Abstract

Introduction - an accident of great proportions and obscure areas

The accident with the Deepwater Horizon oil rig occurred on April 20, 2010, in the Macondo well, under the responsibility of the multinational company BP. So far, it can be considered the most significant disaster of the 21st century in the oil and gas sector. Its human, material, and environmental effects were catastrophic: 11 dead workers, 17 injured, total loss of the unit, and the largest environmental disaster in the Gulf of Mexico (United States) ¹1. Barron MG, Vivian DN, Heintz RA, Yim UH. Long-term ecological impacts from oil spills: comparison of Exxon Valdez, Hebei Spirit, and Deepwater Horizon. Environ Sci Technol 2020; 54:6456-67.. About 5 million barrels were dumped into gulf waters over almost three months (87 days), causing a real “black tide”. The indirect effects of the accident were broad, affecting even the fish and seafood consumption in the affected region ²2. Simon-Friedt BR, Howard JL, Wilson MJ, Gauthe D, Bogen D, Nguyen D, et al. Louisiana residents’ self-reported lack of information following the Deepwater Horizon oil spill: effects on seafood consumption and risk perception. J Environ Manag 2016; 180:526-37. and the increase in the suicide tendency in a portion of the citizens living in this area ³3. Bell TR, Langhinrichsen-Rohling J, Selwyn CN. Conservation of resources and suicide proneness after oilrig disaster. Death Stud 2020; 44:48-57..

The rich scientific literature on the accident mostly deals with its environmental, chemical, biological, and economic effects, as indicated by the Scopus database, considering the descriptors “deepwater horizon” and “ergonomics”, or “ergonomic”, or “collective”, or “organizational”, or “organizational”, or “organization”, or “work”, or “labor”, in the areas of social sciences, engineering, energy, arts and humanities, multidisciplinary, psychology, nursing, and neurosciences. The SciELO database shows no articles with the respective descriptors in Portuguese or Spanish. Regarding the causes of the accident, the literature focuses on the immediate causes of the accident, that is, situations close to the time and space of the final event, especially human errors and technical failures, to the detriment of the underlying causes, which refer to factors of managerial and organizational nature.

This analysis aims to, 12 years after the disaster, carry out a reflection that, starting from the immediate causes, can raise the visibility of the underlying causes, highlighting the collective dimension of work - especially communication - and the organizational factors involved, sometimes immersed in “obscure areas” ⁴4. Llory M, Montmayeul R. O acidente e a organização. Belo Horizonte: Fabrefactum Editora; 2014.. The preparation of this essay assumes that the analysis of accidents with complex systems, such as the Deepwater Horizon oil rig, demands the contribution of references such as the activity ergonomics and the work psychodynamics, whose power helps us to reveal elements that integrate the broader context (in time and space) to the event itself ⁵5. Figueiredo MG, Alvarez D, Adams RN. O acidente da plataforma de petróleo P-36 revisitado 15 anos depois: da gestão de situações incidentais e acidentais aos fatores organizacionais. Cad Saúde Pública 2018; 34:e00034617.. Analyzing the accident from this perspective can evidence aspects of managerial and organizational nature, with greater nuance for issues related to communication between workers, thus bringing original contributions that provide a better understanding of possible factors underlying the disaster.

In this sense, in line with what Magne & Vasseur ⁶6. Magne L, Vasseur D. Risques industriels - complexité, incertitude et décision: une approche interdisciplinaire. Cachan: Lavoisier; 2006. emphasize - that accidents with complex systems are triggered by direct, immediate, technical, and/or human causes (“failures/errors”), but their manifestation and/or their unwinding are driven, favored, precipitated by underlying causes and conditions, with a focus on organizational (complex) factors -, the essay seeks to answer the following question: in the case of the Deepwater Horizon oil rig, which of the main factors would have contributed, as underlying causes, to the disaster that occurred with it, considering the relevance (centrality) of the collective dimension of work in the course of the process?

Theoretical-methodological framework that guides the reflections

This essay is associated with a research project on the triad of work, health, and safety in the oil industry with emphasis on the offshore sector, initiated in 2002 and coordinated by two of its authors. In its development, the theoretical-methodological framework guide has privileged the materials of activity ergonomics ⁷7. Daniellou F, organizador. L’ergonomie en quête de ses principes. Toulouse: Octarès; 2015.^,88. Falzon P, organizador. Ergonomia construtiva. São Paulo: Blucher; 2016.^,99. Teiger C, Lacomblez M. (Se) Former pour transformer le travail: dynamiques de constructions d’une analyse critique du travail. Québec: PUL/Bruxelles: ETUI; 2013. (Santé et Sécurité du Travail). and of work psychodynamics ¹⁰10. Dejours C. Trabalho vivo. Brasília: Paralelo 15; 2012.^,1111. Dejours C. Le choix: souffrir au travail n’est pas une fatalité. Paris: Bayard; 2015.. It is also noteworthy our search for a synergistic conduction dynamics of the relationship between the knowledge of the sciences (with scientific status) and those related to the experience of workers (of a practical nature), pertinent to the analysis of work situations, in convergence with the ergological perspective propositions ¹²12. Schwartz Y, Durrive L, organizadores. Trabalho e ergologia II: diálogos sobre a atividade humana. Belo Horizonte: Fabrefactum Editora; 2015.^,1313. Schwartz Y, Durrive L, organizadores. Trabalho e ergologia: conversas sobre a atividade humana. 3ª Ed. Niterói: EdUFF; 2021.. This essay emphasizes the activity ergonomics and some of its main concepts, presented below, among which the representation stands out, which proved fruitful for the analysis undertaken. Considering the specificities and characteristics of the context studied, contributions originating from other references can be used.

The following methods and techniques of investigation were used: (i) the content produced about the disaster and available in scientific articles and books ¹⁴14. Hopkins A. Decisões desastrosas: as causas humanas e organizacionais do desastre do Golfo do México. São Paulo: Blucher; 2022.^,1515. Le Coze JC. Trente ans d’accidents: le nouveau visage des risques sociotechnologiques. Toulouse: Octarès; 2016.^,1616. Le Coze JC. Globalization and high-risk systems. Policy and Practice in Health and Safety 2017; 15:57-81.^,1717. Perrow C. The next catastrophe: reducing our vulnerabilities to natural, industrial, and terrorist disasters. Princeton: Princeton University Press; 2011.^,1818. Skogdalen JE, Vinnem JE. Quantitative risk analysis of oil and gas drilling, using Deepwater Horizon as case study. Reliab Eng Syst Saf 2012; 100:58-66.^,1919. Vinnem JE. FPSO Cidade de São Mateus gas explosion: lessons learned. Saf Sci 2018; 101:295-304.^,2020. Woolfson C. Preventable disasters in the offshore oil industry: from Piper Alpha to Deepwater Horizon. New Solut 2012; 22:497-524.; (ii) documentary research, with emphasis on two reports, that of the National Commission instituted by the U.S. Government ²¹21. Graham B, Reilly WK, Beinecke F, Boesch DF, Garcia TD, Murray CA, et al. Deep water: the gulf oil disaster and the future of offshore drilling. Washington DC: US Independent Agencies and Commissions; 2011. and, to a lesser extent, the one prepared by the BP internal incident investigation team ²²22. BP. Deepwater Horizon accident investigation report. Londres: BP; 2010.; (iii) articles published in the mainstream media (obtained on the Internet) and gathered in dossier format, organized over the last few years; (iv) interlocution, on different occasions, in 2020, with two experienced workers who worked in the drilling industry (one at Petrobras and, the other, a former Halliburton employee), including abroad; and (v) interactions established with other workers throughout the project, including five who worked at Schlumberger, two at Baker Hughes, and one at Halliburton, companies among the largest multinationals linked to the drilling industry.

The empirical material from contact with experienced workers in the drilling industry was produced based on formal and semi-structured interviews, mobilized by using the network of contacts of one of the researchers, throughout the aforementioned project. Such interlocutions contribute to overcome the difficulties in understanding the functioning of a complex system such as Deepwater Horizon and the organizational logic that governs it, from the view of those who deal directly with the variability in the drilling industry.

Complex sociotechnical systems - the role of the collective dimension of work and organizational factors

Complex high-risk systems involve the relationship between a set of individuals with technical tools to achieve the expected operational objectives. Among the complexity sources are the risk associated with instability and/or unpredictability of interactions (including non-linear) of their subsystems, and the need for cooperation between agents. Thus, the reliability of these systems depends on the technical and human domains. The greater the number of connections, components, and activities at stake, the higher the association and risk potentialization probabilities ¹⁵15. Le Coze JC. Trente ans d’accidents: le nouveau visage des risques sociotechnologiques. Toulouse: Octarès; 2016.^,1717. Perrow C. The next catastrophe: reducing our vulnerabilities to natural, industrial, and terrorist disasters. Princeton: Princeton University Press; 2011.^,2323. Perrow C. Normal accidents: living with highrisk technologies. New Jersey: Princeton University Press; 1999..

The characteristics of the installations, the technical device, and the operation of certain plants and units of the continuous process industries, associated to the nuclear, chemical/petrochemical, petroleum, etc., sectors, then allow us to view them as classic examples of so-called high-risk “complex systems” or “complex socio-technical systems” ²⁴24. Leplat J, Terssac G, diretores. Les facteurs humains de la fiabilité dans le systèmes complexes. Toulouse: Octarès; 1990., capable of triggering the so-called expanded or large-magnitude accidents ⁴4. Llory M, Montmayeul R. O acidente e a organização. Belo Horizonte: Fabrefactum Editora; 2014.^,1515. Le Coze JC. Trente ans d’accidents: le nouveau visage des risques sociotechnologiques. Toulouse: Octarès; 2016.^,2525. Freitas CM, Souza CAV, Machado JMH, Porto MFS. Acidentes de trabalho em plataformas de petróleo da Bacia de Campos, Rio de Janeiro, Brasil. Cad Saúde Pública 2001; 17:117-30.. These are events with the potential to simultaneously cause multiple damages - material, environmental, and to the physical and mental health of exposed human beings. These damages may even extrapolate their time and spatial landmarks, as in this case under analysis, which denotes the high degree of risk present in well drilling. This is corroborated by the Accident Statistics for Offshore Units on the UKCS 1990-2007²⁶26. UK Offshore Energies. Accident statistics for offshore units on the UKCS 1990-2007. Londres: UK Offshore Energies; 2009. report, published the year before the Deepwater Horizon accident, and which, in addressing the current context in the UK over a period of almost 20 years (1990-2007), indicated that drilling activity had the highest number of accidents for the floating (mobile) rig segment. França et al. ²⁷27. França JEM, Hollnagel E, Santos IJAL, Haddad NA. FRAM AHP approach to analyse offshore oil well drilling and construction focused on human factors. Cognition, Technology & Work 2020; 22:653-65. indicate that, throughout their evolution to the present day, the specific risks of drilling activities have greatly increased their potential to harm people, the environment, and corporate sustainability.

The case of Sidoarjo, in Indonesia, reinforces the scope of the possible large proportion and deleterious consequences from oil drilling activities. This accident occurred in 2006 and generated a mud volcano that has flowed uninterruptedly since then ²⁸28. Amalberti R. Gestão da segurança: teorias e práticas sobre as decisões e soluções de compromisso necessárias. Botucatu: Faculdade de Medicina, Universidade Estadual Paulista Júlio de Mesquita Filho; 2016.^,2929. Suprapto N, Zamroni A, Yudianto EA. One decade of the “lusi” mud volcano: physical, chemical, and geological dimensions. Chemistry: Bulgarian Journal of Science Education 2017; 26:615-29.. And, despite unknown origin, the oil spill off the Brazilian coast in August 2019 was also a recent warning for the severity and extent of the damage that major events related to the oil and gas sector can cause. This is considered the largest environmental disaster (in extension) caused by oil on the coast of Brazil and the largest tropical coastal contamination in the world ³⁰30. Soares MO, Teixeira CEP, Bezerra LEA, Paiva SV, Tavares TCL, Garcia TM, et al. Oil spill in South Atlantic (Brazil): environmental and governmental disaster. Mar Policy 2020; 115:103879..

Perrow ²³23. Perrow C. Normal accidents: living with highrisk technologies. New Jersey: Princeton University Press; 1999. emphasizes that, in such complex systems, so-called nonlinear interactions predominate, whose central characteristic - one of the distinctive features of their complexity - would be the possibility of replicating themselves as other parts or subsystems are reached, unlike linear interactions, which are only adjacent or serial.

Along these lines, oil rigs can be seen as quite illustrative of this type of system, and the Deepwater Horizon accident, an emblematic case of an expanded accident with catastrophic developments. It was not by chance that it received enormous attention from several internationally renowned experts on the subject ¹⁴14. Hopkins A. Decisões desastrosas: as causas humanas e organizacionais do desastre do Golfo do México. São Paulo: Blucher; 2022.^,1515. Le Coze JC. Trente ans d’accidents: le nouveau visage des risques sociotechnologiques. Toulouse: Octarès; 2016.^,1616. Le Coze JC. Globalization and high-risk systems. Policy and Practice in Health and Safety 2017; 15:57-81.^,1717. Perrow C. The next catastrophe: reducing our vulnerabilities to natural, industrial, and terrorist disasters. Princeton: Princeton University Press; 2011.^,1818. Skogdalen JE, Vinnem JE. Quantitative risk analysis of oil and gas drilling, using Deepwater Horizon as case study. Reliab Eng Syst Saf 2012; 100:58-66.^,1919. Vinnem JE. FPSO Cidade de São Mateus gas explosion: lessons learned. Saf Sci 2018; 101:295-304.^,2020. Woolfson C. Preventable disasters in the offshore oil industry: from Piper Alpha to Deepwater Horizon. New Solut 2012; 22:497-524..

Then, note some complexity indicators from the perspective of activity ergonomics, considering the contributions of authors such as Leplat ³¹31. Leplat J. Quelques aspects de la complexité en ergonomie. In: Daniellou F, organizador. L’ergonomie en quête de ses principes. Toulouse: Octarès; 2015. p. 51-68. and Pavard et al. ³²32. Pavard B, Dugdale J, Saoud N, Darcy S, Salembier P. Conception de systèmes socio-techniques robustes. In: Terssac G, Boissières I, Gaillard I, editores. La securité en action. Toulouse: Octarès; 2009. p. 67-81.: (a) the multiplicity of variables at stake; (b) the concurrency of the various events/situations; (c) the unpredictability and uncertainty of information; (d) the sensitivity of the system to operators’ interventions; (e) the opacity of the system, that is, the lag between the system requirements and the action model that can serve as the basis for the activity.

These aspects invoke the debate about operators’ difficulty to build a clearer and more precise representation of the situation during the activity, during the actual (or effectively performed) work, and which is distinguished from its prescriptive dimension (the prescribed work), associated with the task objectives defined a priori. A difficulty also associated with the way this representation is shared among the agents involved in the same situation. Hence, Leplat ³¹31. Leplat J. Quelques aspects de la complexité en ergonomie. In: Daniellou F, organizador. L’ergonomie en quête de ses principes. Toulouse: Octarès; 2015. p. 51-68. underlines the idea of shared complexity and knowledge sharing for the execution of the task. For him, if, in some situations, there is an intelligence (cognitive competence) that can be seen as acting in a distributed way between technical (or technical-organizational) devices and operators - a distributed cognition ³³33. Hutchins E. Cognition in the wild. Cambridge: Bradford Books/MIT Press; 1995.^,3434. Theureau J. Cognição distribuída e curso de ação. Laboreal 2020; 16:1-35. -, then one can speak symmetrically of a distributed complexity. Therefore, he emphasizes the importance of considering this cognitive activity inserted in a context, crossed by different situational variables, mentioning the research identified with the current of situated action ³⁵35. Suchman LA. Plans and situated actions: the problem of human-machine communication. Nova York: Cambridge University Press; 1987..

This line of argument seems fruitful to us if we do not wish to circumscribe our perspective of analysis to the record of “standardized safety” (strongly based on compliance with the rules and norms), but to the Record of “safety in action” (focused on the ability to mobilize competencies in the face of unforeseen events). The first emphasizes acquiring procedures and “safe behaviors”, whereas the second bets on the ability to anticipate, to deal with instability, with malfunctions and variability - variations and deviations in relation to the standard, normative mode of operation - and which, often, are predominant, to the detriment of the process stability. It is not about seeing them as antagonistic, but of apprehending their complementarity ³⁶36. Daniellou F, Simard M, Boissières I. Fatores humanos e organizacionais da segurança industrial: um estado da arte. Toulouse: Fondation pour une Culture de Sécurité Industrielle; 2010. (Cadernos da Segurança Industrial 2013-07).^,3737. Rocha R, Lima F. Erros humanos em situações de urgência: análise cognitiva do comportamento dos pilotos na catástrofe do voo Air France 447. Gestão & Produção 2018; 25:568-82.^,3838. Terssac G, Boissières I, Gaillard I, editores. La securité en action. Toulouse: Octarès; 2009..

On the other hand, considering the means available to the collectives of work to perform the coordination of the tasks in necessary. Here, the concept of “work collective” is employed in a different sense from that of prescribed team. Its performance presupposes sharing rules that transcend the hierarchy, beyond formal instances, as a result of the very dynamics of self-regulation from within ³⁹39. Cru D. Collectif et travail de métier: sur la notion de collectif de travail. Travailler 2016; 35:53-9.. For Dejours ⁴⁰40. Dejours C. O fator humano. 5ª Ed. Rio de Janeiro: Editora FGV; 2005., to a large extent, “human errors” can be minimized thanks to the efficiency of these collectives and, for this, cooperation plays a strategic role. According to this author, the reliability and security of such systems would be based, to some extent, on the cooperation that occurs within these collectives, on the cohesion among its members, on the complementarity of knowledge (formal and informal) present there. Thus, the information support and the technical and organizational factors involved in the coordination of tasks become important. Regarding these collectives, the situations in which workers belonging to different teams/companies enter into contact (in the same place), for executing different tasks ⁴¹41. Leplat J. Mélanges ergonomiques: activité, compétence, erreur. Toulouse: Octarès; 2011., something increasingly frequent with the augmentation in outsourcing, should be highlighted. A new task - the management of interfaces -, which is intertwined with those considered as main tasks and is not, as a rule, considered by the company as such, is necessary and can cause harmful effects for reliability ⁴²42. Figueiredo MG. A face oculta do ouro negro: trabalho, saúde e segurança na indústria petrolífera offshore da Bacia de Campos. 2ª Ed. Niterói: EdUFF; 2016..

Another situation especially critical for collective work, that is, the way operators cooperate in a work situation, involves shift change (intrinsic to offshore work). The time of co-presence between the teams that assume and leave the shift is not always enough to enable the effective information exchange and to provide operators who start their shift favorable conditions to take the job ⁴³43. Le Bris V, Barthe B, Marquié JC, Kerguelen A, Aubert S, Bernadou B. Advantages of shift changeovers with meetings: ergonomic analysis of shift supervisors’ activity in aircraft building. Appl Ergon 2012; 43:447-54..

This scenario gains new contours when we incorporate the psychic dimension into the analysis, since the potentially harmful, irreducible, and inherent risks to the task, in addition to their direct effects produced on the body, also indirectly affect the psychic functioning ¹⁰10. Dejours C. Trabalho vivo. Brasília: Paralelo 15; 2012., such as the shift relay itself. The fear of accident or professional illness - more recently, contamination by coronavirus ⁴⁴44. Larentis AL, Silva ENC, Albuquerque HC, Almeida HP, Pina JA, Carvalho LVB, et al. Parecer sobre contaminações por Covid-19 a bordo de plataformas e contribuições para investigação da caracterização do nexo causal entre a doença e o trabalho no setor de petróleo e gás. Rio de Janeiro: Escola Nacional de Saúde Pública Sergio Arouca, Fundação Oswaldo Cruz; 2020.⁾ - and the fear of not being up to the task or the responsibilities, as well as the difficulties related to certain aspects of work organization require constructing and implementing defense strategies (individual and collective) to contain the suffering of psychic order associated with the activity development. These defenses would fulfill the function of denial/euphemization of the perception of reality ¹⁰10. Dejours C. Trabalho vivo. Brasília: Paralelo 15; 2012., hence, paradoxical conduct and indiscipline regarding prevention and safety measures, demonstration of external signs of courage, resistance to suffering, strength, virility, etc., are verified ¹⁰10. Dejours C. Trabalho vivo. Brasília: Paralelo 15; 2012.^,1111. Dejours C. Le choix: souffrir au travail n’est pas une fatalité. Paris: Bayard; 2015..

As we have previously pointed out, in a situation with the characteristics of the accident involving Deepwater Horizon, every event (incident or accident) is initiated by direct, immediate, technical and/or human causes (“human error”). Its development, however, is driven by underlying causes and conditions (factors) of organizational nature ⁴⁵45. Reader TW, O’Connor P. The Deepwater Horizon explosion: nontechnical skills, safety culture, and system complexity. J Risk Res 2014; 17:405-24. - including the adoption of forms of management that accentuate the tendency to the precariousness and intensification of work. Going back to such a level that the very management logic that guides the performance of a given organization is called into question is possible. According to Le Coze ¹⁶16. Le Coze JC. Globalization and high-risk systems. Policy and Practice in Health and Safety 2017; 15:57-81., the case of BP would be paradigmatic in this sense.

The Deepwater Horizon oil rig and a brief description of the accident

Deepwater Horizon was a drilling unit (probe of the semi-submersible type), owned by Transocean, an American multinational and world leader in the offshore drilling industry. It was a fifth-generation platform, considered the largest and one of the most modern drilling rigs in the world at the time of the accident. It was in the service of BP, the operator of the field in which the Macondo well was located, and leased for USD 560 million.

The Macondo well was located at a 1,500m water depth, and 4,000m inside the seabed had already been drilled. This means that, between the water surface and the lower end of the well, the distance was 5,500m. Deepwater Horizon was about to perform the so-called temporary abandonment, a maneuver in which, after the well is sealed, the drilling rig performs the tripping out, disconnecting from the well (“abandons” its lease). Days, weeks, or even months later, another platform will continue the process, connecting to the well to put it into production, only then extracting oil and gas from the reservoir. Before abandonment, however, sealing the well is necessary, sealing its lower end (via cementation of its base) to prevent hydrocarbons (oil and gas) from migrating to its interior, while it is not at the productive phase (Figure 1).

In the case of Deepwater Horizon, according to the report of the National Commission ²¹21. Graham B, Reilly WK, Beinecke F, Boesch DF, Garcia TD, Murray CA, et al. Deep water: the gulf oil disaster and the future of offshore drilling. Washington DC: US Independent Agencies and Commissions; 2011., this cementation was carried out the day before the accident (April 19th, 2010), with the use of a mixture whose preparation was under the responsibility of Halliburton, another large multinational in the sector. Its biggest competitor, Schlumberger, would assess the quality of the cement used in the well at this final stage of drilling, but was dismissed before performing the work. In the PBS/TVI ²⁴24. Leplat J, Terssac G, diretores. Les facteurs humains de la fiabilité dans le systèmes complexes. Toulouse: Octarès; 1990. documentary ⁴⁶46. PBS/TVI24. BP - o desastre continua no golfo: documentário [YouTube]. 2010. Vídeo: 45 min. https://www.youtube.com/watch?v=uN4z35trr_0.
https://www.youtube.com/watch?v=uN4z35tr... , an oil worker who was on board the unit uses the expression “they were practically sent away”.

Then, carrying out pressure tests is part of the procedure, which aim to evaluate the integrity of the well, verifying that the cement injected into the base of the well will satisfy the function of preventing the entry of hydrocarbons inside. The values obtained in two of these tests were well above the expected ²¹21. Graham B, Reilly WK, Beinecke F, Boesch DF, Garcia TD, Murray CA, et al. Deep water: the gulf oil disaster and the future of offshore drilling. Washington DC: US Independent Agencies and Commissions; 2011.. This indicated that a leak could be ongoing, from a possible anomaly in cementation. Faced with this scenario, however, in which the data signaled the possibility that the well was “leaking”, there was a shift change. And, even with the divergent interpretation of those responsible for the operation in each shift regarding the values obtained ²¹21. Graham B, Reilly WK, Beinecke F, Boesch DF, Garcia TD, Murray CA, et al. Deep water: the gulf oil disaster and the future of offshore drilling. Washington DC: US Independent Agencies and Commissions; 2011., continuing the intervention in Macondo was allowed. The discrepancy related to the representation of what was actually occurring in the well is central to analyzing the accident.

The developments that followed, according to the reports of the National Commission ²¹21. Graham B, Reilly WK, Beinecke F, Boesch DF, Garcia TD, Murray CA, et al. Deep water: the gulf oil disaster and the future of offshore drilling. Washington DC: US Independent Agencies and Commissions; 2011. and of BP ²²22. BP. Deepwater Horizon accident investigation report. Londres: BP; 2010., were catastrophic, since, a few hours later, occurred an uncontrolled flow of fluids contained in the reservoir into the well, in a kind of eruption, which hit the rig abruptly and quite violently, configuring what is technically called blowout ⁴⁷47. Fernández EF, Pedrosa Junior OA, Pinho AC. Dicionário do petróleo em língua portuguesa: exploração e produção de petróleo e gás - uma colaboração Brasil, Portugal e Angola. Rio de Janeiro: Lexikon; 2009., the most serious problem likely to occur during drilling. In such circumstances, it is also said that “the well is exploding”. Unfortunately, when the methane gas that spread throughout the unit came into contact with some ignitor source in the engine room, there was a first and great explosion.

In addition to the fire and gas systems failing to prevent the ignition of hydrocarbons, to make matters worse, attempts to seal (close) the well with a device called BOP (blowout preventer - Figure 2), which is a flow blocker, also failed.

From there, what occurred was the aggravation of the fire with other explosions, culminating in the sinking of the unit on the morning of April 22, 2010. We must emphasize that 11 workers died, 17 were injured, numerous oil works arrived on land in shock, and initial attempts to obstruct the spill at the bottom of the sea proved to be totally fruitless, causing it to last for 87 days ¹1. Barron MG, Vivian DN, Heintz RA, Yim UH. Long-term ecological impacts from oil spills: comparison of Exxon Valdez, Hebei Spirit, and Deepwater Horizon. Environ Sci Technol 2020; 54:6456-67..

Well integrity testing and system opacity

First, note that if oil and gas have drained from the reservoir into the well, then the cement has not fulfilled its function of sealing it properly.

And what about the misinterpretation of the pressure tests conducted by the night shift team in the drill booth? Let us remember that, in the evaluation of the person in charge of the previous shift (the day shift), there was “something wrong with the well”, due to the 1,360psi of pressure indicated on the monitor screen ²¹21. Graham B, Reilly WK, Beinecke F, Boesch DF, Garcia TD, Murray CA, et al. Deep water: the gulf oil disaster and the future of offshore drilling. Washington DC: US Independent Agencies and Commissions; 2011., a kind of maximum “warning signal” ⁴4. Llory M, Montmayeul R. O acidente e a organização. Belo Horizonte: Fabrefactum Editora; 2014. of a series that had begun a few months before the accident and intensified in the five days prior to blowout ¹⁷17. Perrow C. The next catastrophe: reducing our vulnerabilities to natural, industrial, and terrorist disasters. Princeton: Princeton University Press; 2011.. However, their shift ended and, despite supporting such a point of view, it was not immediately corroborated in the passage to the night manager. Note that he had just taken on the last night journey of his final boarding on Deepwater Horizon since he had been promoted and would disembark the next morning.

In several accidents with major repercussions, such as the Bhopal chemical industry (India), the Chernobyl nuclear power plant (Ukraine), and the Piper Alpha oil rig (British sector of the North Sea), the shift change was relevant to the network of risk factors, without forgetting that it is intrinsic to offshore activity and especially critical to collective work ⁴³43. Le Bris V, Barthe B, Marquié JC, Kerguelen A, Aubert S, Bernadou B. Advantages of shift changeovers with meetings: ergonomic analysis of shift supervisors’ activity in aircraft building. Appl Ergon 2012; 43:447-54.. The case on screen seems clear, since, with the course of the night shift, its responsible constituted a distinct representation of the one constructed by the person in charge of during the day, establishing a clear divergence about the phenomenon in progress within the well.

By the way, this also evokes the discussion around opacity as one of the structural characteristics of high complexity systems, since they do not give sufficiently clear information for the operator to intervene in certain situations, as indicated by the complexity analysis from the perspective of activity ergonomics ³¹31. Leplat J. Quelques aspects de la complexité en ergonomie. In: Daniellou F, organizador. L’ergonomie en quête de ses principes. Toulouse: Octarès; 2015. p. 51-68.. In fact, the well drilling activity has a whole support from the use of sophisticated devices and sensors, which capture parameters inside the well, transmitting them to the oil rig (on the surface), to subsidize those who are at the head of the operation. Operators, however, cannot effectively visualize what goes on at the bottom, the leak itself. In the expression of some professionals with whom we spoke, “we work blind!”.

Thus, for the person in charge of the night shift, the high pressure was not due to the leakage of the well, but to a phenomenon that can occur inside and is known in the drilling activity as “bladder effect”, a kind of spurious signal associated with the weight of fluid in the well column. To resolve any doubt, a complementary pressure test was used, performed with an auxiliary line (the kill line - Figure 3) that connected the probe directly to the well by an alternative route, and should indicate the same pressure (which had already increased from 1,360 to 1,400psi), if the well had a leakage. Since the measured pressure was null, the reading taking the phenomenon (high pressure) as a manifestation of a “bladder effect” was reinforced. Unknowingly, the kill line would have been blocked or connected at some point on the rig (it cannot be said for sure, given the sinking of the unit), resulting in its null pressure.

This interpretation was accepted by the other present on the site in the end, including the BP fiscal (agent of the contracting company on site), despite the difficulties inherent to the (complex) sharing of this type of representation ³¹31. Leplat J. Quelques aspects de la complexité en ergonomie. In: Daniellou F, organizador. L’ergonomie en quête de ses principes. Toulouse: Octarès; 2015. p. 51-68.. In summary, they assumed as true the false information (the null pressure) and disregarded the correct information, associated with the existing pressure (of 1,400psi).

Regarding the possible manifestation of a “bladder effect” in those circumstances, the chief scientist of the National Commission was adamant: “They were clearly wrong”. A posteriori, there is no doubt about this, but our theoretical framework forces us to ask something absolutely decisive to better problematize the analysis: what could have induced them to interpret the scenario in question, in that context, as the manifestation of a “bladder effect”? How did professionals with extensive experience and competence share a representation that would “clearly” be wrong? Regarding the night manager, he was a professional who, in addition to the formal recognition of his superiors, had already acquired the respect of colleagues and knew the unit very well for he worked on it since it left the shipyard in 2001.

The variability, organizational factors, and gaps in communication: a nebulous and dangerous myriad?

A kind of postulate that should never be forgotten by oil workers in this activity is that, despite technological advances, knowing for sure what is really under the ground is impossible until the wells are drilled. Although seismic analyses are fundamental beacons, a more accurate notion of the difficulties to be faced is possible only in the course of real work, something not yet fully addressed even in the so-called “probes of the future”, a new generation of oil rigs that use artificial intelligence-based (AI) technology ⁴⁸48. Cardoso B. Tecnologia ganha ainda mais protagonismo. TN Petróleo 2020; 26 nov. https://ouronova.com/tecnologia-ganha-ainda-mais-protagonismo/.
https://ouronova.com/tecnologia-ganha-ai... .

The course of drilling should assume this degree of uncertainty and unpredictability as another structural data of the process, whose variability will present in greater or lesser intensity and frequency depending on the characteristics of the situation, something that can lead to substantial delays in the schedule. Undoubtedly, Macondo proved to be a very challenging well and, on the day of the accident, the schedule delay was already of 43 days. Considering that the total daily cost of a probe like Deepwater Horizon could reach USD 1 million, we can get an idea of the pressure on the people directly involved with decisions that would extend the temporary tripping out.

According to one of the oil workers on board, “everyone was dying to get out of that well, the platform had already experienced some kicks [uncontrolled situations in the well that, if not fixed in time, can evolve into a blowout], several problems, surely millions of dollars had already been invested…” ⁴⁶46. PBS/TVI24. BP - o desastre continua no golfo: documentário [YouTube]. 2010. Vídeo: 45 min. https://www.youtube.com/watch?v=uN4z35trr_0.
https://www.youtube.com/watch?v=uN4z35tr... . Such harsh adverse conditions gave it the nickname “well from hell”. As a professional with extensive experience in drilling also told us, based on the delay, the numerous difficulties faced and the pressure they were under so far, “nobody wanted that downtime”.

A common aspect in the contractual clauses in force in the sector, we must clarify that, if the contracting company’s fiscal (BP) verifies that the progress of the operation is being compromised by some failure of the contractor (in this case, more specifically, Transocean), the latter becomes liable to bear the contractual sanctions provided for by the so-called downtime. The burden then rests on the service provider while it is paralyzed, precluding the contractor of any cost in that time interval.

Add to that some of the numerous constraints to which oil workers are exposed under boarding arrangements on the oil rigs, in which confinement and isolation extend for 14 uninterrupted days with two work teams that take turns in 12-hour shifts (one in the morning and the other in the evening). The issue of safety is critical in the face of a picture of sleep deprivation, fatigue, and psychic tension, among other factors, besides the need to perform tasks that require attention and alertness at inappropriate moments from the point of view of biological rhythms ⁴⁹49. Folkard S, Lombardi DA. Modeling the impact of the components of long work hours on injuries and “accidents”. Am J Ind Med 2006; 49:953-63.^,5050. Folkard S, Tucker P. Shift work, safety and productivity. Occup Med 2003; 53:95-101., thus raising the estimated risk in these processes, which tends to increase as the daily working hours of the shifts goes on (Figure 4). We must remember that the night manager was in his last shift of work (the 14th) and the pressure for a final decision, with the subsequent completion of the drilling stage after all the mishaps they faced, had acquired special contours for him since it would also be his last day at Deepwater Horizon, no longer returning to the unit due to the promotion he had received.

A retreat at that time would mean prolonging the delay and intensifying the level of psychic suffering, due to the adversities they would inevitably face. As the work psychodynamics proposes, if using defense mobilizations is an expected conduct in such injunctions to mitigate suffering, we should not lose sight of its counterpart as a risk of impairment of cognitive dynamics ¹⁰10. Dejours C. Trabalho vivo. Brasília: Paralelo 15; 2012.^,1111. Dejours C. Le choix: souffrir au travail n’est pas une fatalité. Paris: Bayard; 2015.. Such a situation occurs, in particular, when facing the “well from hell”, there is the feeling that the work has turned into a “hell” and the system resilience is under severe tension, at its limit ⁵¹51. Pereira RF, Morgado CRV, Carvalho PVR, Santos IJAL. Pensamento sistêmico e engenharia de resiliência aplicados à segurança de processos de exploração e produção de petróleo - estudo de caso Deepwater Horizon. Ação Ergonômica 2015; 10:153-62..

It is worthy remember that the Deepwater Horizon had only six centralizers (devices that enable uniform cementation at the lower end of the well) on board and Halliburton had ordered the shipment of 15 more of these devices since the project indicated a total of 21 centralizers. The day after that determination, however, one of BP’s managers reversed the order, claiming that such a maneuver (the placement of the 15 additional centralizers) would consume 10 more hours of work ¹⁴14. Hopkins A. Decisões desastrosas: as causas humanas e organizacionais do desastre do Golfo do México. São Paulo: Blucher; 2022.. Also, the six centralizers on board were of a different standard, which could lead to serious compatibility problems, namely the risk of such centralizers getting stuck inside the well, further delaying the intervention for days and causing another possible downtime. Add to this the BP’s decision not to perform the cement quality test, to be done by Schlumberger, at the price of USD 128,000, consuming 9 to 12 additional hours. This test could have identified the flaw in the cementing process, but Schlumberger personnel were “sent home” 10 hours before the explosion ¹⁷17. Perrow C. The next catastrophe: reducing our vulnerabilities to natural, industrial, and terrorist disasters. Princeton: Princeton University Press; 2011..

When we look back at other aspects that surrounded the incumbent and others involved in the drilling booth, we realized that two of them are crucial to better understand some of the factors that would have contributed to the routing given by the operators at that juncture.

First, note that the information that had reached them is that the cementation succeeded. In turn, this supported BP’s decision to dismiss Schlumberger from the platform and not assess the quality of the cement, which would probably reveal the failure in cementation. In the event of some unexpected complication, the responsible team understood that the integrity test would identify the problem.

The step related to this test evidently ended up acquiring greater importance throughout the process, but this status of greater relevance than normally expected was never communicated to those who led the process ¹⁴14. Hopkins A. Decisões desastrosas: as causas humanas e organizacionais do desastre do Golfo do México. São Paulo: Blucher; 2022.. Therefore, according to the scenario that was assumed as the most realistic (success of cementation), seeking another explanation for the discrepancy already pointed out in its values (1,400psi) other than leakage was plausible. According to one of our interlocutors, if the information about cementation were distorted or incomplete, certainly the decisions made by the operators could be affected.

Another element of consideration is that, when the same employees of Transocean and BP considered the possibility of a problem in cementation that could evolve into a leak, they considered the safeguard from the BOP performance, showed in Figure 2 and seen as a kind of last protective barrier. However, Hopkins ¹⁴14. Hopkins A. Decisões desastrosas: as causas humanas e organizacionais do desastre do Golfo do México. São Paulo: Blucher; 2022. points out that if the BOP is triggered after the progression of a severe occurrence, just like the blowout seen in Macondo, the chances of it not acting effectively are considerable. The equipment shows its limits precisely in situations where it is most necessary.

In fact, for a blowout like what happened at the Macondo well to be perceived in a timely manner, a key requirement would be effective engagement in monitoring activity. But, for the workers of the company Sperry Sun (responsible for this task), the well had been considered safe twice: when the engineers announced that the cementation had been a success and then when BP assured that the well had passed the integrity test. In other words, they had an entirely different representation from that of the real situation, evidencing the importance of the context, whose crucial role was emphasized in studies based on the current of “situated action” ³⁵35. Suchman LA. Plans and situated actions: the problem of human-machine communication. Nova York: Cambridge University Press; 1987..

To which moment should we rewind on major accident analyses?

There is a question that presents itself recurrently in accidents of this nature: to which moment should we rewind the course of events ⁵²52. Llory M. Acidentes industriais: o custo do silêncio. 2ª Ed. Rio de Janeiro: Multiação Editorial; 2001.? In our case, should we go back a few weeks/months before the accident or until 2008, when 211 people were evacuated from a platform in the Caspian Sea, also due to cementation problems, and the field was closed for months, with significant impacts on the corporative partners of the enterprise ¹⁴14. Hopkins A. Decisões desastrosas: as causas humanas e organizacionais do desastre do Golfo do México. São Paulo: Blucher; 2022.? Or, further back ten years, until 1998, when British Petroleum merges with Amoco, giving rise to BP, and then a quite aggressive program of organizational restructuring gains momentum ¹⁵15. Le Coze JC. Trente ans d’accidents: le nouveau visage des risques sociotechnologiques. Toulouse: Octarès; 2016.?

This program was built based on a new organizational model, focused on business units, in line with what some authors called a “networked company.” In this type of arrangement, the control is predominantly associated with fulfilling goals and results, offering these subareas greater freedom regarding project management and dilution of responsibilities. BP’s business has since gone from focusing on engineering to the commercial and financial management of such units, in which outsourcing and cost reduction have been largely stimulated ¹⁵15. Le Coze JC. Trente ans d’accidents: le nouveau visage des risques sociotechnologiques. Toulouse: Octarès; 2016.^,1616. Le Coze JC. Globalization and high-risk systems. Policy and Practice in Health and Safety 2017; 15:57-81.. This compares to Llory & Montmayeul’s ⁴4. Llory M, Montmayeul R. O acidente e a organização. Belo Horizonte: Fabrefactum Editora; 2014. observation, who noted that, in 2004, some of BP’s leading senior engineers already highlighted, as lessons from the accident with the Grangemouth refinery (Scotland), the need to invest more heavily in developing specific indicators of higher risks when compared with traditional indicators of accidents at work. Moreover, the same professionals recognized that BP had an exacerbated focus on short-term costs reduction.

Despite its consequences regarding precariousness and intensification of work, questioning this strategy was difficult over the years that followed since it had helped elevate BP to leading oil producer in the U.S. territory and the second largest private company in the sector around the world. Its trajectory, however, was the subject of serious questioning when, in the mid-2000s, it suffered, in three of his main sectors of activity (refining, exploration and production, and transportation), an unprecedented sequence of accidents: the explosion at the Texas City (Unioted States) refinery, in 2005; the listing of the Thunder Horse platform, in the same year, in the Gulf of Mexico; and the pipeline leak in Prudhoe Bay, in Alaska (United States), in 2006. In particular, the accident at the Texas City refinery had left a trail of destruction and death: a balance of 15 dead and 180 injured, damage of about USD 1.5 billion, and damaged buildings up to 1,200m around the refinery ⁴4. Llory M, Montmayeul R. O acidente e a organização. Belo Horizonte: Fabrefactum Editora; 2014.^,1515. Le Coze JC. Trente ans d’accidents: le nouveau visage des risques sociotechnologiques. Toulouse: Octarès; 2016.. Also note that, in 2000, BP’s aforementioned refinery in Grangemouth had also been the scene of a major accident ⁴4. Llory M, Montmayeul R. O acidente e a organização. Belo Horizonte: Fabrefactum Editora; 2014.^,1515. Le Coze JC. Trente ans d’accidents: le nouveau visage des risques sociotechnologiques. Toulouse: Octarès; 2016..

After the accident in Texas City, the U.S. Chemical Safety Board (independent federal agency) report found that the refinery disaster had been caused by BP’s own organizational and safety deficiencies, a combination of cost cutting (25% in 1999 and another 25% in 2005), production pressures, and lack of investments. The downsizing of the operational team and its training were also criticized. For Llory & Montmayeul ⁴4. Llory M, Montmayeul R. O acidente e a organização. Belo Horizonte: Fabrefactum Editora; 2014., this accident highlights, explicitly, the role of management as a decisive element for the occurrence of events of this nature. Ferreira ⁵³53. Ferreira LL. Falta de efetivos e insegurança em refinarias de petróleo. Rev Bras Saúde Ocup 2020; 45:35., in turn, also points to the chronic downsizing of personnel in BP refineries, not only among operators, due to this obsessive policy of cost reduction and a threat to the safety of operational processes. This is a potentially harmful role, at least in the way adopted by BP.

Note that this was a “model” (standard) that had expanded greatly in the sector, in the wake of a broader movement linked to productive restructuring that broke out in the central countries in the 1980s, and expanded in the following decade, parallel to the globalization process. In the case of Transocean (of Norwegian origin), ever since it was acquired by a U.S. drilling company in 1996, it has continued to expand and consolidate its position as the world’s largest company specializing in offshore drilling. Its head office was moved to Houston and few of its top Norwegian staff remained in leadership positions. The company’s culture was shaped by different management programs developed under the North American aegis. A relevant example would be the safety management systems, guided by a behavioral bias of workers and traditional indicators of absence due to accidents, as opposed to the dominant trend under the Norwegian context, more focused on organizational aspects and the use of tools such as robust technology and barrier system ⁵⁴54. Ryggvik H. Construindo uma indústria nacional de petróleo offshore: a experiência da Noruega. Rio de Janeiro: Elsevier; 2014..

Moreover, we must note that the functioning of a sociotechnical system with high complexity and submitted to the aforementioned organizational arrangement presupposes multiple interactions between different teams, instances and companies ⁵⁵55. Paté-Cornell E. On “black swans” and “perfect storms”: risk analysis and management when statistics are not enough. Risk Anal 2012; 32:1823-33., in which cooperation and communication occupy an absolutely central role. On the other hand, one of the difficulties of dealing with this configuration is the management of these various interfaces that present themselves during the production process, often under big pressure. In the analyzed case, the arrangement was the following:

• Field operator (BP);

• Probe owner (Transocean);

• Cementing (Halliburton);

• Cement quality (Schlumberger);

• BOP manufacturer (Cameron);

• Flow monitoring (Sperry Sun);

• Float collar (Weatherford);

• Drilling mud (M-I Swaco);

• Remotely operated vehicles - ROV (Oceaneering).

Note that these interfaces, however, are far from restricted to the managerial level, to the interactions and decisions made by managers and supervisors. Thus, one of the central questions that emerges from our interpretation of what happened is the conception that, in situations like this, the collective dimension presents itself as a crucial element. Although from different companies, workers cannot act in isolation. They are forced to interact and play an integrative role in the activity course, contributing to the flow of information and knowledge between the various collectives.

If the actions of these collectives - and the cooperation and communication that permeate them - are continuously exposed to the precarious face of outsourcing, the pressures for aggressive goals and cost reduction, it becomes an element of destabilization of the system reliability, including in the operational safety plan ³⁸38. Terssac G, Boissières I, Gaillard I, editores. La securité en action. Toulouse: Octarès; 2009.^,5656. Dejours C. La panne: repenser le travail et changer la vie. Paris: Bayard; 2012..

Final considerations - a new milestone for the oil industry?

The Deepwater Horizon oil rig accident serves as another warning about the enormous risks involved in the drilling activity. Understanding it is an unavoidable task. Especially when the results show the largest operator in the country and in most of the fields in the “pre-salt” of the Brazilian coast (the Petrobras company) implementing forms of management aligned with the precariousness trends and their harmful consequences as exposed in this essay. The discussion about the factors underlying the accident is relevant, considering that BP can be considered as a “paradigmatic case” ¹⁶16. Le Coze JC. Globalization and high-risk systems. Policy and Practice in Health and Safety 2017; 15:57-81. in the oil industry, given the logic according to which it operated in the years prior to the accident - with emphasis on its forms of management. For Yergin ⁵⁷57. Yergin D. A busca: energia, segurança e a reconstrução do mundo moderno. Rio de Janeiro: Interciência; 2014., studies, debates, and learning possibilities about what happened to the oil rig will continue for years.

Thus, the analysis based on the multidisciplinary theoretical framework adopted, with greater emphasis on the activity ergonomics, helped us to corroborate that certain errors and decision failures made by those who are at the tip of the process, in the operation of systems of this nature (of high complexity), should not be seen as an endpoint, but as a starting point in the analysis of major accidents.

Our investigation also showed that a better understanding of such decisions involves a better comprehension of the representations constructed by these workers (that includes their collective/shared dimension) and of how they deal with the events and variabilities they face. In short, by combining the experience of workers with the knowledge of the scientific literature, this analysis revealed relevant communication aspects (or gaps) in the activity and crucial organizational factors in the context of the accident. This is a set of elements relatively distant from the accident itself and, therefore, difficult to identify since they are sometimes immersed in “obscure areas”. Thus, despite the many publications in the academia on the Deepwater Horizon disaster, this study brings original elements that complement the scientific literature on this case. In this regard, note that an originality point of this essay is bringing the experience of workers of the sector to contribute to our investigative effort.

In processes with such characteristics, a research analysis that seeks to highlight cognitive dynamics during the activity may present important contributions to the analysis of these accidents and incidents and to their prevention, as indicated by some authors cited. Production and safety management systems, therefore, need to review their focus of action, to anticipate these incidents, in convergence with the so-called “safety in action”. It is about adopting a proposal that highlights the real work, the analysis of incidents, the regulation processes, and risk management during the action, valuing dissent and instituting “spaces for debate on work” ⁵⁸58. Rocha R, Mollo V, Daniellou F. Contributions and conditions of structured debates on work on safety construction. Saf Sci 2019; 113:192-9. (p. 193).

Just over 12 years after the explosion and sinking of the Deepwater Horizon, our analysis can also be seen as a contribution so that the lessons bequeathed by events of this nature, which “echo” with other disasters that occurred in this industry, are not the target of the propensity to forgetfulness, resulting from the “erosion of time and the recurrence of accidents” ⁴4. Llory M, Montmayeul R. O acidente e a organização. Belo Horizonte: Fabrefactum Editora; 2014. (p. 6). Moreover, if the accident with the P-36 oil rig can be considered a milestone for the health, safety, and environment (HSE) area of Petrobras ⁵⁹59. Guida HFS, Figueiredo MG, Hennington EA. Acidentes de trabalho fatais em empresa brasileira de petróleo e gás: análise da política de saúde e segurança dos trabalhadores. Ciênc Saúde Colet 2020; 25:1819-28., we understand the expectation that the Deepwater Horizon disaster, due to the magnitude of its deleterious consequences and the issues it evokes, in part discussed in this text, would have established “a new milestone for the entire oil industry” ⁽⁶⁰60. Gosden E. Bob Dudley leaves BP amid a Gulf in percepcions. The Times 2020; 1 fev. https://www.thetimes.co.uk/article/dudley-leaves-amid-a-gulf-in-perceptions-7mb0mq6tm.
https://www.thetimes.co.uk/article/dudle... .

Acknowledgments

To the Postgraduate Program in Public Health, Sergio Arouca National School of Public Health, Oswaldo Cruz Foundation (PPGSP/ENSP/Fiocruz), where prof. Marcelo Figueiredo attended his postdoctoral internship, under the supervision of prof. Dr. Lucia Rotenberg. The present text consists of one of the results of that internship. Indirect financing due to the Brazilian Graduate Studies Coordinating Board (CAPES) doctoral scholarship of one of the authors.

References

Publication Dates

History