BP Oil Spill: Disaters and Swiss cheese

Source: Charlie Riedel: Associated Press

The explosion on April 20th 2010 and subsequent oil spill in the Gulf of Mexico is a major environmental disaster. Numbers can be trotted out to place it in context but the perception and reality is that this is a catastrophe for everyone; for the Gulf, for the environment, for jobs along the Gulf coast and beyond, for the US government and for BP. There are technical questions about how it occurred and serious concerns about the clean up but there are other more generic issues about risks and hazards that this major environmental disaster highlights.

The catalogue of BP ‘errors’ in procedure have been chronicled in the open in front of a congressional panel. BP are said to have cut corners in well design, cementing and drilling mud and installation of safety devices – lockdown sleeves and centralizers. The choices BP made produced a route to disaster that, although not a perfect fit match, the ‘Swiss cheese’ model. The Swiss cheese model was developed by James Reason in 2000 and is based on the idea that in any complex system the route to a disaster is prevented by a series of barriers. These barriers can be procedures, safety equipment, morals, anything that will restrict or constrain the actions of both the people involved and the natural phenomenon involved in the complex system. Reason viewed the system and randomness as being essential in a hazard being realised. With some modifications the same type of model can be applied to the oil spill and BPs catalogue of errors.

Reason's Swiss cheese mdoel of disaters

The layers of the ‘Swiss cheese’ are the barriers that are meant to prevent the disaster that unfolded, each slice is anything that prevents the trajectory of a disaster so that could be procedure, person, technical specification designed to prevent a blow out. The holes in the layers are the weak spots, the holes or gaps that allow ‘mistakes’ to be made. Individually, these mistakes may not be an issue. If the other holes aren’t in lien then the next barrier prevents the trajectory of disaster. Collectively, when all the holes are aligned, disasters occur. The layers can be thick or thin, heavy or light regulation of an industry for example, and likewise the holes can be large or small, gapping omissions from safety protocols or tiny, repetitive practices that for years haven’t been an issue because the other holes haven’t been in alignment.

The list of BP ‘errors’ or holes in each layer meant to prevent a trajectory to disaster is long and seems to be ever expanding. Depending on which reports you read the mistakes those in the table below (derived from tampby.com and businessinsider.com).

• Well design and maintenance:
  April 14th-15th: BP granted permit changes to speed up its over-budget drilling operation in Deepwater Horizon in addition to its existing ‘categorical exclusion’ from 2009. BP allowed to install cheaper, smaller single pipe. Double-lined pipe would offer protection from escaping gas.
  Gaps in pipe segment could have released a blast of gas to the surface
  Lack of O-ring seal could have let a blast of gas up the pipe
  Drilling chief noticed ballooning of the well walls


• Contaminated cement in capping operation (possibly):
  April 20th : Contractors Halliburton trying to temporarily plug and cap well. Technicians noticed pressure rise that suggested cement not holding. One test showed a ‘very large abnormality’, another test was misread and well declared safe.


• Alleged BP ‘company man’ over-rule:Despite rising pressure process of replacing drilling mud with seawater began, a standard practice if no pressure problems. The objections of workers were over-ruled by BP ‘company man’. Rise in pressure resulted from oil and gas rising in well.


• Hesitation in safety procedures?:
  Technicians waited for official approval from BP before turning on blowout preventer. There was no hydraulic pressure when it was switched on. There is debate whether this equipment would have worked anyway in a deepwater well.
  No evacuation of rig ordered despite abnormal test results.


• Weak initial reconnaissance:
  April 22nd – Remote robot sent to well head – no leak detected


• No sonic testing:
  BP had no plans to conduct a cement bond log test which uses sonics to identify any weaknesses in cement – source calls it a gold standard test.


• Fake testing?:An employee has indicated he saw evidence of test results on blowout preventer being faked.


• BP response plan: Aside from the obvious of having a dead man as one of your specialsit, BP only had a generic response plan for the Gulf of Mexico not a specific plan for Deepwater (granted exemption). Delays in getting to survivors of the explosion and the generic plan having a worse case scenario of only 20,000 bbl are just two examples of problems with the generic plan.


• Research delays:
  BP spent weeks after the explosion researching how to stop the leak. No research in place on how to stop leak at this depth.

So what does this evolving list of errors actually tell us?


If you divide the items above into pre-event, event (simplistically mapped out below) and post-event and apply this to the Swiss cheese model, then it is clear that there were systemic holes in BP’s supposed barriers to such a disaster before the first well was even drilled. On the day of the explosion, further holes emerged in barriers, the safety procedures, that were meant to be in place and finally after the explosion the generic nature of the response plan was exposed as inadequate, more holes appeared as events unfolded. This is just one set of ‘mistakes’, other Swiss cheese figures could be constructed to illustrate others and added to as more information becomes available about the disaster.




PRE-EVENT



EVENT

What the Swiss cheese model can’t tell you is why the holes appeared in the layers and why layers thinned. Greed has been put forward as a motive by newspapers, Gulf residents and politicians. Other oil companies have testified to Congress that they would not have made the same key decisions as BP. So is it that simple? A greedy company cut corners to keep costs low and endanger the environment? Although there may prove to be an large dose of truth as the lax protocols and potential company over-ruling of workers is assessed in this another set of questions also need to be asked. Why was BP allowed the exemptions and exclusions? Why were protocols not followed? Why was testing not carried out? These seem to be some of the obvious questions and ones specific to this incident.


It may be as useful to look at the context of the drilling as much as the detail. BP were undertaking deepwater drilling, a relatively new venture for oil companies. How much of the protocols and systemic behaviour was based on BP’s experience on shallow drilling and the latitude in safety measures and well maintenance that that experience implied? If BP’s past experience was the basis for their practices in the Gulf of Mexico then it would appear that the past, the different drilling context, may not be a useful guide to the dangers of the present novel drilling operations. In other words, in this new context is knowing the way the system operated in the past, where the holes in the layers were, how thick the layers were, sufficient to ensure that drilling is safe. How have other oil companies translated and interpreted, improved safety protocols, well designs and a myriad of other parameters to take account of the new dirlling context? Often without a disastrous event, the assumptions of operating in a new context are not questions. Maybe BP’s legacy will be a review by all, compmaies, government adminsitrations and safety officials of the new holes in the cheese in this new context.

James Reason has publsihed a book on accidents taht develops this type of model.