The Road to High Reliability

By Allison Satterwhite

In December 2009 veteran drilling executive Kevin Lacy exited as BP’s vice president for drilling and completions in the Gulf of Mexico. At the time he saw significant planned organizational changes, a risk-heavy set of deep water wells, along with pressure to reduce costs. Four months later came the Macondo blow-out. Here he explains why oil and gas is far from being a “high-reliability” sector yet, and how we might start moving in that direction


When I left BP I was concerned there might be problems, but when I saw Macondo unfold on the news I was aghast. I couldn’t have predicted anything of that magnitude. Prior to that I would have said a major catastrophe in deep water might have been measured, cost-wise, by around a billion dollars. If somebody said ten billion I might or might not have debated it. For something to come in at forty billion was, and is, just incredible.

When I was deposed as part of the hearings in the Macondo incident the big question I kept getting asked was, did anyone tell me to cut corners or sacrifice safety in the interest of cost? And the answer, obviously, was no. It would be rare to find a senior leader give a directive to sacrifice safety or to cut corners at the expense of keeping people safe.

There was, as I stated in my deposition, “tremendous pressure” to reduce costs at BP. Part of a senior leadership role is to manage that pressure so it doesn’t distract people or get in the way of sound decisions. It was this pressure on costs combined with the inherent risk of running eight to ten deep water rigs that gave me concern in light of the proposed changes in the organization and the new people being placed in key roles. In a time of great change with many new managers we know that people will not be comfortable in raising concerns – it is basic human nature.

The changes during that time were part of a bigger corporate reorganisation and I worried that it was all too much. I suddenly found myself being told that there was not a role for me in the new organization. I signed an agreement regarding my departure and was obligated, until parts of my deposition were made public, not to speak of the circumstances of my departure. About a week later Talisman Energy called and I left BP GOM in early December 2009.

I’d been recruited by BP to help them with their offshore drilling operations because my former employer Chevron had benchmarked very well. I’d announced my retirement from Chevron in 2006 not knowing where I was going next and got a call from a recruiter representing BP. The initial role was to provide western hemisphere oversight. In 2007, they asked me to lead a study on the Gulf of Mexico drilling and completion (D&C) operations, a business unit that was having challenges. Halfway through the study they asked me to take over the D&C organization as well as the Health, Safety and Environment group for the GOM.

It was personally difficult to leave BP and the excellent staff I had at the time. We had reorganised the group in 2008 and, as a consequence, saw a dramatic turnaround in performance in that year and the next. We went from bottom in the internal performance league – in terms of safety, hitting capital budgets, production ahead of schedule and so forth – to the top.

I had ongoing concerns with the risk of deep water drilling operations, concerns that started back when I was at Chevron. They stemmed from just too many things going on simultaneously within the industry. The deep water rig fleet expanded by close to 300% over several years along with much turnover between drilling contractors and so I worried about the erosion of the level of competency that we were accustomed to, particularly at the driller and tool pusher levels.

These deepwater wells are very complicated. There are downhole conditions that even very intelligent people struggle accurately to asses. The time when you had a drilling foreman who has seen everything and knows what to do in every situation is long gone.

The challenge with process safety and well control now is that the major incidents are so infrequent that there is a general sentiment that these things don’t happen, or won’t happen – unlike with personnel safety, where there’s enough going on for the risk to be visible and in people’s minds.

What I think we can conclude about Macondo is that the event itself was caused by very basic mistakes in well control but the consequence, and the size of the consequence, was a result of deepwater conditions. Blowouts have always been a concern but this level of consequence has got to be completely unacceptable in our industry and cannot just be dismissed as “bad luck”.


People versus process

The public reaction to Macondo was standard: blame the individuals, and write new processes (along with hiring new frontline people to enforce them). But I believe the response needs to be deeper than finding a scapegoat and finding a process gap. The lesson I take from this is that there are three necessary parts to building a process safety culture. One is leadership, one is the actual process or standards, and then there is the culture itself, how we work. Those three things should work together dynamically and reinforce each other.

The problem is, it’s infinitely easier, especially for engineers and technical people, to write a new process. But we have enough processes, and it is pretty rare these days to find a truly inadequate one. The application of it may turn out to be ineffective, in which case, instead of writing a new one we have to ask the tough questions. Why was it not being used? Does the leadership know it well enough to talk about it with the frontline, to reinforce it?

Culture, behaviour, how we talk to each other, and about what – for engineers that’s all pretty fuzzy, so the reflex is to create more process, more regulation, more audits, and beefed-up equipment.

In the airline industry the response to incidents looks quite different. They have the process: it’s highly evolved and embedded. The question is always: did the mechanic, the pilot, the crew follow the process? That’s where we have to move to. I’m very skeptical about new layers of procedure being added when basic well control procedures, if followed, would work very adequately to prevent another Macondo.


Do we have a culture problem?

North American culture wants less process, less legislation. There is an adversarial mindset among industry players and between industry and the regulator. The values can be expressed by statements like ‘less is adequate’, and ‘experience is a better guide than a highly codified process’. There is a strong independent streak, as well. The concept of communal responsibility that you see in parts of Europe, for instance, is foreign.

I think this has consequences. It is no surprise to me that onshore personal safety performance in North America is among the worst in the world. I think the prevalent culture in oil and gas in North America does present challenges but, having said that, all cultures do. I’ve worked in 15 different countries and each has a unique culture. The trick is to understand the deeply-set norms and values and try to hitch those to your engine of change.

The strongest influences on culture are the regulatory environment, company leadership, and peers. In the North American context a salient weakness is the fact that the penalties for allowing disasters to happen are generally financial as opposed, say, to an individual going to jail. At Chevron I worked in countries where the result of mistakes could be prison. That really makes you sit up and pay attention! Immediately I thought, how do I prevent someone I’ve never met stepping off a helicopter and pressing the wrong button, or opening the wrong valve? I’d have no choice but to make very sure that the offshore installation manager and his second-in-command briefed that person comprehensively on how they did things. You think much more deeply about losing your personal freedom than you do about your company paying a fine on your behalf.

As for leadership in North America, there are several problems. What’s emphasised most, overtly or tacitly, is production and cost reduction. That combines with the rugged individualism prevalent in the American psyche. Pressed to follow a new procedure that claims to be more effective than others, an experienced driller is apt to say, ‘I’ll be the judge of that’. The oil and gas industry historically has reinforced this.

On the subject of disasters, it is very common for drilling managers to say ‘this won’t happen’. I have sympathy with this. What they really mean is, it’s highly improbable. And they’re right: it is highly improbable. In fact, it’s very difficult even to put a probability on it. Is there a one-in-hundred-thousand chance of something the scale of Macondo happening? One-in-a-million? What does that even mean? This creates a kind of vacuum in terms of what to focus on so it’s easier to say, either out loud or in your private thoughts, ‘this won’t happen’.

The way to avoid this trap is to say, yes, it will happen. It will happen to somebody, somewhere, at some point in time. That’s all but guaranteed. Now, what are we going to do to make sure it doesn’t happen to us? It’s a subtle but profound shift in thinking.

High reliability

If you fly domestically in the US, it will strike you just how unnervingly young some of the pilots and co-pilots seem. But the training they receive is comprehensive, the safety culture they operate in is pervasive, and the expectations on them to conform to it are rigorous and uniform.

This is the approach pioneered by so-called “high-reliability organisations” in the airline, nuclear power and other industries, where mistakes just cannot happen. The likelihood of disaster on a plane is very high if you do the wrong things, while on an oil well you can generally get it back under control unless you do some really fundamental things wrong.

How does our industry compare to the airline industry? We’ve done a lot of work over the past 20 years on personnel safety. It’s now statistically safer to work on a drilling rig than on a farm or a construction site. But if you factor in well control as a measure, and you create a safety scale of one to four, I’d put the airline industry at four and oil and gas at around one or two. We’re still two or three orders of magnitude off in terms of the rigour, the training, the consistency, the culture and the expectations.

For example, there are some generally accepted procedures for well control, and there is an effort to train, but the key difference is, it’s to train to pass the test versus to gain real proficiency and understanding. If you compare the responsibilities of a pilot landing an airplane to those of a driller on an average rig, it’s reasonable to expect there to be a difference but, when there’s a well-control incident, suddenly the driller needs the same level of proficiency and training and process back-up that a pilot needs.

Various things set high-reliability organisations apart. They don’t ever allow a single person to be the sole agent in a set of actions that could lead to system failure. They also have global standards – there are certain ways planes are flown whatever country the pilot’s from.


The road to there

DuPont uses a term, “felt leadership”, to describe its philosophy of process safety management. It means that frontline people at DuPont should feel the sincerity, the consistency, and the commitment of management to safety. How? By the managers being visible in the field, talking about the issues, demonstrating by their engagement that they really care. Their task is constantly to keep the culture alive, and to challenge, to pause and ask questions. Are you sure about this? What’s changed, what’s new? They support peer-to-peer challenging, too. It’s a daily, evolving conversation.

The man who recruited me to Chevron many years ago, Carnie Block, “got” this even before there was a fancy term for it. When he went to the field, he tried never to have more than one conversation. If he was there to talk about safety, that’s all he talked about. If it was business, it was business. He didn’t want to dilute the purpose of his visit. That made a big impression: it registered with me how we send mixed signals. For Carnie it wasn’t just ‘the company line’, it was a true internal value and it didn’t change even if they were behind forecast.

Process deficiency is rarely the fault of the process. Very few people intentionally make mistakes but they may not follow a process, or they may not know about it, or, over time, process corner-cutting is reinforced when nothing bad happens right away. This is how process deficiency propagates. It’s almost inevitable, but what combats this is a culture in which somebody else can speak up and say, hang on, that’s not what we do, and where the leadership is constantly asking questions, probing, making sure people are not getting complacent. Only such a living, holistic system of checks and balances will keep small errors from escalating into major incidents.

• Speaking at DecomWorld’s 3rd Annual Offshore Safety Conference in Houston, 29 September-1 October, in Houston, Kevin Lacy recently retired from Talisman Energy as Senior Vice President of Drilling and Completions. After spending 26 years with Chevron, Kevin joined BP in July 2006, where he became VP for Drilling and Completions in the Gulf of Mexico

This article was published with the permission of DecomWorld, a division of FC Business Intelligence Ltd.