead of a “long string casing” because of potential problems with the cement. But rather than agreeing with Halliburton, BP has their internal design team do their own modeling of the cement and they come to the opposite conclusion. Keep in mind Halliburton is the cementing expert. Also, it’s interesting to know that BP’s own method is stated to have saved BP $7 to $10 million. Although BP initially blamed various parties including Halliburton, the reports seem to show them focused on production and speed at any cost. [BP and Halliburton are embroiled in litigation, so more information about the relationship between the parties may be released as a result; we are basing statements on the subject herein on the investigative reports].
On April 18 a float collar (something like a check valve allowing flow only in one direction) was inserted in the well, but would not lock in the closed position. Finally BP guesses (wrongly) that it is in the locked position and moves on without giving it a second thought. BP logs show ”[the float collar] shifted at 3140 psi. Or we hope so.” It turns out it had not locked in closed position and this contributed to the blowout.
On April 19, BP again ignored opinions by Halliburton on the cement. BP decided on a lower density “nitrified foam” cement, but an on- site Halliburton engineer told BP that the cement strength analysis had not been completed (so they could not know whether the lower density cement would be ok). Per the BOEM report: “Nevertheless, BP continued the cement job without this information.” In post-blowout testing the cement did not meet the standards for the application.
In evaluating the risk management to date:
The focus is clearly on saving money, speed and production. The rig day rate (charge to BP for use of the rig perday) was $533,495. Those onboard the rig were risking their own lives. They were apparently not aware of the growing risks right in front of their faces. Shortcuts were being constantly taken. If anyone was fully aware of the situation, he was not confident or comfortable enough to come forward. There was clearly either lack of training or fear of reprisal, likely both. Lack of accountability is evident in this email to supervisors by a BP Wells Team Leader on April 17:
“What is my authority? With the separation of engineering and operations I do not know what I can and cannot do. The operation is not going to succeed if we continue in this manner.”
This separation is the antithesis of the “integration” principle of good risk management. Can “engineering” advocate caution, pushing the science to the forefront, only to be overruled by “operations” whose goal is getting the job done, and fast? Not with true integration.
Suggestions of extra precautions were apparently overruled with a clear expression of the priorities. On April 20, a BP Wells Team Leader sent the following to an apparently, in his mind, overly cautious fellow employee:
“We will never know if your million dollar flush run was needed. How does this get us to sector leadership?”
The Negative Pressure Test – The Last Straw
Per the BOEM report:
“A negative pressure test is critical because it tests the integrity of …the well.”
A negative pressure test is the final test before closing up and moving on from the well. It is designed to detect any leaks in the well and to make certain the well integrity is secure.
Caution, this may be shocking to you (though not as shocking as before you started reading): Per the BOEM report:
“Neither BP nor Transocean had pre-existing negative test standards and procedures.” In discussing how to do this crucial test, one of the key BP players in the test said to upper management (requesting guidance): “I have gotten different opinions from everyone on the team.”
In the government’s investigation, this statement was elicited from one of the on-rig employees (discussing another kind of critical error just prior to the blowout): “Keith testified, however, that the high level of mud-moving activities should have resulted in a stop-work order from someone on the rig.” -emphasis added.
As with many disasters in history, many people on board had serious reservations, but everybody was waiting for someone else to act. The psychology of risk, in a couple of its many manifestations was in play here:
- More risk is taken in group situations that would be taken by any single member of the group. There is a misplaced comfort gained from the group dynamic;
- Many of the errors made had been made before- to put it another way the same shortcuts had been taken before- with no ill effects. Great disasters are rare because they require a statistically remote chain of events. We can handle the frequent but not severe events because we have experience with them. In a poor risk management culture, however, the less likely severe event is bubbling under the surface without any attention paid.
On 4/20/10 at 5:00 pm the first negative pressure test failed. The BOEM report gives this interpretation: “The increase in drill pipe pressure is evidence of an unsuccessful negative test and show the well was possibly flowing.” – emphasis added.
On 4/20/10 at 6:45 pm, the second negative pressure test also failed. Per dialogue captured in the reports, the crew was interpreting the pressure as a to- be- expected “bladder effect.” A rig worker called the BP Houston office to discuss and the reply from Houston was “a successful negative test could not result in pressure on the drill pipe.” In other words what you are experiencing cannot be reconciled with a successful test.
At this critical point, regardless of how many opportunities have been missed till now, BP had the opportunity once again to prevent disaster. It is astounding how everyone up and down the chain at the company was able to ignore such bountiful evidence of impending disaster, particularly at this juncture. It is another lesson in the psychology of risk that group think can take over when there is no culture, no training, no management commitment and no accountability to say otherwise.
Houston apparently accepted the rig’s explanation of the “bladder effect” notwithstanding their prior comments about the pressure. The blowout occurred that night at 10:00 pm.
In a post-mortem investigation by BP (on April 27, 2010), BP Vice President Mike Zanghi forwarded the previously discussed description of the so-called “bladder effect” to engineer Patrick O’Bryan for his comments. O’Bryan responded as follows:
© Licata Risk & Insurance Advisors, Inc. 2012
Jan 09, 2012