Deepwater Horizon: When ignoring risk signals causes the biggest environmental catastrophe in history

; Reading time: 11 minutes

The operating risk in the offshore extractive sector is one of the most complex and dangerous in the world. The Deepwater Horizon case shows that even when danger signals are clear, documented and visible in real time, they can be ignored — with devastating and irreversible consequences for people, the environment and the economy.

One night in the Gulf of Mexico

On April 20, 2010, at 21:50, the oil platform Deepwater Horizon — owned by Transocean and leased to BP — explodes in the Gulf of Mexico. The explosion kills 11 workers and hurts 17. The platform sinks two days later, on 22 April 2010.

What follows is the largest offshore environmental disaster in history. For 87 consecutive days, crude oil pours into the Gulf of Mexico — more than 200 million crude oil gallons have been poured into the Gulf for almost three months before the well could be stopped.  

An event that has forever changed the offshore oil industry. And it could have been avoided.

The chain of causes: a disaster announced

The investigations after the accident revealed a chilling reality. The loss of human lives at the Macondo pit on April 20, 2010, and the consequent pollution of the Gulf of Mexico throughout the summer 2010, were partly the result of a bad risk management, changes of the last minute to the plans, lack of observation and response to the critical indicators, inadequate response to the control of the well and inadequate training to emergencies.  

It wasn’t a single mistake. It was a chain of wrong decisions, each of which had increased the risk exponentially.

The signals that no one wanted to see

Signal #1 — Pressure anomalies ignored in real time :

During the evening of 20 April 2010, while the commander of Deepwater Horizon led a platform tour for BP and Transocean visitors, the drilling crew observed abnormal pressure in the pipe leading to the well and began to take steps to close the well to prevent the release of hydrocarbons.

Anomalous pressure signals were visible on real-time displays. They were recorded hours before the explosion. They were not correctly interpreted — or worse, they were deliberately ignored to respect the production schedule.

Signal #2 — The failed cement integrity test:

At the center of the disaster there is the failure of the concrete barrier in the Macondo well. The report states that a central cause of blowout was the failure of the cement barrier in the string of the production coating. Halliburton, the company responsible for cementing work, had carried out tests showing worrying results. These results have not prevented proceeding.  Claims Journal

Signal #3 — Security systems disabled :

The investigations revealed numerous deficiencies of the systems, and acts and omissions by Transocean and his crew, which had a negative impact on the ability to prevent or limit the magnitude of the disaster. These included poor maintenance of electrical equipment that could have triggered the explosion, bypass of gas alarms and automatic.  Claims Journal

Signal #4 — Trade pressure on the calendar :

As a result of a cascade of fault analysis and deeply defective signals, decision-making, communicative and organizational-managerial faults, security has been compromised to the point that… disaster had become inevitable. The platform was late on the calendar. BP had already spent over $50 million additional costs on the Macondo well. The pressure to complete the operations and abandon the well was huge.  CGT

: three companies, a disaster

The investigations have established multiple and shared responsibilities. In September 2014, the federal court overseeing lawsuits against BP and others established that BP was responsible for 67% for blowout, explosion and payment. Transocean, the owner of the platform, was held responsible to 30%. The remaining 3% of the blame was attributed to Halliburton, a contractor.  Breached Company

Three companies. Three separate command chains. A single disaster that could have been stopped anywhere in the chain.

The cost of acceptance

Human cost:

11 workers lost their lives in the explosion of 20 April 2010. 17 were injured. Hundreds of thousands of people living and working along the coasts of the Gulf of Mexico have suffered devastating economic consequences — fishermen, restaurateurs, tour operators, whole communities.

The financial cost :

In June 2016, BP announced its final estimate of oil spill costs: $61.6 billion. This includes the largest environmental damage agreement in the history of the United States.  The Record

In April 2016, BP agreed to compensate for environmental demands for $20.8 billion — the largest environmental damage agreement in the nation’s history. This agreement included a federal penalty of 5.5 billion dollars under the Clean Water Act, the largest in the history of environmental law.  Breached Company

Separately, BP paid $4 billion in fines and penalties, including $2.4 billion to restore damaged natural resources.  Breached Company

The environmental cost :

The oil tide covered a significant part of the Gulf of Mexico for months. The consequences on the marine ecosystem, the populations of birds, the backdrops and the coasts of Louisiana, Mississippi, Alabama and Florida were devastating and still last today.

:

BP was one of the world’s largest oil companies. The Deepwater Horizon case has permanently cracked this reputation. CEO Tony Hayward was fired in July 2010 after a series of disastrous public statements — including his famous phrase “I’d like my life back” while 11 families wept their dead.

The lesson for each organization

The Deepwater Horizon case is not just about the offshore oil industry. It concerns every organization where commercial pressure can prevail over the culture of safety.

Three fundamental principles emerge from this disaster.

First — real-time signals must be heard :  Pressure abnormalities were visible on the display of the platform hours before the explosion. In each organization, real-time operating data are signals. Ignoring them for convenience or for calendar pressure is a deliberate choice — with potentially catastrophic consequences.

Secondly, shared responsibility is a systemic risk:  when three companies — BP, Transocean and Halliburton — operate on the same site with separate command chains, security liability may fall into the gaps between organizations. As in the case of Carillion with subcontractors, the complexity of the supply chain amplifies the operating risk.

Third — Trade pressure can never prevail over safety :  the platform was late. The costs were out of control. The pressure to complete the operations was huge. In this climate, risk signals are minimized, procedures are shortened, decisions are taken quickly. It is the time when the operating risk stops being managed and begins to accumulate.

Conclusion

Deepwater Horizon explosion wasn’t an accident. It was the inevitable consequence of a chain of wrong choices, ignored signals and an organizational culture in which production speed had replaced security as a primary value.

87 days of oil in the Gulf of Mexico. 11 lives lost. 61.6 billion dollars of total costs. And an ecosystem that still brings scars that night of April 20, 2010.

As in the cases Boeing 737 MAX, KNP Logistics, Carillion and Miteni — the signals existed. They were documented. And they were ignored.

Operating risk management does not begin when the crisis explodes. Start every day, in every operational decision, in every signal you choose to listen — or ignore.

Sources: BP Deepwater Horizon Accident Investigation Report (September 2010) — BOEMRE Panel Report, U.S. Department of the Interior (October 2011) — U.S. Coast Guard Report of Investigation (July 2011) — U.S. Department of Justice, Deepwater Horizon Settlement (April 2016) — NOAA, Deepwater Horizon Oil Spill Settlements (2016) — National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling, Final Report (January 2011).