Responding to Safety & Environmental Incidents: Practical Lessons Learned from the BP Gulf of Mexico Disaster

1. Responding to Safety & Environmental Incidents: Practical Lessons Learned from the BP Gulf of Mexico Disaster Mark D. Hansen, CSP, PE, CPEA, CPE Vice-President, Environmental & Safety Range Resources Corporation Ft. Worth, TX September 16, 2010

2. About the Rig The rig belonged to Transocean, the world’s biggest offshore drilling contractor The rig was originally contracted through the year 2013 to BP and was working on BP’s Macondo exploration well when the fire broke out The rig costs about $500,000 per day to contract The full drilling spread, with helicopters and support vessels and other services, cost closer to $1,000,000 per day to operate in the course of drilling for oil and gas The rig cost about $350,000,000 to build in 2001 and would cost at least double that to replace today

3. What Happened? The Deepwater Horizon drilling rig which caught fire, burned for two days, then sank in 5,000 ft of water in the Gulf of Mexico There were 11 men were killed and 17 injured The event continued for 87 days and released an estimated 5 million bbls of oil in the Gulf of Mexico

4. A Closer Look at bp Choices Note: I am not a Petroleum Engineer nor do I profess to be. Casing locked with a single injection of cement Liners with one (two) cement jobs are less prone to failure Blowout preventer failed

5. Warning Signs First rig, Marianas (Transocean) drilled to 4,023 feet before being damaged by Hurricane Ida … Enter Macondo (Transocean) in February The formation is geologically young and fragile (sand, shale and salt) The use of mud – transport cuttings out of the hole – a liquid plug Run the risk of fracturing the hole or losing mud to a weak formation There were several occasions where mud was lost in weak formation

6. 8 Key findings The annulus cement barrier did not isolate the hydrocarbons The shoe track barriers did not isolate the hydrocarbons The negative-pressure test was accepted although well integrity had not been established Influx was not recognized until hydrocarbons were in the riser Well control response actions failed to regain control of the well Diversion to the mud gas separator resulted in gas venting onto the rig The fire and gas system did not prevent hydrocarbon ignition The BOP emergency mode did not seal the well

7. Barriers Breached and the Relationship to Critical Factors

8. The annulus cement barrier did not isolate the hydrocarbons • Evaluating lift pressure and lost returns did not constitute a ”proven cement evaluation technique“ • A formal risk assessment might have enabled them to identify further mitigation options • Improved engineering rigor, and communication of risk could have identified the low probability of the cement achieving zonal isolation • Improved technical assurance, risk management and management of change by the rig personnel could have raised awareness

9. The shoe track barriers did not isolate the hydrocarbons • Contamination of the shoe track cement by nitrogen breakout from the nitrified foam cement • Contamination of the shoe track cement by the mud in the wellbore • Inadequate design of the shoe track cement • Swapping of the shoe track cement with the mud in the rat hole (bottom of the hole) • A combination of these factors

10. The negative-pressure test was accepted although well integrity had not been established • Incorrect assessment that well integrity had been achieved • Negative pressure test did not have detailed steps and did not specify failure criteria • Test results were determined by competence of field personnel

11. Influx was not recognized until hydrocarbons were in the riser • The rig crew either did not observe or recognize pre-blowout conditions • Tansocean’s Well Control Handbook did not specify how to monitor the well during these events

12. Well control response actions failed to regain control of the well • No apparent well control actions were taken until hydrocarbons were in the riser • The next actions that were taken did not control the well • An annular preventer was likely activated, and it closed around the drill pipe, but failed to seal for about five minutes, allowing further flow of hydrocarbons into the riser • The diversion of fluids overboard, rather than to the Mud Gas Separator, may have given the rig crew more time to respond and may have reduced the consequences of the accident • Transocean’s shut-in protocols were not adequate after well control has been lost • The rig crew was not sufficiently prepared to manage an escalating well control event

13. Diversion to the mud gas separator (MGS) resulted in gas venting onto the rig • The design of the MGS system allowed the riser fluids to be diverted to the MGS vessel when the well was in a high flow condition • Hydrocarbons were vented directly onto the rig through the 12 in. vent exiting the MGS, and other flow-lines directed gas back onto the rig • This created a flammable cloud that only needed an ignition source

14. Mud Gas Separator

15. The fire and gas system did not prevent hydrocarbon ignition • The two main electrically classified areas were within the rig floor and under the deck, where the mud returning from the well could convey some residual hydrocarbons • A flammable cloud migrated to these areas where ignition occurred

16. Fammable Dispersion Model

17. Where the Gas Vented

18. Where the Gas Vented

19. Classified Explosive Areas

20. Classified Explosive Areas

21. The BOP emergency mode did not seal the well • Emergency Disconnect System (EDS) • The explosions and fire damaged the multiplex cables, preventing the EDS from closing the Blind Shear Ram (BSR) • Automatic Mode Function (AMF) • A failed solenoid valve and an insufficient charge prevented the AMF from operating • BOP Maintenance / Testing • The Transocean maintenance management system failed

22. CultureHow could this happen? BP’s safety program was focused on the safety issues on the rig itself This incident was really about operations Few SH&E professionals have an in-depth knowledge of the inner workings of the blowout preventer and drilling on the sea floor and rarely interact with operations regarding these issues This is where the gap occurred

23. More on Culture http://www.thescienceofpersonality.com/2010/08/bps-deepwater-sunset-disaster-waiting.html

24. How did BP get labeled as the “Bad Guy”? • Industry know the merits of BP’s safety and environmental program, but the public and media clearly do not • Paradoxically, BP is known for it’s strict requirements on both its employees as well as it’s contractors. BP works extremely hard to develop and sustain a safety culture unparalleled in industry • BP’s safety requirements are so strict, many companies choose not to do business with them because their safety programs don’t “measure up” • This is so prevalent, even some “employees” leave BP for the same reason • So, how did they get labeled as the “Bad Guy”?

25. How did BP get labeled as the “Bad Guy”? • First, pure and simple … They were put under the microscope … • In events like this … catastrophe = Microscope • Every action no matter how small is dissected in great detail … and in this case … on national tv • Second, they are the operator ... An easy target. Even though: • Transocean was doing the drilling • Halliburton was providing services • BP, Halliburton, and Transocean all appeared at the Congressional Hearing … many of us witnessed the round robin … • … Yet BP was deemed responsible … any surprise?

26. How did BP get labeled as the “Bad Guy”?Public and Media Social Decisions It was BP’s well regardless of any contractual vehicle in place – Logic did not play a role It was difficult to spread the blame to three entities or more (conspiracy theory) – One is much easier Just like lawsuits today there is a propensity to find one entity with which to lay the blame On the other hand, it was easy for the public and the media to label BP as the owner and the “bad guy” Even the Minerals Management Service suffered some “blame” but the skating virtually unscathed On top of all this, in the media, “feelings” trumped any “facts” that would counter the truth

27. Ever Heard of Cognitive Bias? It is a general term that is used to describe many distortions in the human mind that are difficult to eliminate and that lead to perceptual distortion, inaccurate judgment, or illogical interpretation http://en.wikipedia.org/wiki/List_of_cognitive_biases Once the spill occurred, cognitive bias kicked in.

28. Other Supporting Biases Bandwagon effect– the tendency to do (or believe) things because many other people do (or believe) the same Confirmation bias– the tendency to search for or interpret information in a way that confirms one's preconceptions Negativity bias – the tendency to pay more attention and give more weight to negative than positive experiences or other kinds of information Semmelweis reflex – the tendency to reject new evidence that contradicts an established paradigm

29. How did BP get labeled as the “Bad Guy”? No matter what “good” BP could do, they ONLY “good” they could do it get out of this was stopping the leak This puts a fine point on how difficult it is to manage public perception, media, government in addition to “remote” operations and contractors

30. Responding to a Crisis Crisis Communication

31. Today’s Complicator in Crisis Communication E-mail • The proliferation of instantaneous and constant media communications in the digital age has increased public awareness of risks and crises as well as the publicity surrounding them LinkedIn My Space Facebook Twitter Media Websites Youtube

32. Crisis Communication The formal study and practice of crisis communications has been identified for less than 25 years Its use by EH&S professionals is even newer Our role is often to advise management on how to speak to the public about risks and crises under our responsibilities

33. Crisis Communication A variation of risk communication that occurs when something has recently happened that endangers people or that threatens to endanger them in the not too distant future. People are fearful, angry or miserable Peter M. Sandman

34. Risk Perception Model 15 different factors Affect how risk is perceived by stakeholder Each has the capacity to alter perceptions in varying degrees of magnitude. Perception determines level of concern which changes attitudes and behavior (Vincent Covello – Center for Risk Communication)

35. 15 Risk Perception Factors • Voluntariness • Controllability • Familiarity • Equity • Benefits • Understanding • Uncertainty • Dread • Reversibility • Trust in institutions • Personal Stake • Ethical/Moral Nature • Human vs. Natural Origin • Victim Identity • Catastrophic Potential

36. Mental Noise Model (Covello) Evaluates how information is processed under stress Changes in the way information is processed should affect communications Strong feelings arouse mental agitation which creates mental noise Can interfere with ability to be rational

37. Trust Determination Model(Covello) First establish trust between the sender and the receiver Emphasizes two-way communication process Difficult to achieve objectives without it If trust is already in place, communication barriers are more easily overcome

38. Models Risk = Hazard + Outrage www.petersandman.com

39. High Hazard/High Outrage (CrisisCommunications) Emotion from audience is more likely fear Skilled messenger or audience may become depressed or apathetic Acknowledge reasonable fears and give constructive action ideas “We’re in this together

40. Audience AnalysisFactors Influencing Public Perception How well the risk is understood – technical information How equitable the risk is distributed among populations – statistical information What level of control exists - Covello’s Risk Perception Model

41. Audience AnalysisFactors Influencing Public Perception • Whether the risk is assumed voluntarily and/or without approval • How easily they can they recall a related event of a specific risk (stroke vs. shark attack) • Significant influence of media • How closely they were affected by an event

42. Tailor the Message to the Audience If the Audience is… Tailor the message… • Unaware • Apathetic • Well informed • Hostile • Lots of graphics and color • Find means to get stakeholders involved, offer choices • Build on past information • Acknowledge concerns, find common ground, get stakeholders involved

43. Crafting the Message Provide knowledge needed for informed decision-making Build (rebuild) trust - Transparent Engage stakeholders in dialogue Minimize conflict among messengers and messages Good planning on message content Good skill and practice delivering messages Center for Risk Communication

44. Crafting the MessageCrisis Communication Messages Don’t over-reassure Err on the alarming side Be willing to speculate Don’t aim for zero fear Acknowledge uncertainty Tell people what to expect Offer people things to do Let people choose their own actions Peter Sandman

45. Crafting the Message Be willing to identify the worst case scenario and talk about it Change the message from “We are ready – we will protect you.” to “We are doing our best, but you need to do some work too” The question isn’t “How safe is safe enough?”, but “How ready is ready enough?”

46. When the Message Doesn’t Work Pitfalls • Using abstractions • Don’t assume a common understanding • Don’t attack • Respond to issues, not people • End debates, don’t further them • Sending negative non-verbal messages • Don’t lose your temper • Adopt a relaxed physical stance • Who’s fault is it? • Accept blame where appropriate • Don’t shift it to others • Don‘t focus on money • What are the benefits for the money being spent? • Don’t complain about lack of funds • Avoid guarantees • Offer likelihoods and emphasize progress • Avoid jargon • It’s OK to educate.

47. 7 Cardinal Rules of Crisis Communication Source: Covello & Allen (1998) • Accept and involve the public as a legitimate partner Create an informed public, avoid simply pacifying their concerns • Plan carefully and evaluate your efforts Audience analysis is key here • Listen to the public’s specific concerns Credibility, empathy and concern can sometimes be as important as risk levels, statistics and details • Be honest, frank and open Trust and credibility take time to develop but are quickly lost and hard to regain

48. 7 Cardinal Rules of Crisis Communication Source: Covello & Allen (1998) • Coordinate and collaborate with other credible sources Conflicts between organizations makes things more difficult • Meet the needs of the media The media are usually more interested in politics than in risk, in simplicity than in complexity, and in danger than in safety

49. 7 Cardinal Rules of Crisis Communication Source: Covello & Allen (1998) • Speak clearly and with compassion Never let efforts prevent acknowledgement of the tragedy People can understand risk information, but they may still not agree Some people will not be satisfied

50. When the Message Doesn’t Work Pitfalls • Don’t go on and on … • Aim for 15 minutes or less • Save plenty of time for questions • Avoid negative allegations • Refute where you can • Don’t repeat and give credibility • Avoid negative words and phrases • Stay positive or neutral • You’re never “off the record” • Nothing is confidential • It’s not about you • Always “we”, never “I” • Promises are hard to keep • Make sure it can be delivered • Never promise for another group or organization • Accompany your words • Visuals and hand-outs help enhance the message • Just the facts • Speculation is a huge trap • Statistics • They’re not the focus • Use to enhance your remarks