THE JOURNAL OF ENERGY AND DEVELOPMENT

George Baker,

The Political Science of Industrial Safety: Have the Deeper Lessons of Deepwater Horizon Been Learned?,
Volume 36, Number 2

Copyright 2012

THE POLITICAL SCIENCE OF INDUSTRIAL SAFETY: HAVE THE DEEPER LESSONS OF DEEPWATER HORIZON BEEN LEARNED?
George Baker*

Introduction f, during the fateful daylight hours on April 20, 2010, the members of the VIP joint safety audit team that was visiting Deepwater Horizonthe ultra-deepwater, offshore oil righad met privately with the Transocean site manager, they would have learned of a disagreement regarding the safety risks associated with a procedure that was then taking place. The Transocean manager regarded the BP decision as so unreasonable that he remarked, fatefully, [decisions like that are the reason] why we have blowout preventers.1 The audit team would have learned that in the temporary well abandonment process, BP had ordered the displacement of heavy drilling mud in four miles of well bore and risers with much lighter sea water in a well that had penetrated an

*George Baker is the Managing Principal of Baker & Associates, Energy Consultants. The firm, based in Houston since 1996, provides back-office analysis through its Mexico Energy Intelligence (MEI) reporting, along with briefings and workshops on developments in Mexican energy, law, and contracts. The author earned a Ph.D. in history from Duke and an M.A. in social sciences form California State, Fullerton. He has held positions at several academic and commercial organizations, among them New Mexico State University, where in the late 1980s he was executive secretary of a bi-national consortium of public universities with academic programs on U.S.-Mexico policy matters. In tracking Pemex, the national oil company of Mexico, and its goal to become a deepwater producer, his concerns have come to include public oversight and industrial organization and safety. Based on his interviews with industry and government sources from the United States, Mexico, and Cuba, Baker concludes that the lessons of Macondo will not have been learned until they are applied equally across the Gulf of Mexico. The Journal of Energy and Development, Vol. 36, Nos. 1 and 2 Copyright 2012 by the International Research Center for Energy and Economic Development (ICEED). All rights reserved.

219

220

THE JOURNAL OF ENERGY AND DEVELOPMENT

over-pressured reservoir; but the rub was that the integrity of the cement plug had not yet been unequivocally established. During the time of the VIP visit, the Transocean staff was carrying out the negative pressure test, by which the pressure in the well bore above the cement barrier is reduced in order to detect if that condition produces flows of liquids or gas.2 The correct interpretation of this test is the single most important industrial safety check associated with temporary well abandonment. Professor Andrew Hopkins of the Australian National University writes:
[The staff] ultimately misinterpreted the results of their testing and concluded that the well was secure when in fact it was flowing. This was a terrible mistake, calling into question the 3 competence and training of all those involved.

The VIPs visited the drilling shack where rig personnel were engaged in a discussion of how the test is performed and how to measure the results. A Transocean executive, possibly smelling trouble, suggested that the on-site rig manager stay behind in the tour to oversee the process.4 Later in the day, the executive asked the manager if the test had gone well and was given a thumbs up. Hopkins observes that the question, as posed, was more conversational than one of a serious inquiry. The executive did not exercise his role as auditor of this Critical-to-Quality measure.5 Hopkins notes there was a second opportunity for the VIPs to exercise the role of safety auditors: safety rules required that the crew monitor the volume of fluids extracted from the well in order to make sure that they were in balance with the fluids going into the well. If more fluids were coming out than going in, it meant that the well was flowing (which it was). Lack of attention to this process meant that the final opportunity to prevent the blowout was missed. Background Anthropologists in the late 19th and early 20th centuries, studying primitive (non-literate) societies, introduced the term culture to refer to the set of attitudes, behaviors, beliefs, and taboos that characterize the members of a population that may be identified by geographical, religious, or linguistic grounds. By its polyvalent nature, culture lacks a single metric by which to measure its presence. Industry uses the term safety culture as a metaphor in a vaguely quantitative way to refer to attitudes and practices that, in principle, could be scored higher or lower in terms of an awareness of, and attention to, risk. A safety culture also may be regarded as positive or negative. In relation to the Deepwater Horizon drilling rig, the U.S. Coast Guard in its report determined that the safety culture was lax.6 Since the 1980s there has been extensive research into the nature of safety culture, but the concept itself remains ill-defined. Consider two characterizations:

INDUSTRIAL SAFETY & DEEPWATER HORIZON

221

. . . [t]he product of individual and group values, attitudes, perceptions, competencies, and patterns of behaviour that determine the commitment to, and the style and proficiency of, an organizations health and safety management. Organizations with a positive safety culture are characterized by communications founded on mutual trust, by shared perceptions of the importance of safety and by confidence in the 7 efficacy of preventive measures.

There is an element of circularity in these characterizations: a company with a positive safety culture is one where there are shared perceptions of the importance of safety, but what, precisely, is meant by safety? Discussion The discussion that follows seeks to abstract from the facts and lessons of the Deepwater Horizon accident in order to gain a higher level overview. The goal is to glimpse, however dimly, the shape of the new paradigm of accountability in relation to accident prevention and liability that will apply to industrial infrastructure in general, and not just to offshore facilities in the oil industry.
The Starting Point for Understanding the Deepwater Horizon Accident: As Professor Hopkins tells the story, the starting point for understanding what went wrong on the Deepwater Horizon on April 20, 2010, is to divide the concept of safety itself into two components: occupational safety and industrial safety (or process safety). The first is concerned with conditions that may lead to the slips and falls of an individual employee; the second deals with those components and procedures whose failure or non-compliance puts at risk the physical integrity of the infrastructure and the lives of employees en bloc. The Safety Audit of April 20, 2010: As mentioned earlier, on the day of the

accident at the Deepwater Horizon, the rig was visited by a safety audit team that was composed of two senior officials each from the principal contracting parties, namely, BP and Transocean. The team busied itself with matters of occupational safety, but ignored the grand drama of industrial safety. As a result of the failure of the team to look beyond occupational safety, the catastrophe that was unfolding before the diverted eyes of the safety audit team members was ignored. In subsequent testimony, the auditors explained that they did not look into operations at the mud shack so as not to give the impression that the qualifications and professionalism of the chief mud engineer and his crew were being questioned. Testimony also was given by employees about the protocol that was called in Transocean Time Out for Safety, by which a junior line manager may call for a suspension of the plant operations where a safety issue is seen to be at risk. Even though some employees intuited something was amiss, it did not occur to them to implement this procedure, i.e., call for a suspension of the questioned operations.

222

THE JOURNAL OF ENERGY AND DEVELOPMENT

What is Being Audited in Safety Audits? All safety audits have common concerns: not only the condition of safety equipment but the condition of safety alarm systems, such as hydrogen sulfate alarms on rig platforms and safety alerts in crew quarters. Beyond matters of the material conditions, a safety audit should evaluate the quality of training, supervision, and performance. Occupational Safety: The safety audits regarding occupational safety are well known, perhaps to a fault; the protocols for inspecting conditions where injury to head, limbs, and organs have been well established in most industries. Process Safety: The auditing of process safety at an industrial facility requires a breadth and depth of industry background as the audit may entail making judgments about a dozen or more independent systems, any one of which, if it should fail, would put in jeopardy the crew and the facility. Quality of Technical Supervision: Technical supervision requires constant training and verification. On the Deepwater Horizon it would soon become apparentbut only after the auditors left the rigthat the training and supervision of the crew regarding the critical test of well integrity were inadequate. Rogue Behavior: The banking industry has seen disastrous outcomes of the speculative behavior of traders who were acting on their own impulses and agendas outside of company norms and rules. There is no reason to suppose that such rogues, as they have been termed in the media, exist only in the banking industry.8 Auditors, personnel managers, and line managers need to be alert for signs of rogue behavior. Safety Politics and Appearances: The evidence and personal anecdotes as presented by Professor Hopkins indicate that the notions of Time Out for Safety and Stop-Work Authority are far from being tools that enhance safety; he suggests that they serve mainly as slogans in corporate safety advertising. While a manager may stop a production line if there is risk to an employee, it is unlikely that either one would risk asking for the suspension of all production owing to a risk to the facility. The question has been raised as to why the Transocean manager, who, by press accounts, strongly disagreed with the well abandonment procedures that the BP site manager had requested, did not order a suspension of all work pending a review by onshore authority. Why, in other words, did he not exercise his Stop-Work Authority?9 The answers to these questions are probably found in the money on the table: the fully loaded, daily cost of operating the rig was in the neighborhood of $1 million. For Transocean to have ordered the abandonment process be suspended, it likely would have been liable by contract to BP for that amount. In addition, there may have been bonuses and penalties at stake both for the site and onshore managers that motivated them to get the rig off the Macondo well site without further delay. Features of the Next Safety Accountability Regime: This discussion suggests that

changes in the legal, regulatory, and contractual frameworks governing industrial accidents are ahead. In response to the Macondo accident, and to others like

INDUSTRIAL SAFETY & DEEPWATER HORIZON

223

itoffshore or otherwisesooner or later the law in the United States and in most other countries around the world will be changed. 1. Contractors and owners will be jointly and severally liable for accidents at industrial facilities, offshore and otherwise, but not in equal proportion. Perhaps the well owner would be liable for 70 percent of costs, with key contractors collectively being responsible for the remainder. The goal here is to break through the mindset of complacency of contractors who tell themselves that it is the operator, not the contractor, who is on the hook for liabilities. 2. The joint-liability model will entail new insurance requirements to reflect risk exposure. A system of differentiated liability caps may be needed for distinct classes of contractors. 3. There will be incentives and sanctions for agencies and public servants responsible for permitting and regulatory enforcement. Observations In his analysis of testimony after the Macondo accident, Professor Hopkins concluded that auditors chose not to inquire into the state of training and supervision of personnel in the mud shack, even though the entire integrity of the rig depended upon the accuracy and thoroughness with which crew and supervisors did their jobs. Hopkins speculates that, in turning away from an obvious danger zone, the auditors reasoned that they did not want to insinuate, by their inquiries, that there was any lack of confidence in the professionalism of the crew and its supervisor. He observes that the purpose of an audit is not to be polite but to verify that training and performance standards are being met. The term management walk-around (as used in the title of his report) has the ring of an audit of matters of occupational safety; it suggests an easy conversational tone without a clipboard in hand. An industrial safety audit, in contrast, requires a clipboard if not an iPad in order that the condition and integrity of key components (including data sets) may be verified. The notion of Stop-Work Authority should be dropped, as it is seldom if ever employed; further, in many cases, stopping a production line needlessly could create other safety hazards as well as entail economic losses.

Conclusion Had a regulatory framework been in place on April 20, 2010, that required that industrial safety audits be carried out independently from occupational safety audits, then it is reasonable to suppose an audit of the first kind on Deepwater Horizon that day would have spotted and corrected the problems that led to the blowout.

224

THE JOURNAL OF ENERGY AND DEVELOPMENT

Regardless of the reasons, the turning away by the safety auditors from the likely trouble spots where improper execution of well abandonment procedures could put at risk the lives of the crew and the physical integrity of the rig meant that the auditors chose not to audit. The auditors turned their visit into a social one, giving the appearance of management interest in, and concern about, the working conditions of crews on an important asset. In this light, the accident was caused by the failure of the rig governance model and the inadequacies and blind spots of the safety audit protocols. The story of such failures and inadequacies is doubtlessly replicated in industrial accidents around the globe. Often, blame is put on outside parties or contractors. In April of 1992, when a kilometer or more of sewage pipeline exploded in a poor neighborhood of Guadalajara, Pemexthe national oil company of Mexicoat first put the blame on a private chemical plant. In July of 1996, twothirds of Pemexs gas processing capability for the country was taken off-line when an explosion destroyed the 2 billion-cubic-feet-per-day plant at Ciudad Pemex. The eventual cause was said to have been that of a contractor who was welding with an acetylene torch in an improper manner. Such accidents will continue to occur until contractors, as well as facility owners, are responsible for the costs of such accidents. Only then will contractors feel co-responsible for lapses in training, supervision, and safety audits.10 In relation to industrial infrastructure, offshore or otherwise, the political science of safety is an area begging for more management and sociological research. What is the right mix of incentives and sanctions that would motivate all actors involved in regulation, enforcement, and operations to insist on training and protocols of industrial safety in ways such that Critical-to-Quality hot spots will not be overlooked elsewhere as they were on the Deepwater Horizon in 2010? This is an open question for further research. It is a scientific question as well as one for regulators and industry executives and their lawyers.
NOTES
1 As events turned out, the blowout preventer would be needed; however, in this case it failed to cancel out the original bad decision to proceed with the well abandonment process absent an unmistakable test of well integrity.

Terry Barr, The Oil Disaster Is About Human, Not System, Failure, Wall Street Journal, June 11, 2010. Andrew Hopkins, Management Walk-Arounds: Lessons from the Gulf of Mexico Well Blowout, National Research Centre for Occupational Health and Safety Regulation, Working Paper no. 79, Australian National University, Canberra, Australia, February 2011. Citations to Professor Hopkins refer to this report. Russell Gold and Ben Casselman, On Doomed Rigs Last Day, a Divisive Change of Plan, Wall Street Journal, August 26, 2010.
4 3

INDUSTRIAL SAFETY & DEEPWATER HORIZON

225

5 Critical-to-Quality is a concept taken from the quality-control system known as Six Sigma, famously practiced by General Electric:

To achieve Six Sigma Quality, a process must produce no more than 3.4 defects per million opportunities. An opportunity is defined as a chance for nonconformance, or not meeting the required specifications. This means we need to be nearly flawless in executing our key processes. See General Electrics website, available at http://www.ge.com/en/company/companyinfo/ quality/whatis.htm.
6 Critics in U.S. Congressional hearings and in the media criticized BPs long history of safety violations as evidence of a lax safety culture.

The first heading in Wikipedias entry on Safety Culture is Defining Safety Culture. References to the cited text are provided in this article, available at http://en.wikipedia.org/wiki/ Safety_culture.
8 Dr. Bruce Ivins was the anthrax killer who, according to findings by the U.S. Justice Department, escaped detection for most of a decade, all the while performing his duties at a secret biodefense research lab.

It is even more perplexing why the Transocean manager did not voice his concerns and objections to the safety audit team. It would appear that only a whistle-blower onboard the rig could have saved the ship. BPs post-accident report focused almost exclusively on matters of remediation and ignored the causes and preventative measures that could be implemented to help prevent the recurrence of a future Macondo. In some contexts, as in Pemex, the oil union also should be included in the accountability model.
10