By Jeffrey T. Fowler, Ph.D.
Faculty Member, School of Security and Global Studies, American Military University
Public and private enterprises often use risk analysis in their planning. Risk analysis is the identification and analysis of risks, the probability that risks will occur, and the identification of countermeasures.
There are various ways to carry out a risk analysis. John Fay, former risk manager for British Petroleum (BP) operations in the Gulf of Mexico and the author of a well-known text on security management, suggested a classic risk analysis process as outlined here.
1) Identification of assets
2) Identification of threats
3) Probability of occurrence assessment
4) Impact assessment
5) Frequency assessment
6) Manageability assessment
7) Identification of countermeasures
Fay’s analysis includes the risks associated with human error in decision making and how these risks can result in death or serious bodily injury. A case in point is the Deepwater Horizon tragedy in 2010. It is perhaps ironic that Fay was at onetime BP’s security manager for operations in the Gulf of Mexico but that his risk analysis process was not followed.
The Deepwater Horizon Fatal Disaster
The Deepwater Horizon was an exploratory oil platform located in U.S. waters in the Gulf of Mexico. Transocean, the world’s primary operator of offshore oil rigs, owned this oil platform.
At the time of the explosion and fire in 2010, the Deepwater Horizon was under contract to BP, which owned the rights to oil exploitation in the Macondo Prospect area of the Gulf. Deepwater Horizon’s job was to locate an oil deposit, drill it, and move on while another rig exploited the find.
But on April 20, 2010, the Deepwater Horizon rig exploded and sank, killing 11 workers and injuring 17 others. It was the largest maritime oil spill in history. Had emergency measures gone as planned, the rig would have been successfully sealed and temporarily abandoned.
Additionally, Halliburton, a major supplier of products and services to the energy industry, was under contract to provide the cement foam seal and cement well plugs that would be used to cap the well prior to the crew abandoning the Deepwater Horizon. Schlumberger, a provider of oil and gas technology and analysis, was contracted to analyze data from the well logs.
The Risk of Human Error
In the oil industry, fire is always a risk because of the many volatile fuels and gases involved in the drilling process. There are very specific measures that must be taken before a rig like the Deepwater Horizon can be temporarily abandoned.
Here is a brief risk analysis review of the human errors that contributed to the disaster:
Schlumberger was responsible for analyzing the mud logs data taken from the Deepwater Horizon well. Mud log analysis is very expensive; the results are closely guarded corporate secrets, due to the competitive nature of the oil and gas industry.
BP also contracted Schlumberger to run the Cement Bond Log (CBL) test on the well plug, which is considered critical in determining well stability. The mud log data was analyzed, but the CBL test was not conducted according to the guidance of the rig leadership. The Schlumberger team requested that the on-site manager dump kill fluid down the well to cap the wellhead, but the BP manager refused When the Schlumberger team requested a helicopter to evacuate its personnel from the Deepwater Horizon, the BP manager said there were no immediate scheduled flights. Schlumberger sent a helicopter and the team left the rig at approximately 11:15 a.m. on the day of the explosion.
Halliburton was responsible for the cement used to seal the well. The cement seal would ensure that volatile gas in the rocks surrounding the well bore and casing could not seep to the surface. In addition, just before a well is sealed, special cement plugs are routinely lowered into the well.
Questions arose during the investigation into the tragedy about the strength of the special cement Halliburton used. Any cement used must cure before being it goes into the well. Investigators also questioned whether the cement had been allowed to cure properly before sealing the well and why no cement bore plug was used even though its use is common practice.
As the owner of the Deepwater Horizon platform, Transocean’s task was to drill into the Macondo Prospect, locate oil, establish a well, seal it and temporarily abandon the well for BP. On the night of the catastrophe, Transocean’s team on the rig, along with BP officials, had to determine whether it was safe to seal and temporarily abandon the well.
When a hole is drilled into rock in search of oil, that oil (and other gases in the rock), are under immense pressure. The oil within the drilled hole can explode and blow out to the surface in an uncontrollable manner.
The blowout preventer (BOP) is the primary industry-wide mechanical device used to prevent such an incident. But the BOP on the Deepwater Horizon did not function as intended that night, due to a drill pipe that buckled under compression.
British Petroleum
As the owner of drilling rights on the Macondo Prospect, it was BP’s responsibility to ensure that the well was operated in a safe and environmentally responsible manner. After the catastrophe, it was suggested that BP executives failed to execute proper risk management in three key areas:
- Untimely plan changes
- Failure to identify and properly respond to indicators of critical problems with the process, such as the failure to process and analyze the Cement Bond Log
- Inadequate response (in terms of the environmental disaster following the sinking of the rig)
Discussion of Key Risk Factors
The Macondo Prospect drilling contract was several days behind schedule and time certainly is money in industrial operations. Pressure to “get the job done” as soon as possible may have contributed to the fatal accident. Several key human error factors were also involved:
1) The Schlumberger team did not do a full analysis of the geologic safety of the well. The team performed the mud log analysis, but its request to perform a CBL was denied.
The team then requested that kill fluid be dumped down the well. This request was also denied. Schlumberger’s subsequent request for a helicopter and evacuation suggests the company was concerned about the safety of operational decisions regarding the abandonment of the well.
2) The post-disaster hearings questioned whether the cement used by Halliburton to seal the well was in line with industry best practices. Halliburton earlier had pled guilty to charges of destroying the results of two tests on the type of cement used in the Macondo Prospect well. While the test results were claimed to be satisfactory, the subsequent destruction of the results raises ethical questions and casts doubt on the official claims.
3) Transocean and BP personnel conducted two negative pressure tests to check the safety of the well on the night of the catastrophe. One test was conducted on the main well pipe and the second was conducted on the smaller “kill line.”
There are two pressure gauges in the Deepwater Horizon control room – one for the main pipeline and one for the kill line. A questionable reading on the kill line gauge was misinterpreted, which affected the decision to temporarily abandon the well with the ensuing fatal results.
4) An alarm failed to activate on the Deepwater Horizon rig. The alarm was allegedly placed intentionally in an inhibited state due to an administrative decision. This human error had a considerable impact on the safety of the people onboard the Deepwater Horizon.
Deepwater Horizon Accident Demonstrates Need for Risk Analysis
Oil and gas industry operations include inherent risk from natural, manmade (human error) and mechanical causes. Human errors were by no means the only reasons for the Deepwater Horizon disaster.
They do suggest, however, the importance of proper risk analysis and decision making prior to embarking upon a potentially dangerous operation – in this case, sealing and temporarily abandoning the well. The pressures of time and money are important with regard to business profitability, but they cannot override safety concerns.
About the Author
Dr. Jeffrey Fowler is an Assistant Professor in the School of Security and Global Studies at American Military University. He holds a B.A. in law enforcement from Marshall University, an M.A. in military history from Vermont College of Norwich University and a Ph.D. in business administration with a concentration in criminal justice from Northcentral University. Jeffrey is also a published author, a former New York deputy sheriff and a retired Army captain, having served over 20 years in the U.S. Army.
Comments are closed.