A robust system of process safety indicators might have revealed many of these management system deficiencies before the Deepwater Horizon disaster occurred, CSB investigators announced at a July 24 public hearing in Houston. The CSB team presented eight conclusions from the agency’s investigation into the disaster, which claimed 14 lives and was one of the worst environmental disasters in the United States to date.
CSB investigators offered these eight conclusions from the investigation to date:
- Transocean and BP had multiple safety management system deficiencies that contributed to the Macondo incident.
- Before the Macondo blowout, the safety approaches and metrics used by the two companies and U.S. trade associations did not adequately focus on major accident hazards. Recently BP officials informed CSB investigators that they are working to develop a more comprehensive offshore indicators program using leading and lagging metrics to help drive performance improvements.
- Systems used for measuring safety effectiveness in the offshore industry focused on personal safety and infrequent lagging indicators.
- The U.S. offshore regulator, the Department of the Interior, can achieve a greater impact on major accident prevention through the development of a leading and lagging process safety indicator program.
- Despite some significant progress with process safety indicator implementation in the downstream oil industry, in the offshore sector BP, Transocean, industry associations, and the regulator had not effectively learned critical lessons of Texas City and other serious process incidents at the time of the Macondo blowout.
- Companies and trade associations operating in other regulatory regimes outside the U.S. have developed effective indicator programs, recognizing the value of leading indicators, and using those indicators to drive continuous improvement.
- Trade associations and many of the same companies that operate in the U.S. are partnering with the regulators in other countries in advancing safety indicators programs.
- In the aftermath of the Macondo blowout, companies and trade associations in the United States are initiating efforts to advance the development of offshore major accident indicators.
CSB Team Lead Cheryl MacKenzie noted that Transocean primarily measured safety performance through two metrics: total recordable injuries and the “total potential severity rate.” Although Transocean gave itself a zero score for total recordable injuries following the tragedy, its scoring on the potential severity rate enabled top-level management at Transocean to receive financial bonuses for safety performance.
The focus on personal safety was reflected in a 2004 Transocean major accident hazard risk assessment of the Deepwater Horizon. The assessment made 27 recommendations for safety improvements – but almost all addressed personal safety issues and no recommendations addressed major accident risks such as gas entering the riser or well blowouts.
Role of Regulators
The CSB investigation also is looking at the role U.S. regulators and regulations played in the time preceding to the accident. The CSB found that BP was a finalist for a safety award from the Minerals Management Service (MMS), the former Department of the Interior agency overseeing offshore oil exploration and production, and that a total of 15 safety awards had been given to BP and Transocean over a period of years. The criteria used to determine the award candidates, CSB investigators said, focused on personal safety metrics and did not give an accurate measure of safety management system performance to control major accident hazards.
Following the Macondo blowout, a re-organization within the Interior Department created the Bureau of Safety and Environmental Enforcement (BSEE). Preliminary CSB findings indicate that some reporting requirements have become mandatory, but the focus remains on reporting major accident events such as fires rather than predictive, leading indicators.
The onshore refining industry, responding to a previous CSB recommendation to the American Petroleum Institute (API) and the United Steelworkers Union, is moving toward the development of key safety performance indicators, the CSB noted.
“API has taken a positive step forward in establishing 'Recommend Practice 754' on safety performance indicators but I believe that input from all stakeholders is necessary to develop a more robust recommended practice,” said CSB Chairman Dr. Rafael Moure-Eraso. “We would like to see API move even further and focus more on leading indicators to proactively measure safety system performance before accidents occur. I believe the offshore drilling industry could benefit from such a program as well. Meantime, it is encouraging to see the industry move in this important direction, which will help prevent accidents and save lives.”
Safety Management System Deficiencies
The CSB investigative team further presented a number of preliminary findings of management system deficiencies underlying the Macondo blowout and explosion. The existence of these deficiencies – at the same time that the relevant companies and the regulator focused on personal safety metrics – underscore the need for more effective process safety indicators, investigators said. These system deficiencies included:
- BP and Transocean hazard assessment systems were inadequate. For example, the bridging document that sought to harmonize safety controls between BP and Transocean was a minimal document that focused only on six personal safety issues such as minimum heights for employing fall protection equipment. The document did not address major accident hazards like the potential for loss of well control.
- Hazard assessments of major accident risks on the Deepwater Horizon relied heavily on prompt, correct manual intervention by the rig crew to prevent a catastrophe, for example to divert the flow of flammable hydrocarbons away from the rig during a blowout. Depending on a human reaction alone during an emergency situation – with many distractions – is not a reliable safety layer. A comprehensive hazard assessment should have identified this risk.
- There were no written procedures for how to conduct the key “negative pressure test” which was conducted on the day of the incident and was necessary to confirm the integrity of the cement seal on the well. There also were no written criteria or safe limits defined for determining if the test was a success.
- Systems for managing the safety of process changes were inadequate. The plan to complete and “temporarily abandon” the Macondo drilling operation was changed five times during the week before the disaster, but there is no available documentation that management of change procedures or formal hazard assessments were conducted.
- Systems for investigating safety incidents and implementing and disseminating the findings were inadequate. Prior to the Macondo disaster in December 2009, Transocean operated the Sedco 711 drilling rig in the North Sea (BP was not involved). In an incident similar to Macondo, the Transocean crew had a delayed response to indications that hydrocarbons were flowing into the well. Mud and hydrocarbons eventually reached the rig floor at the sea surface, though they did not ignite in that case and the blowout preventer sealed the well. Transocean prepared an "Operations Advisory" discussing the lessons from the Sedco 711 incident, but it was not effectively communicated to employees beyond the North Sea.
- On the Deepwater Horizon, a little over a month before the Macondo blowout, there was a delay by operators in responding to a "well kick" – an unanticipated, hazardous influx of hydrocarbons into the wellbore that can precede a blowout. BP investigated the incident but after informal verbal discussions with Transocean, evidence indicates that Transocean did not implement changes based on the findings.
CSB is an independent federal agency charged with investigating serious chemical accidents. The agency’s board members are appointed by the president and confirmed by the Senate. CSB investigations look into all aspects of chemical accidents, including physical causes such as equipment failure as well as inadequacies in regulations, industry standards and safety management systems.