Lessons are drawn from an incident in the early history of the North Sea offshore industry, regarding how a “culture of production” affects companies’ ability to respond appropriately to dangerous situations.
Ger Wackers, Narvik University College, Norway
The 1977 Bravo blowout at Ekofisk Field was the first major oil blowout in the North Sea. The operator, Phillips, lost control during an open well procedure that was required to replace production tubing in Well B-14. The blowout lasted 7 days, spilling about 3,000 tons of oil per day. The well was killed, in the fifth attempt, by Red Adair on April 30, 1977. Fortunately, the oil that flowed freely was not ignited and reached no shores. No human lives were lost.
This article examines the Bravo blowout in terms of how entrainment in a culture of production hampered the proper exploration of the “solution spaces” that emerged as a result of shifts in task structure, as well as the system’s ability to execute the solution selected.
SHIFT IN TASK AND SOLUTION SPACE
Having started production a few years earlier, the Bravo platform had entered into a routine mode of production by 1977, gathering 15 wellheads on its production deck, Fig. 1. Norwegian regulations required Phillips to provide, on a regular basis, data such as composition of the oil-gas-water mixture produced and reservoir temperature and pressure to the Petroleum Directorate in Stavanger. This data was acquired by wireline through the production tubing. Previous measurements had demonstrated an increase in the amount of gas produced from Well B-14. Consequently, the well had been choked, decreasing the oil production to one-fifteenth of the well’s capacity. During the last series of measurements, the instruments stuck in the tubing, and the wireline snapped.
 |
|
Fig. 1. In 1977 Ekofisk Field, in the Norwegian sector of the North Sea, comprised three platforms: Alpha, Bravo and Charlie.
|
|
The snapping of the wire produced a shift in task structure. Previously a routine wire operation, the work on B-14 now required a major overhaul of the well’s tubing. The structure of the task at hand shifted, and a new solution space, or set of possible solutions, emerged. This new solution space was subject to production targets and requirements concerning regularity of production and delivery (i.e., a “regularity gradient”), which originated in (other) parts of the company dealing with business performance and fulfillment of contractual obligations. In this perspective, reduction of production capacity was calculated as costs and losses. To minimize the regularity losses resulting from the problem in B-14, the well’s production capacity had to be restored as soon as possible. Hence, the solution space for the B-14 problem was structured such that the faster solution would be favored.
The solution space for this task consisted roughly of (at least) three possible solutions. First (and fastest) was to try to fish the stuck instruments out. Second was to use the production crew to replace the production tubing with the stuck instruments. Third and most time consuming would be to bring in an exploration crew to replace the production tubing, an operation requiring an open well procedure.
Fishing was tried first, but attempts to connect to the stuck instrument package failed. So it was decided to pull out and replace the tubing with the instruments stuck in its lower portion. Phillips prepared an overhaul plan for Well B-14 and submitted it to the Petroleum Directorate.
In order to pull out the production tubing, the tree had to be replaced by a BOP. During this replacement, the well would be open. Safety regulations required that there be two barriers between the high-pressure reservoir in the seafloor and the environment, so these two barriers had to be in place before the tree could be dismantled. First, the well was killed with drilling mud pumped into the production tubing. Because no recent data were available on reservoir pressure in Well B-14, the production crew had to use a trial-and-error procedure - in a closed well - to find the optimal mud weight.
The barrier provided by the drilling mud depended on a dynamic equilibrium. It was decided that a downhole safety valve, serving in closed position as a mechanical plug, would provide the second barrier. The production tubing had seats at various levels where plugs and other devices could be installed.
Problems were encountered by the wireline operator, who was employed by a subcontractor and flown to the platform to install the plug. He tried different approaches using different types of valves and plugs, some of which had to be flown in from the mainland. He made two attempts to set a downhole safety valve in a closed position. After the accident it was established by the manufacturer that this type of valve could not be set in drilling mud, but this fact was not included in the instructions accompanying the valve.
The wireline operator also tried to set a plug that consisted of two parts, but the plug leaked. After the accident, it was established that the two parts used belonged to plugs of slightly different dimensions. However, due to insufficient marking of the parts, the wireline operator had no possibility of discovering this difference.
In the offshore work culture, improvisation, stamina, job completion and meeting production targets were highly valued. Hence, the problems encountered did not lead to a decision to abort the operation, suspend the well and prepare for the open well overhaul with a new and specialized crew. The “culture of production” and the crew’s work ethic pulled in the same direction, favoring one solution over another.
The wireline operator worked for more than 30 hours without sleep. Finally, in a seventh attempt, he succeeded in installing a downhole safety valve. However, before being able to test whether it was seated properly, he had to interrupt his work for a few hours due to some small accident. He left the valve in place but unlocked. When he returned, he locked the valve and tested its position by exerting an upward pull on the wire. He evaluated the test as satisfactory and reported the mechanical plug installed. The tree could now be dismantled.
EXPLORING A COGNITIVE SOLUTION SPACE
During the dismantling of the tree, mud was observed to flow from the hydraulic control line for the newly installed downhole safety valve. The mud flowing from the control line constituted a cognitive task for the crew. They had to consider possible causes for the mud flow and ascertain its meaning for the status of the mechanical plug, and whether it was a problem serious enough to stop the work.
This cognitive task also had a solution space, consisting of at least two possible solutions. One solution was that the downhole valve was not properly seated, as a result of which the gaskets were not in their proper place and allowed passage of drilling mud. The other solution was that the valve was properly seated, but that there was a leak in one of the gaskets, causing mud to flow into the control fluid, Fig. 2.
 |
|
Fig. 2. In the downhole safety valve, hydraulic fluid from the control line communicated with the valve through a circular space that was isolated from the wellstream by gaskets above and below. The drilling engineer thought that a leak in one of these gaskets was responsible for drilling mud observed flowing from the control line.
|
|
The solution space for the mud flowing from the control line was subject to the same pressure to restore production as was the overall task of fixing the problem in Well B-14. This pressure, favoring the solution that would bring B-14 back online most quickly, also favored the cognitive solution that had the least severe consequences for completion of the procedure. The explanation offered by the drilling engineer was that there must be a leak in the lower gasket of the valve, and that the oozing mud was caused by its thermal expansion due to the heat of the reservoir. This was of minor consequence, however, because the second gasket was still in place and tight.
The drilling engineer was, like the wireline operator, employed by a subcontractor, a specialized drilling company. Contracts between the operating company and subcontractors had a duration of only a few years. Performance statistics gathered during the past contract period come up during negotiations for contract renewal. Depending on the terms of the contract, interruption of work at the instigation of a contractor’s employee can have direct economic consequences for the contracting company, from interruption of payments to risk of liability for incurred damage. This makes contractors’ employees reluctant to voice any concerns.
The common offshore practice of dividing a work sequence and contracting specialized parts of it out to specialized companies also brought with it a division and distribution of responsibility. Whereas, under Norwegian law, the operating company was ultimately responsible for all the work conducted on its behalf, the subcontractors’ responsibility was limited to the part of the work that was covered by the contract. This responsibility did not extend into the areas of expertise of other subcontractors. The work ethic that favored improvisation, stamina and meeting production targets was accompanied by a culture of respecting the division of labor and expertise, produced by the practice of subcontracting.
The wireline operator’s report that the downhole safety valve had been installed and tested biased the drilling engineer toward explaining the mud flowing from the control line as a result of a leak and thermal expansion. This conclusion was available as a ready-made cognitive pattern in the drilling engineer’s solution space on the basis of his training and professional experience. His most recent experience was from a platform (Bravo) that was in a routine production mode of operation, in which open well procedures were rare.
The alternative - reaching a conclusion that the oozing mud from the control line could imply that the mechanical plug was not properly seated - would have required a greater cognitive effort. It would also have required a questioning of the wireline operator and the drilling engineer’s expertise, and it would have delayed the project even further.
The drilling supervisor accepted the engineer’s explanation and ordered the tree dismantled. Then he went to bed while the well was open and the BOP not yet assembled.
EXECUTING THE CHOSEN SOLUTION
Dismantling the tree exposed the top of the production tubing at the wellhead on the production deck, filled to the rim with drilling mud. The BOP would be installed one floor up, at the drilling unit deck. A stand of riser was to be installed between the wellhead and the BOP. Drilling mud began to ooze slowly over the rim of the production tubing.
The drilling engineer and the drilling supervisor had just reached the conclusion that the flow of mud from the control line was due to thermal expansion, that one of the gaskets might have a leak, but that the safety valve was properly seated, in accordance with the wireline operator’s report. Thus, interpretation of the mud slowly oozing over the rim of the production tubing “required” no new exploration of a solution space to find a conclusion; the conclusion had already been reached. This mud oozing over the rim, it was concluded, was also due to thermal expansion and therefore of no consequence. They could therefore proceed as planned with installation of the stand of riser between the production deck and the drilling unit deck and with assembly of the BOP. After the riser was installed, it slowly filled with mud.
Assembly of a BOP was a job that occurred only rarely, and the toolpusher supervising the BOP assembly on Bravo had never done one before. In his experience on other occasions, the BOP had always been pre-assembled onshore. Now it was in two heavy pieces, lying on deck, which had to be transported to the BOP room for assembly and subsequent installation. This was a job that would take several hours.
The well was open, but the BOP not yet assembled, when the speed of the mud flow over the tubing rim started to increase. Now the “thermal expansion” explanation could no longer be maintained. The task structure shifted once again. From a well situation that was assumed to be under control, the task shifted into one of recovery from a potentially disastrous trajectory as it was recognized that the well was going out of control. Simultaneously, the timeframe collapsed. Under the assumption that the mechanical plug was properly seated, there had been sufficient time to assemble the BOP. With the mud flow speeding up, no time was left to properly explore the solution space for this new task. The one solution that seemed to be within reach was to use the equipment that should have prevented the blowout in a desperate attempt to contain it.
The crew rushed to assemble the BOP so it could mechanically plug or cap the open end of the riser. They managed to put the BOP together and attempted to put it on top of the riser. They failed, however, to contain the speeding flow of mud, which was now being replaced by oil. The blowout was upon them. There was no choice but to evacuate the platform.
Seven days later, the downhole safety valve was found on deck, unscathed. It was probably never properly seated, but only jammed in the tube. The pull exerted by the wireline operator on the valve to test it was insufficient to dislodge it. The BOP was found to be installed upside down.
CONCLUSION
The failure to maintain containment and subsequently to regain control was the result of an emergent system vulnerability that touched multiple levels of the organization. The causal analysis of this blowout cannot be reduced to human errors of the offshore workers, the wireline operator, the drilling engineer or the toolpusher. Onshore management is responsible for the quality of record keeping and maintenance administration. They are also responsible for maintaining among their offshore crews the responsive repertoire that is required to prevent or properly handle emergencies.
Settling into a routine mode of production on Ekofisk Field, the operator failed to keep good records of the type and dimensions of the equipment installed on the platform. The wireline operator had to try different types of plugs and valves to find one that would fit. After the tree had been dismantled, an engineer had to put his arm in the open well to check on the inside of the upper portion whether the tubing had nipples for the installation of a safety valve. However, it is not only a matter of better record keeping and on-the-job training.
It is equally important to recognize that tasks associated with optimizing business performance and safety-critical tasks associated with major maintenance or modification work are characterized by different logics. The company as a business unit tries to optimize shareholder value and profitability as costs rise and sentiments on stock markets change the value of the company. The company’s ability to deliver the oil and gas covered by already concluded contracts, and in accordance with the terms of the contracts, is crucial.
The solution found by the company as a business unit interferes with the proper exploration of solution spaces in safety critical work at the level of technical systems engineering. The pressure for regular production that originates in the contracts is translated to the operation of offshore production installations as production and productivity targets. Contracts with subcontractors are part of the same optimizing business solution. Contract terms reward uptime and operational effectiveness and discourage downtime. It is in these contracts that time is priced.
The lessons that can be learned from the 1977 Bravo blowout, and from other large-scale accidents, pertain to people working at various levels in the organization. One lesson has to do with the recognition that the logic of business performance and optimization interferes with the search process required for safe and reliable operation of safety-critical technical systems. It may reduce the accessibility of solutions in a space of possible solutions. The solution that is easiest to access cognitively, because it follows the pressure for regular production, is not always the best one in terms of technical integrity and containment. Granted that several of the events that led to the blowout at Bravo were beyond the company’s control; nonetheless, the incident illustrates how, when entrainment in a culture of production is allowed to degrade record-keeping systems, technical integrity of equipment and worker skills, then the organization’s ability to respond appropriately in emergency situations will also be degraded.
The solution to this problem must be found in the development of mechanisms that allow for the suspension of the pressure for regular production. Whenever there is a substantial shift in task structure, it should be possible to pause and use time to find the safest and most reliable solution and assemble the resources required for executing it. It should be possible to suspend the pricing of time in the design, planning and execution of safety-critical work, so that time can become available as a resource for safety. This will require changes in accepted accountancy practices and in the terms of contracts. In improving safety, creative innovations by business economists, accountants and lawyers negotiating contracts may turn out to be more important than the work of engineers. 
|
THE AUTHOR
|
|
|
Ger Wackers is an associate professor at the engineering school of Narvik University College in Norway. His principal research concerns the vulnerability of complex technological systems in the North Sea offshore industry. In addition to his work on the 1977 Bravo blowout, he has conducted case studies on the 1991 Sleipner-A GBS loss, the 1997 Norne helicopter accident and the 2004 Snorre A subsea gas blowout. Dr. Wackers holds a PhD degree in science and technology studies from the University of Maastricht in the Netherlands.
|
|
|
