In a 2011 paper on ‘Management walkarounds; Lessons from the Gulf of Mexico oil well blowout’, Prof Andrew Hopkins of Australian National University and the Australian National Research Centre for Occupational Health and Safety Regulation, explains some of the blind spots in management site visits.
Management requires senior managers to spend time with front line workers. Some performance agreements for senior managers require that they conduct a certain number of site visits per year.
The challenge is to make proper use of site visits. Safety is often a focus for visiting VIPs, but too often safety is understood as a matter of occupational safety; slips, trips, falls or job procedures, rather than management of major hazards and process risks that can blow the plant and workers apart.
BP oil rig safety visit
A BP senior management and rig owner Transocean visit to the Mexican Gulf Deepwater Horizon rig, seven hours before the 2010 explosion, failed to prevent the disaster.
Four company VIPs helicoptered onto the Deepwater Horizon on a management visibility tour, and were touring the rig when disaster struck.
There were already several indications that the well was not under control, was ‘flowing’ as oil and gas forced their way up from several kilometers below the sea floor. These indicators were all missed or misinterpreted by rig staff.
The two BP top execs and two rig owner execs had all worked as drilling engineers or rig managers in the past and had detailed knowledge of drilling operations. Had they focused their attention on the well, they would have recognised warning signs and could have stopped operations.
But their attention was focused elsewhere. There is tragic irony here. A major purpose of the visit was to emphasise the importance of safety, and yet the visitors paid almost no attention to safety critical activities.
BP and Transocean management visibility tours of Gulf of Mexico rigs were regularly scheduled. By chance, Deepwater Horizon had been selected for a social visit on this occasion.
The group visited the bridge to talk to the marine crew, who were often omitted on management visibility tours. The bridge has many monitors. One of the managers explained; “We had a nice long vist there. We also had the chance to work with a dynamic positioning simulator that they have used for training and demonstration.”
Celebrating seven years without injury
The managers also had a set of safety functions to fulfil. The rig had amassed a total of seven years without a lost time injury and the VIPs wished to congratulate the crew on this achievement and to identify lessons that could be transferred to other oil and gas rigs.
One visiting manager was aware of a slip hazard indentified on another rig, and wanted to see if Deepwater Horizon was aware of this hazard and had installed non slip materials. It was an informal safety audit.
Another manager had a particular interest in harnesses used for work at height, housekeeping, inspection schedules. Some harnesses did not have inspection tags, but the offshore installation manager could explain.
He also asked various employees about their understanding of safety culture. Transocean and BP were running a concerted campaign to increase awareness of the risk of hand injury and objects dropped from height.
They came close to discovering warnings of blowout which had been systematically missed or misinterpreted.
Offshore oil well sealing procedure
Drilling of the well had been completed and the rig was preparing to move. During drilling, well safety is assured by keeping the well full of a heavy fluid, called mud, nearly twice the weight of sea water.
Before the drilling rig moves to its next assignment, mud in the column rising from the sea floor to surface must be replaced with sea water. The casing or lining in the well must be fully sealed to prevent influx of oil or gas into the bottom of the well.
To test the seal, pressure inside the well is temporarily reduced and observers check if there is a tendency for fluids to flow out of the top of the well, or if pressure increases.
If the well is ‘flowing’, and that if the mud is removed completely, the well is likely to blow. Staff was doing a reduced pressure test at the time the top mangers visited.
Staff hides problems from head office
They misinterpreted test results. The VIPs had visited the drilling shack and found rig staff in discussion about how to do the test, and the meaning of the results. The BP man in residence on the rig told one of the visiting BP executives: “We’re having a little trouble getting lined up (for the test) but it’s no big deal”.
The BP executive asked no more questions about this and moved on to a social conversation about the history of the company.
The senior Transocean executive noted that the tone of the conversation among the drillers was confused. He sensed that they needed help and suggested that the site rig manager, who was accompanying the VIPs on their tour, should stay at the drill shack.
Later he asked the site rig manager if the test had gone well and was given a ‘thumbs up’. Conversation and inquiry are different communications. The visitor did not probe for evidence and accepted reassurance.
The experienced VIPs were not asked for help, and did not offer help with site functions. The visitors had constrained themselves.
Safety opportunities missed
There was another missed opportunity to avoid disaster during the exec visit. Drillers were replacing drilling mud with sea water in the column between the rig and the sea floor. At some point oil began flowing into the bottom of the well at an ever increasing rate.
The volume of fluid going into the well from above, should be matched by what is coming out above. If more is coming out, the well is flowing and must be immediately ‘shut in’ to be evaluated and rectified.
Flow in and fow out must be continuously monitored and compared. Standard procedure is to drawn from one ‘pit’, while what comes out goes into another pit. Total volume in these pits are monitored electronically and visually to check for fluid loss or gain.
However, that afternoon and evening numerous other activities made it virtually impossible for observers to know whether outflow matched inflow. Observers were all busy doing other things.
Managers must ask crucial questions
Had any of the VIPs asked “How are you monitoring flows?”, they would have realized that no monitoring was taking place and could have intervened.
Recent North Sea well control incident
Four months earlier, Transocean had a near disastrous blowout in the North Sea, off the coast of Scotland. Workers had tested that the well was sealed and were replacing mud with seawater. Since the well had passed the test, they were not paying attention to flows in and out, and blowout followed.
They regained control by other means in time to stop an explosion. Transocean management wrote a ten page advisory about the incident. “Do not be complacent, remain focussed on well control”.
The VIPs did not check on this safety lesson. They may have been unaware of the North Sea event. There were some surprising gaps in the management visit.
Check conditions and behaviour
The VIPs appeared to focus their visit on workplace conditions, instead of behaviour. This is a common auditing bias. Conditions are easier to audit, because they ‘stand still’.
Compliance with procedure, especially where intermittent, is hard to find and audit, and may be considered intrusion and disruption to both parties, or undermining of site authority.
There is always variance between required procedure and culturally agreed procedure. Behaviour on night shift is notoriously less compliant than on day shift. The presence of senior managers obviously changes normal site behaviour.
Audit ‘stealth’ means to not examine too closely what people are doing in the presence of the auditor.
Vague questions get vague answers
Another BP executive interviewed at the inquiry said they would ‘check with people what they are doing, by going down through the chain of command… I may go to his manager and ask questions.’
This approach leads to vague and subtle questions, and tests managers and overseers, not operators. This was probably part of the problem on Deepwater Horizon. There is obvious reluctance to test competency by engaging directly with operators.
USA president Obama said after the oil spill that government agencies would need to “trust but verify” that oil companies were doing the right thing. Senior executives need to apply the same philosophy to their subordinate managers.
LTI does not reveal major risks
Process safety disasters, due to major risks, are rare. They do not contribute to monthly or annual worker injury statistics, yet BP, like many other employers, evaluated its own safety performance, and that of contractors, on the basis of lost time injury (LTI) rates.
The senior health and safety manager of BP drilling operations in the Gulf of Mexico said at the inquiry that his focus was on occupational safety, not process safety, which is a matter for engineering authorities.
Safety for him was about individual job risks, not major process risks. The senior visitors were likewise focused on occupational safety, and failed to see larger cultural issues.
They made no efforts to ascertain how well major risks were managed, like how effectively a reduced pressure test was being carried out, or whether people were following procedures designed to protect against major risk.
This approach had been identified as a contributor to many previous process safety accidents, including BP Texas City refinery disaster of 2005, where staff incidentally was also celebrating a good injury record on the day of the disaster.
Workers could stop jobs, but not the process
Informal auditing by VIPs on Deepwater Horizon was limited by conventional safety hazards, and blind to larger issues that may have revealed t corporate deficiencies.
Stopping the job was not an option. Yet BP and the contractor instilled in their workers that they should stop a job when something was amiss. People who stopped the job for safety reasons were acknowledged and rewarded. Witnesses said that stopping the job for safety reasons was relatively common.
However, in all cases where the job had been stopped, the issue was a perceived risk to an individual, such as a risk that an object might be dropped on someone.
Witnesses at the inquiry were not aware of instances where drilling or other well operations had been stopped for safety reasons.
Evidence by one of the mud loggers is that he was ‘uncomfortable’ about simultaneous operations that made it difficult for him to monitor mud flows in the hours before the blowout, but it did not occur to him to stop the job.
The ‘stop unsafe work’ policy does not in practice apply to major hazards, and the VIPs reinforced this interpretation.
The job was too important to be interrupted by VIPs. The subliminal message was that only obvious risk could stop the drilling process, and the company trusted the process.
Management visit suggestions.
Prior to the executive visit, they would have reminded themselves of the major accident events that were possible on the rig. If executives are not experts, they should be briefed about this.
One of the executives on this tour was briefed about matters he could discuss; productivity of the rig in terms of non productive days and days per 1000 feet of drilling. No reference was made to managing blowout and well control.
They could have reminded themselves about controls that were supposed to be in place to prevent major events, and to verify that these controls were working as intended.
Given the fundamental importance of mud monitoring for well safety, one visitor could have dedicated himself to observing this process.
They could have inquired about what was happening on the rig before they arrived, to take advantage of particular process and behaviour auditing opportunities.
They would have asked people to explain at every step along the way what they were doing.
Do not avoid embarrassment
If the well had not passed the reduced pressure test, the existing timetable would have had to be abandoned and there would have been red faces all round.
They could have included an expert drilling engineer in the party to interpret the process, often an effective auditing strategy.
Management by walking around is a widely recognised and advocated activity. When such walkarounds are focused on safety, executives should plan their strategies carefully. Managers need detailed information about what might be going wrong.
Managers must know process deviations
Trevor Kletz puts it thus: ‘After an explosion managers have often said, ‘I didn’t know that the employees were not following correct procedures. If I had known I would have stopped it’. But it is the manager’s job to know that procedures are not being followed.
“They can only do this if managers, at all levels, look at details from time to time. A helicopter view is bad management… you have to land the helicopter…”
Top managers on Deepwater Horizon were sampling details, but it was a biased sample, towards workplace conditions rather than behaviour or management. Top managers failed to sample details of how the rig was managing its major hazards and risks.
Stoppage reveals culture
The sociologist, Harold Garfinkle (Studies in Ethnomethodology, Englewood Cliffs, NJ; Prentice Hall, 1967) suggested that the best way to understand rules that are implicitly operating in a social order, is experimentally to disrupt them. If people are unwilling to stop a process, then they value the process above safety.
• This report is an extract from a 2011 paper on ‘Management walkarounds; Lessons from the Gulf of Mexico oil well blowout’, Prof Andrew Hopkins of Australian National University and the Australian National Research Centre for Occupational Health and Safety Regulation.
• The inquiry into the Mexican Gulf Deepwater Horizon disaster was conducted jointly by the USA Coast Guard and the USA Department of Interior; visit http://www.deepwaterhorizoninvestigation.com