1 Introduction

1Drilling wells in the offshore oil and gas industry is by some denoted a “continuous problem-solving process”. You can plan drilling operations, but changes in plans will occur, e.g. due to the geological conditions not being as predicted. One has to adapt as the drilling proceeds. Risk assessment is an important mean to cope with these changes. During drilling operations, monitoring of pressure, mud and other data is an important input to maintain control and progress. Resilient abilities (RAB) among actors from many different organizations in the drilling crew and onshore support centers it possible to succeed drilling wells in complicated reservoirs. However, the last decade has shown that drilling operations can lead to disastrous outcomes. In this paper we look into the role of RAB in the Deepwater Horizon (DWH) accident (2010) and Snorre A (SNA) near-accident (2004). Four abilities in particular have been denoted to constitute resilience: the abilities to respond, monitor, anticipate and learn (Hollnagel, 2010). The purpose of the study is to investigate whether RAB characteristics contributed to the incidents and/or supported handling the incidents. The latter is paid particular attention to for SNA, as this was a successful recovery from a gas blowout. To answer these questions investigation reports are reviewed and a comparison table is developed to collect and sort information about RAB in the incidents. The table is used as a basis in this paper to develop descriptions about resilience in the two incidents and to compare them (section 3-5). The reports used in the table are Brattbak et al. (2005), Schiefloe et al. (2005), DHSG (2010) and National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling (2011), hereafter called NCDH (2011). The background material give much more detailed descriptions of circumstances and facts than what can be captured in this paper. As a result the table is not presented here, in stead only examples highlighting important RAB are given. For more detailed information the investigation reports should be consulted.

2 The Incidents

2The well drilled at DWH was first planned as an exploration well but during drilling it was decided to complete it as a production well (DHSG, 2010). While performing the temporary abandonment procedure, i.e. securing the well and leaving the well site so that other rigs can complete the well construction process, a well control event allowed hydrocarbons to escape the well and follow the riser up to the drill floor, causing fire and explosion on the rig. 11 workers were killed and oil leakage went on for about 3 months. For the original well design a hazard assessment and a design peer review was performed, and the plan encompassed all elements of well design and testing (BP, 2010). Also the job was performed in an environment where the natural hazards were profound: deep waters, open ocean, low strength and high pressure – high temperature reservoirs, toxic and explosive fluids and gases. Due to the challenge of making predictions in such environments the original well design was repeatedly changed (NCDH, 2010).

3SNA was in the process of pulling pipes out of an existing well in preparation for drilling a subsequent sidetrack when well control was lost and a gas blowout occurred (PSA, 2004). Gas escaped through the tubing below seafloor and entered the sea bed around the well, and also forced its way through the piping and past the blow out preventer (BOP) to the drilling deck (Wackers, 2006). No one was injured or killed and the crew managed to kill the blowout (the successful response is further described in section 3.2) .The well was known as problematic (corrosion and leaks, unconventional well completion with many small completion elements, and downhole well control valves), and it was in 2003 closed due to leakages. When closed the well was tested to only hold 94 bar. The original slot recovery plan took into account the known deficiencies in well integrity. The plan was however changed several times during the well operation (PSA, 2004).

3 Resilience In The Incidents

4The four resilient abilities were in the incident review observed to be closely connected, especially between the ability to anticipate what can go wrong and ability to monitor what is going on in present time. Due to this observation the four abilities are in the summaries below described jointly for each incident.

3.1 The Deepwater Horizon Accident

5Throughout the drilling project, efforts to anticipate were neglected which is especially evident by the poor risk assessments and management of change (MOC) processes, especially for the many changes made to the temporary abandonment procedure. Critical elements like the quality of cement at the bottom of the well, mud weight in the well and riser, and status of BOP were not thoroughly assessed resulting in loss of important barriers.

6The relationship between poor anticipation, monitoring and response became especially evident during drilling and completing. Lost circulation problems were observed in the rock formation indicating the importance of achieving a correct cement job at the bottom of the well. Still, ambiguous signals on the quality of the cement job were poorly investigated and cement evaluation logging was cancelled prohibiting additional information about location and quality of the cement. Due to the cancelled cement tests, negative pressure testing became the only possibility to evaluate the integrity of the cement job. Vigilant assessment of test results was therefore critical, but instead results were poorly interpreted and no critical questions were asked to the assessment, thus avoiding anticipation and preparations of the adverse outcomes present in the data; that a kick and blowout was possible. The test was incorrectly declared successful, leading to a particular failure of response when the crew continued the completion procedure (open the BOP and displacing mud from the riser). The previous superficial approach to evaluate the cement job should have places extra precaution on monitoring and anticipation. Instead poor efforts in these abilities became even more evident: data about mud volume and flow rate was disturbed by allowing mud from other locations to mix with mud from the well; and unclear who, if any, monitored real time data due to high activity on the rig. In the 50 minutes before the explosion, there were several anomaly well monitoring data, e.g. drill pipe pressure which should have initiated efforts to respond. But despite the critical signals from the well, no one on board recognized the signs. Chief Council’s report (2011) points at lack of vigilance during the final displacement; lack of sufficient training; simultaneous operations and poor communication between operator and contractor personnel as important contributors to the lack of kick detection.

7In the end an odd pressure difference between drill pipe and kill line was discovered and pumps were shut off for investigation. In this period drill pipe pressure increased but suddenly started decreasing, all of which was strong indications of a kick. Nevertheless, operators first realised that a kick occurred when drill mud began spewing out on the rig which finally initiated actions to shut in the well. When the kick occurred the crew failed to anticipate the potential severity and responded by sending the incoming flow to the mud-gas separator instead of overboard. Stronger monitoring and interpreting efforts would probably have given a more correct response to blowout. The flow from the well quickly overwhelmed the system and the first explosion occurred. When the crew finally activated the BOP and emergency shut down (ESD) neither worked, possibly because the response was too late. In the phase after the blowout, the attempts to kill the well were characterized by improvisation, adaptation and trial and errors before finally succeeding to kill the well about three months after the explosion.

8Several problems with learning and sharing of information within and between companies and actors impacted RAB, e.g.: failure to use Best Available and safest technology; difficulties with primary cement job known by BP and Halliburton but not communicated to the rig crew conducting the negative pressure test and monitoring the well; tests showing that the cement to be used were unstable were poorly or not communicated at all by Halliburton to BP; Transocean failed to communicate and use lessons from a similar near-miss.

3.2 The Snorre A Near Accident

9Efforts to anticipate were well taken care of in early planning. Historical data was collected and shared and several experts and disciplines participated in planning meetings. Well integrity was taken into account by ensuring sufficient barriers. The original plan was however changed several times, e.g.: the reservoir section was decided to be opened and cemented and tail pipe perforated (allowing contact with reservoir pressure). During these changes poor risk assessments and evaluation of barriers were performed, e.g.: risk review for the entire program was postponed and later cancelled. Risk assessments were also done without SNA people participating and without results being communicated to them, and required meetings ensuring participation from executing people at the platform were not held. This probably prevented SNA people from having sufficient information about the job and be able to anticipate and respond sufficiently during the job. Failure to learn from earlier incidents at the platform and to use knowledge and experience outside the SNA organisation also prevented valuable lessons from being used.

10Monitoring was performed during the whole operation. Although there were problems interpreting several signals the job was continued. However, after continued swabbing and mud loss monitoring and responding vigilance increased. Attempts to test what was wrong started and the crew observed that mud was still lost, that mud did not return when circulating, and backflow of well liquids occurred when reverse-circulating the well. Due to the strange signals the process was stopped and the BOP closed several times. At one point a strong pressure increase was observed (increasing well instability). Then gas was detected in several modules and production was stopped. The crew took remedial action to kill the well and additional mud was mixed to be better prepared for well control. The crew however first realised that they were dealing with a blow out on sea bed when they discovered that the sea was “boiling” with gas. Only then was ESD activated (two hours after the first gas detection). This late detection could have been critical: less favourable weather conditions and small changes well development could have given ignition, fire and explosion.

11The ability among the crew to monitor and assess the situation and improvise in their response became evident especially after ESD: rerouting air intake from external to internal in cement rooms to ensure that they could be used if necessary (air intake located under the platform meaning that gas could be sucked in if used); inspection rounds to monitor critical room that had lost ventilation and overpressure and doors kept open to prevent temperature from getting too high; main power switched on after no observation of gas for one hour. The decision to switch on main power was critical (risk of ignition) but necessary to get enough power kill the well. During the kill operation the crew run out of mud two times and more mud had to be mixed. However when they finally killed the well mud stores were empty. Emergency management was carried out as planned: emergency management team was mustered and evacuation started.

4 Comparison Of The Incidents

12In both incidents the operations were performed under complex/unfamiliar conditions. In SNA the well was denoted complex and in DWH the operation was performed with profound natural hazards. The organisations however did not acknowledge the fact that the upcoming operations were not standard and therefore required heightened vigilance during planning and execution. E.g. by learning from previous incidents and existing knowledge; to dedicate resources to anticipate possible adverse outcomes; to dedicate attention to closely monitor the operation; to prepare response to adverse outcomes. Further weak anticipation efforts were evident by the many uninvestigated changes in plans. In both incidents changes were made without proper risk assessment and evaluation of barriers, neither single nor total impact of changes. The organisations lost oversight and knowledge about the operation when subsequent changes in plans were made without proper investigation and communication, which further lead to problems monitoring and interpreting signals during execution.

13In addition, received signals were not interpreted sufficiently during the operations. In DWH odd signals in quality of cement and pressure test were received and in SNA signals of continued swabbing. None of these were investigated properly which prevented anticipation of what was going and the ability to respond and take proper action. People seem to have had a mindset that the well was fine and that adverse outcomes were unlikely. Especially for DWH, the kick came as a total surprise when mud started spewing out, although there were several undetected signs of anomalies in the well. In both incidents poor anticipation and learning during the planning process resulted in a situation where people at the sharp end carried the responsibility for spotting anomalies and react on those. A situation which is not robust, especially considering the difficulty and unfamiliar operations they had to perform. Proper planning processes, MOC and involvement should have prevented front end operators from finding them selves in the middle of the complex situations in the two incidents.

14In both incidents poor sharing of information hindered effective RAB. E.g. in DWH problems with primary cement job and test data on cement was poorly communicated. In SNA meetings and risk assessments were performed without SNA people participating and valuable knowledge and experience outside the SNA organisation was not used. In both incidents the many changes to plan were not properly communicated to executing personnel and lessons from earlier incidents not used. If people (cross companies and actors) had been aware of changes made to plan and problems identified in simulations and meetings they would have been better prepared for what to look for and expect during the operations.

15In the end SNA succeeded in preventing an accident while DWH did not. An important difference is that SNA was able to establish increased vigilance and attention towards what was going on at an earlier stage in the course of events. Even though SNA was not able to completely understand what happened they took action to close the BOP, shut down systems, increase efforts to investigate and prepare the organisation to respond to adverse outcomes. Vigilant monitoring and ability to respond prevented the blow out from developing into a more severe accident.

16The success in avoiding an accident at SNA has been explained by good relationships and informal structures among actors and companies at the platform. People trusted each other and communicated effectively during the incident. They had extended and detailed local plant/equipment knowledge, all-round competence and the ability to improvise in problem solving. They were able to fast and effectively coordinate capacity and competence at the platform to handle unforeseen incidents.

5 How Can Resilience Be Engineered To Prevent Future Blowouts?

17The incidents studied show that poor abilities in anticipation, learning, monitoring, and responding are closely connected and influence each other. Both the DWH and the SNA incident show that the organizations in the end had an adequate ability to respond, SNA in avoiding explosion and DWH in stopping the blowout (although it took about 3 months to kill the well, the process in this period is characterised by adaptation). However, to be a resilient organisation one has to have a balance of adequacy among the four RAB (Hollnagel, 2010). For DWH and SNA, there have clearly been poor abilities to anticipate, monitor and learn. These are all abilities that would likely have initiated earlier response, thus avoiding the incidents. Important premises for the abilities are underlying qualities such as knowledge, competence, resources and time (Hollnagel and Woods, 2006). In light of the mentioned incidents, how can resilience abilities and underlying qualities for these be improved for drilling operations?

18Recently, concepts of integrated operations (IO) has been adopted in the oil and gas industry, i.e. extended use of ICT, real time data and automation, close collaboration offshore-onshore and cooperation cross organizational and geographical borders. If implemented properly, IO concepts could provide resources able to strengthen RAB:

19Improve resources for monitoring what is going on. The industry already collect real-time data that provide signals for kicks in the well, nevertheless the incidents described in this paper show that the involved organizations was not able to monitor and react to these signals. It is possible to improve resources that influence the ability to monitor by improving HMI, automated alarms and facilitation of organisational redundancy.

20Involve the onshore organisation during high activity level and difficult operations. The investigation reports indicate that high activity level and complexity of the operations contributed to the failure of monitoring. Improved involvement of the land organization to monitor and interpret signals during such situations is possible. A presumption for such collaboration is to tear down barriers between offshore and onshore related to local knowledge, expert knowledge and decision-making authority.

21Better systems for information sharing between actors. Poor information flow among distributed actors contributed to the problems in RAB. IO could help sharing important information more easily. It must however be decided which information is required by who and channels and practice for sharing, also when unforeseen problems occur. Improved information flow will improve abilities to anticipate future developments.

22Improve methods of operational risk assessments. Both incidents showed problems identifying, assessing and communicating changes in plans. Keeping en overview and knowledge about the course of events and threats involved cross involved parties in drilling operations are becoming even more critical with IO. Approaches for operational risk assessment involving companies and actors onshore and offshore must therefore be further developed.

23Improve skills related to responding to unexpected events. While there were plans and procedures available to handle expected events, approaches to handle the unforeseen were lacking, especially at DWH. The incidents show that skills to suddenly cope with unanticipated events are needed. At SNA critical success factors for adaption to the situation was high degree of local knowledge, a united crew, and ability to microcoordinate at the rig. Learning by doing is likely to be effective, e.g. by exercises involving unanticipated events should be emphasised.