Fostering a Culture of Safety

white arrow on a blue background — (Photo by Nick Fewings on Unsplash)

By Tara Hoke

On April 20, 2010, an explosion on the BP drilling rig Deepwater Horizon killed 11 men and created a massive spill of oil in the Gulf of Mexico that continued unabated for nearly three months. In addition to the loss of life and the great harm done to the region's economy and ecology, the disaster has given rise to significant criminal and civil liability. In November 2012 BP pled guilty to 14 felony counts for its role in the Deepwater disaster, and the U.S. Department of Justice announced its indictment of two drilling rig managers on charges of negligent manslaughter. As is frequently the case with a catastrophic accident of this type, the disaster was not the result of an unforeseeable occurrence or even of a single, isolated mistake. Rather, it derived from a series of omissions, oversights, and bad decisions.

Situation

On April 20, 2010, work on the Deepwater Horizon carried out in connection with a new well in the Gulf of Mexico is winding down. Completion of the oil well will be undertaken by a smaller, more efficient rig, and that morning the Deepwater crew receives its instructions for the process of "temporary abandonment," that is, securing the well so that operations can be transferred from one rig to another.

Although Deepwater's departure had been planned for some time, the temporary abandonment procedure had been drawn up by BP's shoreside team only two weeks earlier, and it had then undergone a number of revisions. The installation of a "lockdown sleeve"-a safety mechanism for use during the well's output phase-would typically be performed by the smaller completion rig, but this project was already behind schedule. Reasoning that Deepwater could set the sleeve faster and at less cost than could its replacement, BP made several procedural adjustments to facilitate the placement of the lockdown sleeve during the abandonment process.

The procedure sent to Deepwater includes three tests designed to confirm the integrity and soundness of the well. The last of these tests is a "negative pressure test," during which the crew reduces pressure inside the well, simulating conditions that will occur when the well is abandoned. The test also monitors the integrity of the cement at the bottom of the well, ensuring that the cement fulfills its crucial task of preventing hydrocarbons from leaking into and up through the well when pressure is reduced.

The first step in preparing a negative pressure test is to pump a liquid mixture called a spacer down the drill pipe. The spacer is followed by seawater, the purpose being to displace the heavy drilling mud in the pipe to a point above the well's blowout preventer. The spacer chosen by BP in this particular case is unusual in both volume and composition, as it consists of fluids left over from the Deepwater drilling that BP wishes to avoid treating as hazardous waste.

In a properly sealed well, when the drill pipe pressure is bled to zero during a negative pressure test, the amount of backflow fluid is only enough to account for the pressure release. The pressure in the drill pipe will remain zero. But when the members of the Deepwater crew conduct the test, they are unable to bleed the pressure in the pipe to zero. They attribute the anomalous result to a loosened seal between the drill pipe and its blowout preventer that is allowing fluid to leak back down into the drill pipe. After the seal is tightened, the test is conducted for a second time, but once again there is a rise in pressure in the drill line and significant backflow.

One of the members of the drill team speculates that the increase in pressure is caused by what he terms a "bladder effect," meaning that the displaced mud is pushing down on the blowout preventer and the resultant pressure is being transmitted into the drill pipe. The well site leaders decide to conduct a third negative pressure test on the well, this time testing the effects of negative pressure on a "kill line," one of three pipes that run parallel to the drill line between the rig and the well. When this third test is performed, no pressure buildup or flow is observed on the kill line, but the pressure readings in the drill line remain high.

While unable to explain the pressure in the drill line, the well site leaders feel that the kill line results demonstrate the integrity of the bottom cement, and they declare the test a success. In fact, the test was no such thing, and the flow and pressure readings should have indicated to the crew that the cement was inadequate and that hydrocarbons were leaking into the well. Just a few hours later, emergency measures fail and hydrocarbons rising from the well ignite on the rig.

Question

What ethical lessons can be drawn from the negative pressure tests conducted before the Deepwater Horizon blowout?

Discussion

In its report to President Obama, the National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling listed a number of shortcomings in connection with the development and execution of the negative pressure test.

First, the changes made by the BP shoreside team to the temporary abandonment process and the decision to use an unusual spacer for the pressure test were not properly reviewed to ensure safety and soundness. In fact, the commission saw both of these as contributing to the disaster. The revised abandonment procedure increased the stresses on what proved to be unsound bottom concrete, and the viscous spacer material is believed to have seeped into and clogged the kill line, preventing a rise in pressure there that would have confirmed a leak in the well.

Furthermore, no standards existed for conducting the negative pressure test, and the rig team had received no written guidelines or formal training to help them interpret the results. The crew members appeared to have understood the test to be one of "flow or no flow," but they did not know how much flow to expect and were unaware of the importance of monitoring pressures. What is more, procedures either did not exist or were not enforced for reporting anomalous data, meaning that the rig crew failed to consult BP's shore-side team regarding the confusing negative pressure test results.

Perhaps even more significant, rig personnel seemed not to recognize the importance of the negative pressure test. If BP had explained how crucial the test was to the safety of the rig and its personnel, the crew members might have been more cautious in interpreting the results. Instead, as the commission saw it, "they started with the assumption that the well could not be flowing, and kept running tests and coming up with various explanations until they had convinced themselves their assumption was correct."

In short, the failure of the Deepwater crew to recognize the dangerous condition of their well was a direct result of a failure on the part of responsible professionals to institute procedures that would protect the safety and welfare of the people who relied on those procedures. In a broader sense, senior BP managers had failed to create a "culture of safety" to properly protect the public and minimize risks.

Canon 1 of ASCE's Code of Ethic states in part that engineers "shall hold paramount the safety, health, and welfare of the public." Category (a) in the guidelines to practice for this canon adds the following: "Engineers shall recognize that the lives, safety, health, and welfare of the general public are dependent upon engineering judgments, decisions, and practices incorporated into structures, machines, products, processes, and devices." These two provisions may be seen as the founding principles for establishing a "culture of safety," for they embody the engineer's obligation to view each professional choice in the light of its effect on the public.

Fostering a Culture of Safety

Situation

Question

Discussion

Further Reading