The Deepwater Horizon oil rig accident, 12 years later: analysis focusing on the collective dimension of work and the organizational factors

Abstracts

The Deepwater Horizon oil rig accident, in 2010, is considered the biggest disaster of the 21st century in the oil and gas industry. A total of 11 workers died, 17 were injured, total loss of the unit, and the largest environmental disaster in the Gulf of Mexico (United States). The existing literature encompasses its environmental, chemical, biological, and economic effects, focusing on immediate causes, that is, situations close to the event in time and space, especially human errors and technical failures. This approach is taken at the expense of identifying possible underlying causes, which refer to managerial and organizational factors. This essay aims to answer the question: wich factors may have contributed to the disaster that affected the platform, considering the relevance of the collective dimension of work? Our theoretical-methodological contribution is based on the activity ergonomics and the work psychodynamics, also valuing the synergistic conduction of the relationship between the knowledge of the sciences and the experience of the workers, as proposed by the ergological perspective. We identified decision failures from those who are at the tip of the process, operating systems of high complexity, that should not be interpreted as an endpoint, but as a starting point in the analysis of major accidents. Understanding such decisions demands the comprehension of the representations constructed by the workers, including in their collective and shared dimension. The communication (or communication gaps) between workers and organizational factors in the context of the accident are essential aspects to be considered in the analysis of events involving complex systems.

Keywords:
Occupational Accidents; Accidents Prevention; Oil and Gas Industry; Risk Management; Occupational Health

O acidente com a plataforma Deepwater Horizon, em 2010, é considerado o maior desastre do século no setor de óleo e gás. Esse evento teve como consequências 11 trabalhadores mortos, 17 feridos, perda total da unidade e maior desastre ambiental no Golfo do México (Estados Unidos). A literatura existente abarca seus impactos ambientais, químicos, biológicos e econômicos, concentrando-se nas causas imediatas, ou seja, situações próximas no tempo e no espaço do evento, em especial erros humanos e falhas técnicas. Tal abordagem se dá em detrimento da identificação de possíveis causas subjacentes, que remetem a fatores gerenciais e organizacionais. O objetivo deste ensaio é responder à pergunta: que fatores teriam contribuído para a ocorrência do desastre que acometeu a plataforma, considerando-se a relevância da dimensão coletiva do trabalho? Nosso aporte teórico-metodológico se baseia na ergonomia da atividade e na psicodinâmica do trabalho, valorizando também a condução sinérgica da relação entre os saberes das ciências e da experiência dos trabalhadores, como propõe a perspectiva ergológica. Foram identificadas falhas de decisão tomadas por quem se situa à ponta do processo, na operação de sistemas de alta complexidade, mas que não devem ser vistas como ponto de chegada, e sim de partida na análise de grandes acidentes. O entendimento de tais decisões demanda a compreensão das representações construídas pelos trabalhadores, inclusive em sua dimensão coletiva e compartilhada. A comunicação (ou lacunas de comunicação) entre os trabalhadores e fatores organizacionais no contexto do acidente são aspectos essenciais a serem considerados na análise de eventos que envolvem sistemas complexos.

Palavras-chave:
Acidentes de Trabalho; Prevenção de Acidentes; Indústria de Petróleo e Gás; Gestão de Risco; Saúde do Trabalhador

El accidente de Deepwater Horizon en 2010 es considerado el mayor desastre del siglo en el sector del petróleo y gas. Este evento resultó en 11 trabajadores muertos, 17 heridos, pérdida total de la unidad y un gran desastre ambiental en el Golfo de México (EE.UU.). La literatura existente abarca sus impactos ambientales, químicos, biológicos y económicos, enfocándose en las causas inmediatas, es decir, situaciones próximas en el tiempo y espacio del evento, especialmente errores humanos y fallas técnicas. Tal enfoque no identifica las posibles causas subyacentes, que se refieren a factores gerenciales y organizacionales. El objetivo de este ensayo es responder a la pregunta: ¿qué factores habrían contribuido a la ocurrencia del desastre que afectó a la plataforma, considerando la relevancia de la dimensión colectiva del trabajo? Nuestro aporte teórico-metodológico se fundamenta en la ergonomía de la actividad y en la psicodinámica del trabajo, valorando además la conducción sinérgica de la relación entre el saber de las ciencias y la experiencia de los trabajadores, tal como lo propone la perspectiva ergológica. Se identificaron fallos de decisión, tomados por quienes están al final del proceso, en la operación de sistemas de alta complejidad, pero que no deben ser vistos como un punto de llegada, sino un punto de partida en el análisis de accidentes mayores. Comprender tales decisiones requiere comprender las representaciones construidas por los trabajadores, incluso en su dimensión colectiva y compartida. La comunicación (o brechas de comunicación) entre los trabajadores y los factores organizacionales en el contexto del accidente son aspectos esenciales a ser considerados en el análisis de eventos que involucran sistemas complejos.

Palabras-clave:
Accidentes de Trabajo; Prevención de Accidentes; Industria del Petróleo y Gás; Gestión de Riesgos; Salud Laboral

Introduction - an accident of great proportions and obscure areas

The accident with the Deepwater Horizon oil rig occurred on April 20, 2010, in the Macondo well, under the responsibility of the multinational company BP. So far, it can be considered the most significant disaster of the 21st century in the oil and gas sector. Its human, material, and environmental effects were catastrophic: 11 dead workers, 17 injured, total loss of the unit, and the largest environmental disaster in the Gulf of Mexico (United States) ¹. About 5 million barrels were dumped into gulf waters over almost three months (87 days), causing a real “black tide”. The indirect effects of the accident were broad, affecting even the fish and seafood consumption in the affected region ² and the increase in the suicide tendency in a portion of the citizens living in this area ³.

The rich scientific literature on the accident mostly deals with its environmental, chemical, biological, and economic effects, as indicated by the Scopus database, considering the descriptors “deepwater horizon” and “ergonomics”, or “ergonomic”, or “collective”, or “organizational”, or “organizational”, or “organization”, or “work”, or “labor”, in the areas of social sciences, engineering, energy, arts and humanities, multidisciplinary, psychology, nursing, and neurosciences. The SciELO database shows no articles with the respective descriptors in Portuguese or Spanish. Regarding the causes of the accident, the literature focuses on the immediate causes of the accident, that is, situations close to the time and space of the final event, especially human errors and technical failures, to the detriment of the underlying causes, which refer to factors of managerial and organizational nature.

This analysis aims to, 12 years after the disaster, carry out a reflection that, starting from the immediate causes, can raise the visibility of the underlying causes, highlighting the collective dimension of work - especially communication - and the organizational factors involved, sometimes immersed in “obscure areas” ⁴. The preparation of this essay assumes that the analysis of accidents with complex systems, such as the Deepwater Horizon oil rig, demands the contribution of references such as the activity ergonomics and the work psychodynamics, whose power helps us to reveal elements that integrate the broader context (in time and space) to the event itself ⁵. Analyzing the accident from this perspective can evidence aspects of managerial and organizational nature, with greater nuance for issues related to communication between workers, thus bringing original contributions that provide a better understanding of possible factors underlying the disaster.

In this sense, in line with what Magne & Vasseur ⁶ emphasize - that accidents with complex systems are triggered by direct, immediate, technical, and/or human causes (“failures/errors”), but their manifestation and/or their unwinding are driven, favored, precipitated by underlying causes and conditions, with a focus on organizational (complex) factors -, the essay seeks to answer the following question: in the case of the Deepwater Horizon oil rig, which of the main factors would have contributed, as underlying causes, to the disaster that occurred with it, considering the relevance (centrality) of the collective dimension of work in the course of the process?

Theoretical-methodological framework that guides the reflections

This essay is associated with a research project on the triad of work, health, and safety in the oil industry with emphasis on the offshore sector, initiated in 2002 and coordinated by two of its authors. In its development, the theoretical-methodological framework guide has privileged the materials of activity ergonomics ^7,8,9 and of work psychodynamics ^10,11. It is also noteworthy our search for a synergistic conduction dynamics of the relationship between the knowledge of the sciences (with scientific status) and those related to the experience of workers (of a practical nature), pertinent to the analysis of work situations, in convergence with the ergological perspective propositions ^12,13. This essay emphasizes the activity ergonomics and some of its main concepts, presented below, among which the representation stands out, which proved fruitful for the analysis undertaken. Considering the specificities and characteristics of the context studied, contributions originating from other references can be used.

The following methods and techniques of investigation were used: (i) the content produced about the disaster and available in scientific articles and books ^{14,15,16,17,18,19,20}; (ii) documentary research, with emphasis on two reports, that of the National Commission instituted by the U.S. Government ²¹ and, to a lesser extent, the one prepared by the BP internal incident investigation team ²²; (iii) articles published in the mainstream media (obtained on the Internet) and gathered in dossier format, organized over the last few years; (iv) interlocution, on different occasions, in 2020, with two experienced workers who worked in the drilling industry (one at Petrobras and, the other, a former Halliburton employee), including abroad; and (v) interactions established with other workers throughout the project, including five who worked at Schlumberger, two at Baker Hughes, and one at Halliburton, companies among the largest multinationals linked to the drilling industry.

The empirical material from contact with experienced workers in the drilling industry was produced based on formal and semi-structured interviews, mobilized by using the network of contacts of one of the researchers, throughout the aforementioned project. Such interlocutions contribute to overcome the difficulties in understanding the functioning of a complex system such as Deepwater Horizon and the organizational logic that governs it, from the view of those who deal directly with the variability in the drilling industry.

Complex sociotechnical systems - the role of the collective dimension of work and organizational factors

Complex high-risk systems involve the relationship between a set of individuals with technical tools to achieve the expected operational objectives. Among the complexity sources are the risk associated with instability and/or unpredictability of interactions (including non-linear) of their subsystems, and the need for cooperation between agents. Thus, the reliability of these systems depends on the technical and human domains. The greater the number of connections, components, and activities at stake, the higher the association and risk potentialization probabilities ^15,17,23.

The characteristics of the installations, the technical device, and the operation of certain plants and units of the continuous process industries, associated to the nuclear, chemical/petrochemical, petroleum, etc., sectors, then allow us to view them as classic examples of so-called high-risk “complex systems” or “complex socio-technical systems” ²⁴, capable of triggering the so-called expanded or large-magnitude accidents ^4,15,25. These are events with the potential to simultaneously cause multiple damages - material, environmental, and to the physical and mental health of exposed human beings. These damages may even extrapolate their time and spatial landmarks, as in this case under analysis, which denotes the high degree of risk present in well drilling. This is corroborated by the Accident Statistics for Offshore Units on the UKCS 1990-2007²⁶ report, published the year before the Deepwater Horizon accident, and which, in addressing the current context in the UK over a period of almost 20 years (1990-2007), indicated that drilling activity had the highest number of accidents for the floating (mobile) rig segment. França et al. ²⁷ indicate that, throughout their evolution to the present day, the specific risks of drilling activities have greatly increased their potential to harm people, the environment, and corporate sustainability.

The case of Sidoarjo, in Indonesia, reinforces the scope of the possible large proportion and deleterious consequences from oil drilling activities. This accident occurred in 2006 and generated a mud volcano that has flowed uninterruptedly since then ^28,29. And, despite unknown origin, the oil spill off the Brazilian coast in August 2019 was also a recent warning for the severity and extent of the damage that major events related to the oil and gas sector can cause. This is considered the largest environmental disaster (in extension) caused by oil on the coast of Brazil and the largest tropical coastal contamination in the world ³⁰.

Perrow ²³ emphasizes that, in such complex systems, so-called nonlinear interactions predominate, whose central characteristic - one of the distinctive features of their complexity - would be the possibility of replicating themselves as other parts or subsystems are reached, unlike linear interactions, which are only adjacent or serial.

Along these lines, oil rigs can be seen as quite illustrative of this type of system, and the Deepwater Horizon accident, an emblematic case of an expanded accident with catastrophic developments. It was not by chance that it received enormous attention from several internationally renowned experts on the subject ^{14,15,16,17,18,19,20}.

Then, note some complexity indicators from the perspective of activity ergonomics, considering the contributions of authors such as Leplat ³¹ and Pavard et al. ³²: (a) the multiplicity of variables at stake; (b) the concurrency of the various events/situations; (c) the unpredictability and uncertainty of information; (d) the sensitivity of the system to operators’ interventions; (e) the opacity of the system, that is, the lag between the system requirements and the action model that can serve as the basis for the activity.

These aspects invoke the debate about operators’ difficulty to build a clearer and more precise representation of the situation during the activity, during the actual (or effectively performed) work, and which is distinguished from its prescriptive dimension (the prescribed work), associated with the task objectives defined a priori. A difficulty also associated with the way this representation is shared among the agents involved in the same situation. Hence, Leplat ³¹ underlines the idea of shared complexity and knowledge sharing for the execution of the task. For him, if, in some situations, there is an intelligence (cognitive competence) that can be seen as acting in a distributed way between technical (or technical-organizational) devices and operators - a distributed cognition ^33,34 -, then one can speak symmetrically of a distributed complexity. Therefore, he emphasizes the importance of considering this cognitive activity inserted in a context, crossed by different situational variables, mentioning the research identified with the current of situated action ³⁵.

This line of argument seems fruitful to us if we do not wish to circumscribe our perspective of analysis to the record of “standardized safety” (strongly based on compliance with the rules and norms), but to the Record of “safety in action” (focused on the ability to mobilize competencies in the face of unforeseen events). The first emphasizes acquiring procedures and “safe behaviors”, whereas the second bets on the ability to anticipate, to deal with instability, with malfunctions and variability - variations and deviations in relation to the standard, normative mode of operation - and which, often, are predominant, to the detriment of the process stability. It is not about seeing them as antagonistic, but of apprehending their complementarity ^36,37,38.

On the other hand, considering the means available to the collectives of work to perform the coordination of the tasks in necessary. Here, the concept of “work collective” is employed in a different sense from that of prescribed team. Its performance presupposes sharing rules that transcend the hierarchy, beyond formal instances, as a result of the very dynamics of self-regulation from within ³⁹. For Dejours ⁴⁰, to a large extent, “human errors” can be minimized thanks to the efficiency of these collectives and, for this, cooperation plays a strategic role. According to this author, the reliability and security of such systems would be based, to some extent, on the cooperation that occurs within these collectives, on the cohesion among its members, on the complementarity of knowledge (formal and informal) present there. Thus, the information support and the technical and organizational factors involved in the coordination of tasks become important. Regarding these collectives, the situations in which workers belonging to different teams/companies enter into contact (in the same place), for executing different tasks ⁴¹, something increasingly frequent with the augmentation in outsourcing, should be highlighted. A new task - the management of interfaces -, which is intertwined with those considered as main tasks and is not, as a rule, considered by the company as such, is necessary and can cause harmful effects for reliability ⁴².

Another situation especially critical for collective work, that is, the way operators cooperate in a work situation, involves shift change (intrinsic to offshore work). The time of co-presence between the teams that assume and leave the shift is not always enough to enable the effective information exchange and to provide operators who start their shift favorable conditions to take the job ⁴³.

This scenario gains new contours when we incorporate the psychic dimension into the analysis, since the potentially harmful, irreducible, and inherent risks to the task, in addition to their direct effects produced on the body, also indirectly affect the psychic functioning ¹⁰, such as the shift relay itself. The fear of accident or professional illness - more recently, contamination by coronavirus ⁴⁴⁾ - and the fear of not being up to the task or the responsibilities, as well as the difficulties related to certain aspects of work organization require constructing and implementing defense strategies (individual and collective) to contain the suffering of psychic order associated with the activity development. These defenses would fulfill the function of denial/euphemization of the perception of reality ¹⁰, hence, paradoxical conduct and indiscipline regarding prevention and safety measures, demonstration of external signs of courage, resistance to suffering, strength, virility, etc., are verified ^10,11.

As we have previously pointed out, in a situation with the characteristics of the accident involving Deepwater Horizon, every event (incident or accident) is initiated by direct, immediate, technical and/or human causes (“human error”). Its development, however, is driven by underlying causes and conditions (factors) of organizational nature ⁴⁵ - including the adoption of forms of management that accentuate the tendency to the precariousness and intensification of work. Going back to such a level that the very management logic that guides the performance of a given organization is called into question is possible. According to Le Coze ¹⁶, the case of BP would be paradigmatic in this sense.

The Deepwater Horizon oil rig and a brief description of the accident

Deepwater Horizon was a drilling unit (probe of the semi-submersible type), owned by Transocean, an American multinational and world leader in the offshore drilling industry. It was a fifth-generation platform, considered the largest and one of the most modern drilling rigs in the world at the time of the accident. It was in the service of BP, the operator of the field in which the Macondo well was located, and leased for USD 560 million.

The Macondo well was located at a 1,500m water depth, and 4,000m inside the seabed had already been drilled. This means that, between the water surface and the lower end of the well, the distance was 5,500m. Deepwater Horizon was about to perform the so-called temporary abandonment, a maneuver in which, after the well is sealed, the drilling rig performs the tripping out, disconnecting from the well (“abandons” its lease). Days, weeks, or even months later, another platform will continue the process, connecting to the well to put it into production, only then extracting oil and gas from the reservoir. Before abandonment, however, sealing the well is necessary, sealing its lower end (via cementation of its base) to prevent hydrocarbons (oil and gas) from migrating to its interior, while it is not at the productive phase (Figure 1).

Figure 1
The three stages of the cementing process (plugs push the cement until the collar breaks and occurs the consequent dispersion of the cement through the well).

In the case of Deepwater Horizon, according to the report of the National Commission ²¹, this cementation was carried out the day before the accident (April 19th, 2010), with the use of a mixture whose preparation was under the responsibility of Halliburton, another large multinational in the sector. Its biggest competitor, Schlumberger, would assess the quality of the cement used in the well at this final stage of drilling, but was dismissed before performing the work. In the PBS/TVI ²⁴ documentary ⁴⁶, an oil worker who was on board the unit uses the expression “they were practically sent away”.

Then, carrying out pressure tests is part of the procedure, which aim to evaluate the integrity of the well, verifying that the cement injected into the base of the well will satisfy the function of preventing the entry of hydrocarbons inside. The values obtained in two of these tests were well above the expected ²¹. This indicated that a leak could be ongoing, from a possible anomaly in cementation. Faced with this scenario, however, in which the data signaled the possibility that the well was “leaking”, there was a shift change. And, even with the divergent interpretation of those responsible for the operation in each shift regarding the values obtained ²¹, continuing the intervention in Macondo was allowed. The discrepancy related to the representation of what was actually occurring in the well is central to analyzing the accident.

The developments that followed, according to the reports of the National Commission ²¹ and of BP ²², were catastrophic, since, a few hours later, occurred an uncontrolled flow of fluids contained in the reservoir into the well, in a kind of eruption, which hit the rig abruptly and quite violently, configuring what is technically called blowout ⁴⁷, the most serious problem likely to occur during drilling. In such circumstances, it is also said that “the well is exploding”. Unfortunately, when the methane gas that spread throughout the unit came into contact with some ignitor source in the engine room, there was a first and great explosion.

In addition to the fire and gas systems failing to prevent the ignition of hydrocarbons, to make matters worse, attempts to seal (close) the well with a device called BOP (blowout preventer - Figure 2), which is a flow blocker, also failed.

Figure 2
BOP (blowout preventer) positioned to close the well in case of a serious emergency.

From there, what occurred was the aggravation of the fire with other explosions, culminating in the sinking of the unit on the morning of April 22, 2010. We must emphasize that 11 workers died, 17 were injured, numerous oil works arrived on land in shock, and initial attempts to obstruct the spill at the bottom of the sea proved to be totally fruitless, causing it to last for 87 days ¹.

Well integrity testing and system opacity

First, note that if oil and gas have drained from the reservoir into the well, then the cement has not fulfilled its function of sealing it properly.

And what about the misinterpretation of the pressure tests conducted by the night shift team in the drill booth? Let us remember that, in the evaluation of the person in charge of the previous shift (the day shift), there was “something wrong with the well”, due to the 1,360psi of pressure indicated on the monitor screen ²¹, a kind of maximum “warning signal” ⁴ of a series that had begun a few months before the accident and intensified in the five days prior to blowout ¹⁷. However, their shift ended and, despite supporting such a point of view, it was not immediately corroborated in the passage to the night manager. Note that he had just taken on the last night journey of his final boarding on Deepwater Horizon since he had been promoted and would disembark the next morning.

In several accidents with major repercussions, such as the Bhopal chemical industry (India), the Chernobyl nuclear power plant (Ukraine), and the Piper Alpha oil rig (British sector of the North Sea), the shift change was relevant to the network of risk factors, without forgetting that it is intrinsic to offshore activity and especially critical to collective work ⁴³. The case on screen seems clear, since, with the course of the night shift, its responsible constituted a distinct representation of the one constructed by the person in charge of during the day, establishing a clear divergence about the phenomenon in progress within the well.

By the way, this also evokes the discussion around opacity as one of the structural characteristics of high complexity systems, since they do not give sufficiently clear information for the operator to intervene in certain situations, as indicated by the complexity analysis from the perspective of activity ergonomics ³¹. In fact, the well drilling activity has a whole support from the use of sophisticated devices and sensors, which capture parameters inside the well, transmitting them to the oil rig (on the surface), to subsidize those who are at the head of the operation. Operators, however, cannot effectively visualize what goes on at the bottom, the leak itself. In the expression of some professionals with whom we spoke, “we work blind!”.

Thus, for the person in charge of the night shift, the high pressure was not due to the leakage of the well, but to a phenomenon that can occur inside and is known in the drilling activity as “bladder effect”, a kind of spurious signal associated with the weight of fluid in the well column. To resolve any doubt, a complementary pressure test was used, performed with an auxiliary line (the kill line - Figure 3) that connected the probe directly to the well by an alternative route, and should indicate the same pressure (which had already increased from 1,360 to 1,400psi), if the well had a leakage. Since the measured pressure was null, the reading taking the phenomenon (high pressure) as a manifestation of a “bladder effect” was reinforced. Unknowingly, the kill line would have been blocked or connected at some point on the rig (it cannot be said for sure, given the sinking of the unit), resulting in its null pressure.

Figure 3
Kill line highlighted.

This interpretation was accepted by the other present on the site in the end, including the BP fiscal (agent of the contracting company on site), despite the difficulties inherent to the (complex) sharing of this type of representation ³¹. In summary, they assumed as true the false information (the null pressure) and disregarded the correct information, associated with the existing pressure (of 1,400psi).

Regarding the possible manifestation of a “bladder effect” in those circumstances, the chief scientist of the National Commission was adamant: “They were clearly wrong”. A posteriori, there is no doubt about this, but our theoretical framework forces us to ask something absolutely decisive to better problematize the analysis: what could have induced them to interpret the scenario in question, in that context, as the manifestation of a “bladder effect”? How did professionals with extensive experience and competence share a representation that would “clearly” be wrong? Regarding the night manager, he was a professional who, in addition to the formal recognition of his superiors, had already acquired the respect of colleagues and knew the unit very well for he worked on it since it left the shipyard in 2001.

The variability, organizational factors, and gaps in communication: a nebulous and dangerous myriad?

A kind of postulate that should never be forgotten by oil workers in this activity is that, despite technological advances, knowing for sure what is really under the ground is impossible until the wells are drilled. Although seismic analyses are fundamental beacons, a more accurate notion of the difficulties to be faced is possible only in the course of real work, something not yet fully addressed even in the so-called “probes of the future”, a new generation of oil rigs that use artificial intelligence-based (AI) technology ⁴⁸.

The course of drilling should assume this degree of uncertainty and unpredictability as another structural data of the process, whose variability will present in greater or lesser intensity and frequency depending on the characteristics of the situation, something that can lead to substantial delays in the schedule. Undoubtedly, Macondo proved to be a very challenging well and, on the day of the accident, the schedule delay was already of 43 days. Considering that the total daily cost of a probe like Deepwater Horizon could reach USD 1 million, we can get an idea of the pressure on the people directly involved with decisions that would extend the temporary tripping out.

According to one of the oil workers on board, “everyone was dying to get out of that well, the platform had already experienced some kicks [uncontrolled situations in the well that, if not fixed in time, can evolve into a blowout], several problems, surely millions of dollars had already been invested…” ⁴⁶. Such harsh adverse conditions gave it the nickname “well from hell”. As a professional with extensive experience in drilling also told us, based on the delay, the numerous difficulties faced and the pressure they were under so far, “nobody wanted that downtime”.

A common aspect in the contractual clauses in force in the sector, we must clarify that, if the contracting company’s fiscal (BP) verifies that the progress of the operation is being compromised by some failure of the contractor (in this case, more specifically, Transocean), the latter becomes liable to bear the contractual sanctions provided for by the so-called downtime. The burden then rests on the service provider while it is paralyzed, precluding the contractor of any cost in that time interval.

Add to that some of the numerous constraints to which oil workers are exposed under boarding arrangements on the oil rigs, in which confinement and isolation extend for 14 uninterrupted days with two work teams that take turns in 12-hour shifts (one in the morning and the other in the evening). The issue of safety is critical in the face of a picture of sleep deprivation, fatigue, and psychic tension, among other factors, besides the need to perform tasks that require attention and alertness at inappropriate moments from the point of view of biological rhythms ^49,50, thus raising the estimated risk in these processes, which tends to increase as the daily working hours of the shifts goes on (Figure 4). We must remember that the night manager was in his last shift of work (the 14th) and the pressure for a final decision, with the subsequent completion of the drilling stage after all the mishaps they faced, had acquired special contours for him since it would also be his last day at Deepwater Horizon, no longer returning to the unit due to the promotion he had received.

Figure 4
Estimated risk in shift work, given a 60-hour work week.

A retreat at that time would mean prolonging the delay and intensifying the level of psychic suffering, due to the adversities they would inevitably face. As the work psychodynamics proposes, if using defense mobilizations is an expected conduct in such injunctions to mitigate suffering, we should not lose sight of its counterpart as a risk of impairment of cognitive dynamics ^10,11. Such a situation occurs, in particular, when facing the “well from hell”, there is the feeling that the work has turned into a “hell” and the system resilience is under severe tension, at its limit ⁵¹.

It is worthy remember that the Deepwater Horizon had only six centralizers (devices that enable uniform cementation at the lower end of the well) on board and Halliburton had ordered the shipment of 15 more of these devices since the project indicated a total of 21 centralizers. The day after that determination, however, one of BP’s managers reversed the order, claiming that such a maneuver (the placement of the 15 additional centralizers) would consume 10 more hours of work ¹⁴. Also, the six centralizers on board were of a different standard, which could lead to serious compatibility problems, namely the risk of such centralizers getting stuck inside the well, further delaying the intervention for days and causing another possible downtime. Add to this the BP’s decision not to perform the cement quality test, to be done by Schlumberger, at the price of USD 128,000, consuming 9 to 12 additional hours. This test could have identified the flaw in the cementing process, but Schlumberger personnel were “sent home” 10 hours before the explosion ¹⁷.

When we look back at other aspects that surrounded the incumbent and others involved in the drilling booth, we realized that two of them are crucial to better understand some of the factors that would have contributed to the routing given by the operators at that juncture.

First, note that the information that had reached them is that the cementation succeeded. In turn, this supported BP’s decision to dismiss Schlumberger from the platform and not assess the quality of the cement, which would probably reveal the failure in cementation. In the event of some unexpected complication, the responsible team understood that the integrity test would identify the problem.

The step related to this test evidently ended up acquiring greater importance throughout the process, but this status of greater relevance than normally expected was never communicated to those who led the process ¹⁴. Therefore, according to the scenario that was assumed as the most realistic (success of cementation), seeking another explanation for the discrepancy already pointed out in its values (1,400psi) other than leakage was plausible. According to one of our interlocutors, if the information about cementation were distorted or incomplete, certainly the decisions made by the operators could be affected.

Another element of consideration is that, when the same employees of Transocean and BP considered the possibility of a problem in cementation that could evolve into a leak, they considered the safeguard from the BOP performance, showed in Figure 2 and seen as a kind of last protective barrier. However, Hopkins ¹⁴ points out that if the BOP is triggered after the progression of a severe occurrence, just like the blowout seen in Macondo, the chances of it not acting effectively are considerable. The equipment shows its limits precisely in situations where it is most necessary.

In fact, for a blowout like what happened at the Macondo well to be perceived in a timely manner, a key requirement would be effective engagement in monitoring activity. But, for the workers of the company Sperry Sun (responsible for this task), the well had been considered safe twice: when the engineers announced that the cementation had been a success and then when BP assured that the well had passed the integrity test. In other words, they had an entirely different representation from that of the real situation, evidencing the importance of the context, whose crucial role was emphasized in studies based on the current of “situated action” ³⁵.

To which moment should we rewind on major accident analyses?

There is a question that presents itself recurrently in accidents of this nature: to which moment should we rewind the course of events ⁵²? In our case, should we go back a few weeks/months before the accident or until 2008, when 211 people were evacuated from a platform in the Caspian Sea, also due to cementation problems, and the field was closed for months, with significant impacts on the corporative partners of the enterprise ¹⁴? Or, further back ten years, until 1998, when British Petroleum merges with Amoco, giving rise to BP, and then a quite aggressive program of organizational restructuring gains momentum ¹⁵?

This program was built based on a new organizational model, focused on business units, in line with what some authors called a “networked company.” In this type of arrangement, the control is predominantly associated with fulfilling goals and results, offering these subareas greater freedom regarding project management and dilution of responsibilities. BP’s business has since gone from focusing on engineering to the commercial and financial management of such units, in which outsourcing and cost reduction have been largely stimulated ^15,16. This compares to Llory & Montmayeul’s ⁴ observation, who noted that, in 2004, some of BP’s leading senior engineers already highlighted, as lessons from the accident with the Grangemouth refinery (Scotland), the need to invest more heavily in developing specific indicators of higher risks when compared with traditional indicators of accidents at work. Moreover, the same professionals recognized that BP had an exacerbated focus on short-term costs reduction.

Despite its consequences regarding precariousness and intensification of work, questioning this strategy was difficult over the years that followed since it had helped elevate BP to leading oil producer in the U.S. territory and the second largest private company in the sector around the world. Its trajectory, however, was the subject of serious questioning when, in the mid-2000s, it suffered, in three of his main sectors of activity (refining, exploration and production, and transportation), an unprecedented sequence of accidents: the explosion at the Texas City (Unioted States) refinery, in 2005; the listing of the Thunder Horse platform, in the same year, in the Gulf of Mexico; and the pipeline leak in Prudhoe Bay, in Alaska (United States), in 2006. In particular, the accident at the Texas City refinery had left a trail of destruction and death: a balance of 15 dead and 180 injured, damage of about USD 1.5 billion, and damaged buildings up to 1,200m around the refinery ^4,15. Also note that, in 2000, BP’s aforementioned refinery in Grangemouth had also been the scene of a major accident ^4,15.

After the accident in Texas City, the U.S. Chemical Safety Board (independent federal agency) report found that the refinery disaster had been caused by BP’s own organizational and safety deficiencies, a combination of cost cutting (25% in 1999 and another 25% in 2005), production pressures, and lack of investments. The downsizing of the operational team and its training were also criticized. For Llory & Montmayeul ⁴, this accident highlights, explicitly, the role of management as a decisive element for the occurrence of events of this nature. Ferreira ⁵³, in turn, also points to the chronic downsizing of personnel in BP refineries, not only among operators, due to this obsessive policy of cost reduction and a threat to the safety of operational processes. This is a potentially harmful role, at least in the way adopted by BP.

Note that this was a “model” (standard) that had expanded greatly in the sector, in the wake of a broader movement linked to productive restructuring that broke out in the central countries in the 1980s, and expanded in the following decade, parallel to the globalization process. In the case of Transocean (of Norwegian origin), ever since it was acquired by a U.S. drilling company in 1996, it has continued to expand and consolidate its position as the world’s largest company specializing in offshore drilling. Its head office was moved to Houston and few of its top Norwegian staff remained in leadership positions. The company’s culture was shaped by different management programs developed under the North American aegis. A relevant example would be the safety management systems, guided by a behavioral bias of workers and traditional indicators of absence due to accidents, as opposed to the dominant trend under the Norwegian context, more focused on organizational aspects and the use of tools such as robust technology and barrier system ⁵⁴.

Moreover, we must note that the functioning of a sociotechnical system with high complexity and submitted to the aforementioned organizational arrangement presupposes multiple interactions between different teams, instances and companies ⁵⁵, in which cooperation and communication occupy an absolutely central role. On the other hand, one of the difficulties of dealing with this configuration is the management of these various interfaces that present themselves during the production process, often under big pressure. In the analyzed case, the arrangement was the following:

• Field operator (BP);

• Probe owner (Transocean);

• Cementing (Halliburton);

• Cement quality (Schlumberger);

• BOP manufacturer (Cameron);

• Flow monitoring (Sperry Sun);

• Float collar (Weatherford);

• Drilling mud (M-I Swaco);

• Remotely operated vehicles - ROV (Oceaneering).

Note that these interfaces, however, are far from restricted to the managerial level, to the interactions and decisions made by managers and supervisors. Thus, one of the central questions that emerges from our interpretation of what happened is the conception that, in situations like this, the collective dimension presents itself as a crucial element. Although from different companies, workers cannot act in isolation. They are forced to interact and play an integrative role in the activity course, contributing to the flow of information and knowledge between the various collectives.

If the actions of these collectives - and the cooperation and communication that permeate them - are continuously exposed to the precarious face of outsourcing, the pressures for aggressive goals and cost reduction, it becomes an element of destabilization of the system reliability, including in the operational safety plan ^38,56.

Final considerations - a new milestone for the oil industry?

The Deepwater Horizon oil rig accident serves as another warning about the enormous risks involved in the drilling activity. Understanding it is an unavoidable task. Especially when the results show the largest operator in the country and in most of the fields in the “pre-salt” of the Brazilian coast (the Petrobras company) implementing forms of management aligned with the precariousness trends and their harmful consequences as exposed in this essay. The discussion about the factors underlying the accident is relevant, considering that BP can be considered as a “paradigmatic case” ¹⁶ in the oil industry, given the logic according to which it operated in the years prior to the accident - with emphasis on its forms of management. For Yergin ⁵⁷, studies, debates, and learning possibilities about what happened to the oil rig will continue for years.

Thus, the analysis based on the multidisciplinary theoretical framework adopted, with greater emphasis on the activity ergonomics, helped us to corroborate that certain errors and decision failures made by those who are at the tip of the process, in the operation of systems of this nature (of high complexity), should not be seen as an endpoint, but as a starting point in the analysis of major accidents.

Our investigation also showed that a better understanding of such decisions involves a better comprehension of the representations constructed by these workers (that includes their collective/shared dimension) and of how they deal with the events and variabilities they face. In short, by combining the experience of workers with the knowledge of the scientific literature, this analysis revealed relevant communication aspects (or gaps) in the activity and crucial organizational factors in the context of the accident. This is a set of elements relatively distant from the accident itself and, therefore, difficult to identify since they are sometimes immersed in “obscure areas”. Thus, despite the many publications in the academia on the Deepwater Horizon disaster, this study brings original elements that complement the scientific literature on this case. In this regard, note that an originality point of this essay is bringing the experience of workers of the sector to contribute to our investigative effort.

In processes with such characteristics, a research analysis that seeks to highlight cognitive dynamics during the activity may present important contributions to the analysis of these accidents and incidents and to their prevention, as indicated by some authors cited. Production and safety management systems, therefore, need to review their focus of action, to anticipate these incidents, in convergence with the so-called “safety in action”. It is about adopting a proposal that highlights the real work, the analysis of incidents, the regulation processes, and risk management during the action, valuing dissent and instituting “spaces for debate on work” ⁵⁸ (p. 193).

Just over 12 years after the explosion and sinking of the Deepwater Horizon, our analysis can also be seen as a contribution so that the lessons bequeathed by events of this nature, which “echo” with other disasters that occurred in this industry, are not the target of the propensity to forgetfulness, resulting from the “erosion of time and the recurrence of accidents” ⁴ (p. 6). Moreover, if the accident with the P-36 oil rig can be considered a milestone for the health, safety, and environment (HSE) area of Petrobras ⁵⁹, we understand the expectation that the Deepwater Horizon disaster, due to the magnitude of its deleterious consequences and the issues it evokes, in part discussed in this text, would have established “a new milestone for the entire oil industry” ⁽⁶⁰.

Acknowledgments

To the Postgraduate Program in Public Health, Sergio Arouca National School of Public Health, Oswaldo Cruz Foundation (PPGSP/ENSP/Fiocruz), where prof. Marcelo Figueiredo attended his postdoctoral internship, under the supervision of prof. Dr. Lucia Rotenberg. The present text consists of one of the results of that internship. Indirect financing due to the Brazilian Graduate Studies Coordinating Board (CAPES) doctoral scholarship of one of the authors.

Referências

• ¹
  Barron MG, Vivian DN, Heintz RA, Yim UH. Long-term ecological impacts from oil spills: comparison of Exxon Valdez, Hebei Spirit, and Deepwater Horizon. Environ Sci Technol 2020; 54:6456-67.
• ²
  Simon-Friedt BR, Howard JL, Wilson MJ, Gauthe D, Bogen D, Nguyen D, et al. Louisiana residents’ self-reported lack of information following the Deepwater Horizon oil spill: effects on seafood consumption and risk perception. J Environ Manag 2016; 180:526-37.
• ³
  Bell TR, Langhinrichsen-Rohling J, Selwyn CN. Conservation of resources and suicide proneness after oilrig disaster. Death Stud 2020; 44:48-57.
• ⁴
  Llory M, Montmayeul R. O acidente e a organização. Belo Horizonte: Fabrefactum Editora; 2014.
• ⁵
  Figueiredo MG, Alvarez D, Adams RN. O acidente da plataforma de petróleo P-36 revisitado 15 anos depois: da gestão de situações incidentais e acidentais aos fatores organizacionais. Cad Saúde Pública 2018; 34:e00034617.
• ⁶
  Magne L, Vasseur D. Risques industriels - complexité, incertitude et décision: une approche interdisciplinaire. Cachan: Lavoisier; 2006.
• ⁷
  Daniellou F, organizador. L’ergonomie en quête de ses principes. Toulouse: Octarès; 2015.
• ⁸
  Falzon P, organizador. Ergonomia construtiva. São Paulo: Blucher; 2016.
• ⁹
  Teiger C, Lacomblez M. (Se) Former pour transformer le travail: dynamiques de constructions d’une analyse critique du travail. Québec: PUL/Bruxelles: ETUI; 2013. (Santé et Sécurité du Travail).
• ¹⁰
  Dejours C. Trabalho vivo. Brasília: Paralelo 15; 2012.
• ¹¹
  Dejours C. Le choix: souffrir au travail n’est pas une fatalité. Paris: Bayard; 2015.
• ¹²
  Schwartz Y, Durrive L, organizadores. Trabalho e ergologia II: diálogos sobre a atividade humana. Belo Horizonte: Fabrefactum Editora; 2015.
• ¹³
  Schwartz Y, Durrive L, organizadores. Trabalho e ergologia: conversas sobre a atividade humana. 3ª Ed. Niterói: EdUFF; 2021.
• ¹⁴
  Hopkins A. Decisões desastrosas: as causas humanas e organizacionais do desastre do Golfo do México. São Paulo: Blucher; 2022.
• ¹⁵
  Le Coze JC. Trente ans d’accidents: le nouveau visage des risques sociotechnologiques. Toulouse: Octarès; 2016.
• ¹⁶
  Le Coze JC. Globalization and high-risk systems. Policy and Practice in Health and Safety 2017; 15:57-81.
• ¹⁷
  Perrow C. The next catastrophe: reducing our vulnerabilities to natural, industrial, and terrorist disasters. Princeton: Princeton University Press; 2011.
• ¹⁸
  Skogdalen JE, Vinnem JE. Quantitative risk analysis of oil and gas drilling, using Deepwater Horizon as case study. Reliab Eng Syst Saf 2012; 100:58-66.
• ¹⁹
  Vinnem JE. FPSO Cidade de São Mateus gas explosion: lessons learned. Saf Sci 2018; 101:295-304.
• ²⁰
  Woolfson C. Preventable disasters in the offshore oil industry: from Piper Alpha to Deepwater Horizon. New Solut 2012; 22:497-524.
• ²¹
  Graham B, Reilly WK, Beinecke F, Boesch DF, Garcia TD, Murray CA, et al. Deep water: the gulf oil disaster and the future of offshore drilling. Washington DC: US Independent Agencies and Commissions; 2011.
• ²²
  BP. Deepwater Horizon accident investigation report. Londres: BP; 2010.
• ²³
  Perrow C. Normal accidents: living with highrisk technologies. New Jersey: Princeton University Press; 1999.
• ²⁴
  Leplat J, Terssac G, diretores. Les facteurs humains de la fiabilité dans le systèmes complexes. Toulouse: Octarès; 1990.
• ²⁵
  Freitas CM, Souza CAV, Machado JMH, Porto MFS. Acidentes de trabalho em plataformas de petróleo da Bacia de Campos, Rio de Janeiro, Brasil. Cad Saúde Pública 2001; 17:117-30.
• ²⁶
  UK Offshore Energies. Accident statistics for offshore units on the UKCS 1990-2007. Londres: UK Offshore Energies; 2009.
• ²⁷
  França JEM, Hollnagel E, Santos IJAL, Haddad NA. FRAM AHP approach to analyse offshore oil well drilling and construction focused on human factors. Cognition, Technology & Work 2020; 22:653-65.
• ²⁸
  Amalberti R. Gestão da segurança: teorias e práticas sobre as decisões e soluções de compromisso necessárias. Botucatu: Faculdade de Medicina, Universidade Estadual Paulista Júlio de Mesquita Filho; 2016.
• ²⁹
  Suprapto N, Zamroni A, Yudianto EA. One decade of the “lusi” mud volcano: physical, chemical, and geological dimensions. Chemistry: Bulgarian Journal of Science Education 2017; 26:615-29.
• ³⁰
  Soares MO, Teixeira CEP, Bezerra LEA, Paiva SV, Tavares TCL, Garcia TM, et al. Oil spill in South Atlantic (Brazil): environmental and governmental disaster. Mar Policy 2020; 115:103879.
• ³¹
  Leplat J. Quelques aspects de la complexité en ergonomie. In: Daniellou F, organizador. L’ergonomie en quête de ses principes. Toulouse: Octarès; 2015. p. 51-68.
• ³²
  Pavard B, Dugdale J, Saoud N, Darcy S, Salembier P. Conception de systèmes socio-techniques robustes. In: Terssac G, Boissières I, Gaillard I, editores. La securité en action. Toulouse: Octarès; 2009. p. 67-81.
• ³³
  Hutchins E. Cognition in the wild. Cambridge: Bradford Books/MIT Press; 1995.
• ³⁴
  Theureau J. Cognição distribuída e curso de ação. Laboreal 2020; 16:1-35.
• ³⁵
  Suchman LA. Plans and situated actions: the problem of human-machine communication. Nova York: Cambridge University Press; 1987.
• ³⁶
  Daniellou F, Simard M, Boissières I. Fatores humanos e organizacionais da segurança industrial: um estado da arte. Toulouse: Fondation pour une Culture de Sécurité Industrielle; 2010. (Cadernos da Segurança Industrial 2013-07).
• ³⁷
  Rocha R, Lima F. Erros humanos em situações de urgência: análise cognitiva do comportamento dos pilotos na catástrofe do voo Air France 447. Gestão & Produção 2018; 25:568-82.
• ³⁸
  Terssac G, Boissières I, Gaillard I, editores. La securité en action. Toulouse: Octarès; 2009.
• ³⁹
  Cru D. Collectif et travail de métier: sur la notion de collectif de travail. Travailler 2016; 35:53-9.
• ⁴⁰
  Dejours C. O fator humano. 5ª Ed. Rio de Janeiro: Editora FGV; 2005.
• ⁴¹
  Leplat J. Mélanges ergonomiques: activité, compétence, erreur. Toulouse: Octarès; 2011.
• ⁴²
  Figueiredo MG. A face oculta do ouro negro: trabalho, saúde e segurança na indústria petrolífera offshore da Bacia de Campos. 2ª Ed. Niterói: EdUFF; 2016.
• ⁴³
  Le Bris V, Barthe B, Marquié JC, Kerguelen A, Aubert S, Bernadou B. Advantages of shift changeovers with meetings: ergonomic analysis of shift supervisors’ activity in aircraft building. Appl Ergon 2012; 43:447-54.
• ⁴⁴
  Larentis AL, Silva ENC, Albuquerque HC, Almeida HP, Pina JA, Carvalho LVB, et al. Parecer sobre contaminações por Covid-19 a bordo de plataformas e contribuições para investigação da caracterização do nexo causal entre a doença e o trabalho no setor de petróleo e gás. Rio de Janeiro: Escola Nacional de Saúde Pública Sergio Arouca, Fundação Oswaldo Cruz; 2020.
• ⁴⁵
  Reader TW, O’Connor P. The Deepwater Horizon explosion: nontechnical skills, safety culture, and system complexity. J Risk Res 2014; 17:405-24.
• ⁴⁶
  PBS/TVI24. BP - o desastre continua no golfo: documentário [YouTube]. 2010. Vídeo: 45 min. https://www.youtube.com/watch?v=uN4z35trr_0
  » https://www.youtube.com/watch?v=uN4z35trr_0
• ⁴⁷
  Fernández EF, Pedrosa Junior OA, Pinho AC. Dicionário do petróleo em língua portuguesa: exploração e produção de petróleo e gás - uma colaboração Brasil, Portugal e Angola. Rio de Janeiro: Lexikon; 2009.
• ⁴⁸
  Cardoso B. Tecnologia ganha ainda mais protagonismo. TN Petróleo 2020; 26 nov. https://ouronova.com/tecnologia-ganha-ainda-mais-protagonismo/
  » https://ouronova.com/tecnologia-ganha-ainda-mais-protagonismo/
• ⁴⁹
  Folkard S, Lombardi DA. Modeling the impact of the components of long work hours on injuries and “accidents”. Am J Ind Med 2006; 49:953-63.
• ⁵⁰
  Folkard S, Tucker P. Shift work, safety and productivity. Occup Med 2003; 53:95-101.
• ⁵¹
  Pereira RF, Morgado CRV, Carvalho PVR, Santos IJAL. Pensamento sistêmico e engenharia de resiliência aplicados à segurança de processos de exploração e produção de petróleo - estudo de caso Deepwater Horizon. Ação Ergonômica 2015; 10:153-62.
• ⁵²
  Llory M. Acidentes industriais: o custo do silêncio. 2ª Ed. Rio de Janeiro: Multiação Editorial; 2001.
• ⁵³
  Ferreira LL. Falta de efetivos e insegurança em refinarias de petróleo. Rev Bras Saúde Ocup 2020; 45:35.
• ⁵⁴
  Ryggvik H. Construindo uma indústria nacional de petróleo offshore: a experiência da Noruega. Rio de Janeiro: Elsevier; 2014.
• ⁵⁵
  Paté-Cornell E. On “black swans” and “perfect storms”: risk analysis and management when statistics are not enough. Risk Anal 2012; 32:1823-33.
• ⁵⁶
  Dejours C. La panne: repenser le travail et changer la vie. Paris: Bayard; 2012.
• ⁵⁷
  Yergin D. A busca: energia, segurança e a reconstrução do mundo moderno. Rio de Janeiro: Interciência; 2014.
• ⁵⁸
  Rocha R, Mollo V, Daniellou F. Contributions and conditions of structured debates on work on safety construction. Saf Sci 2019; 113:192-9.
• ⁵⁹
  Guida HFS, Figueiredo MG, Hennington EA. Acidentes de trabalho fatais em empresa brasileira de petróleo e gás: análise da política de saúde e segurança dos trabalhadores. Ciênc Saúde Colet 2020; 25:1819-28.
• ⁶⁰
  Gosden E. Bob Dudley leaves BP amid a Gulf in percepcions. The Times 2020; 1 fev. https://www.thetimes.co.uk/article/dudley-leaves-amid-a-gulf-in-perceptions-7mb0mq6tm
  » https://www.thetimes.co.uk/article/dudley-leaves-amid-a-gulf-in-perceptions-7mb0mq6tm
• ⁶¹
  Aslan JF. Segurança: aspectos de segurança na cimentação de poços de petróleo. https://www.petroleoenergia.com.br/6041/ (acessado em 29/Ago/2021).
  » https://www.petroleoenergia.com.br/6041/

Publication Dates

• Publication in this collection
  16 Dec 2022
• Date of issue
  2022

History

• Received
  11 Sept 2021
• Reviewed
  21 Sept 2022
• Accepted
  24 Oct 2022