On April 20, 2010, the Deepwater Horizon mobile offshore drilling unit exploded in the Gulf of Mexico while drilling the Macondo well 49 miles off of the Louisiana coast. The explosion killed 11 workers, started a massive oil spill and resulted in tens of billions of dollars of economic damage. Based on the findings of The National Commission on the Deepwater Horizon Oil Spill and Offshore Drilling, the disaster was a culmination of management failures by BP, Transocean and Halliburton. We should learn from their mistakes.
In March 2008, BP paid $34M to the Minerals Management Service for an exclusive lease to drill in a nine-square-mile plot in the Gulf of Mexico. BP served as the legal operator for this block, and Macondo was its first well on the new lease. BP was supported by its partners, Anadarko and MOEX, as well as two primary contractors: Transocean, a leading owner of deepwater drilling rigs, and Halliburton, one of the world’s largest oilfield services companies.
The immediate cause of the well blowout was a failure to contain hydrocarbon pressures at Macondo. Three things could have contained those pressures: the cement at the bottom of the well, the mud in the well and in the riser, and the blowout preventer. But mistakes and failures to appreciate risk compromised each of those potential barriers, steadily depriving the rig crew of safeguards until the blowout was inevitable and, at the end, uncontrollable. Most of the mistakes and oversights can be traced back to a single overarching failure – a failure of management.
- Lack of Change Control – BP’s management process did not adequately identify or address risks created by late changes to well design and procedures. BP did not have adequate controls in place to ensure that key decisions in the months leading up to the blowout were sound from an engineering perspective.
- Inadequate Testing – Halliburton and BP’s management processes did not ensure that cement was adequately tested. Halliburton had insufficient controls in place to ensure that laboratory testing was performed in a timely fashion or that test results were vetted rigorously in-house or with the client.
- Poor Communication – BP, Transocean and Halliburton failed to communicate adequately. Information appears to have been excessively compartmentalized at Macondo. BP did not share important information with its contractors, or sometimes internally with members of its own team, and vice versa. As a result, individuals often found themselves making critical decisions without a full appreciation for the context or without recognition that the decisions were critical.
- Poor Incorporation of Learning – Transocean failed to adequately communicate lessons from an earlier near-miss to its crew. An eerily similar near-miss on one of its rigs in the North Sea occurred four months prior to the Macondo blowout.
- Inadequate Risk Analysis – Decision-making processes did not adequately ensure that personnel fully considered the risks created by time- and money-saving decisions. There appears to have been no formal system for ensuring that alternative procedures were in fact equally safe.
Management should thoroughly understand and address risks in their operating environment. A mature understanding of risk drivers, likelihood and impact enables comprehensive analysis, informed decisions and specific communications to involved parties. As the Board that investigated the loss of the Columbia space shuttle noted, “complex systems almost always fail in complex ways.” A complex understanding of risk is essential to maintaining stability in complex operating environments.
“BP management had not distinguished between occupational safety – concern over slips, sprains and other workplace accidents – and process safety: hazard analysis, design for safety, material verification, equipment maintenance and process change reporting. BP was not investing leadership and other resources in managing the highest risks.”
Complexity and risks can increase exponentially during the extension of processes for new use or the inclusion of additional parties. Risks that were minimal in a stable process may be compounded in a changing environment, and while additional groups may bring increased capabilities – BP, Transocean, Anadarko, MOEX, etc. – there are inherent dangers in bringing more stakeholders into a single effort. Different organizations may have various processes, cultures or structures that may be difficult to unify, and risks may increase. Accountability and communication must be clear across parties, and the overall understanding of risks cannot be outsourced. Management should focus on generating, sharing and using performance measures that matter. While individual worker occupational safety is important (“10 Days Since Last Accident!”), measuring process risks provides higher-level, and more meaningful, information.
Better management by BP, Halliburton and Transocean would almost certainly have prevented the Macondo blowout by improving the ability of individuals to identify the risks they faced and to properly evaluate, communicate and address them. Fostering an environment with clear warning signals, incentives to share information and full appreciation for the relevant risks decreases the likelihood of catastrophic failure. Heeding these lessons will help avoid future disasters.