In early April of 2010, I flew to Mobile, Alabama, to report a story for The Wall Street Journal. I covered the oil industry for the paper, and a few weeks earlier, President Obama had announced plans to expand oil and gas drilling from the western and central Gulf of Mexico, where it had long been legal, into the eastern gulf, where it was banned. Mobile Bay, which marks the dividing line between the eastern and central waters, offered a unique case study.
My story was intended to cut through the rhetoric on either side of the drilling debate and focus on the real-world complexities. In a draft of the story, I laid it out this way:
The national debate over drilling has tended to focus on the possibility of a catastrophic accident that could damage delicate ecosystems and threaten coastal tourism.
But residents in Mobile Bay paint a more nuanced picture of both costs and benefits. Mobile Bay has never had a major spill, the beaches are still white and the rigs haven’t scared off tourists. The oil industry employs hundreds of workers in the area and provides millions of dollars in revenue to the state through taxes and royalties on oil and gas produced in state waters. Recreational fishermen love the rigs, which act as artificial reefs, attracting fish.
But there are consequences, too.
I filed that draft to my editor on April 19. The following day — five years ago Monday — the Deepwater Horizon rig exploded in the Gulf of Mexico, killing 11 men and setting off exactly the kind of catastrophic oil spill that my story had dismissed as unlikely.
The story never ran in the paper. But the truth is that hardly anyone saw the disaster coming. Certainly not the oil industry, which had spent billions of dollars quantifying and mitigating every possible risk — hurricanes, fires, equipment failure, human error — yet had failed to plan adequately for a catastrophe of this magnitude. Quite simply, no one in the industry thought it was possible — and most of the usual watchdogs believed them. Government regulators focused on policing day-to-day violations while ignoring larger threats that were harder to measure. Even environmental groups acknowledged, at least in private conversations, that they were more concerned about the death-by-a-thousand-cuts impact of incremental damage than about the potential for a single massive spill. As Casi Callaway, a Mobile environmental leader, told me in April 2010 as oil from the Deepwater Horizon site approached Alabama’s shores: “All of us knew that there was a strong possibility that there were leaks and accidents and small things, but I certainly did not think this could happen.”
In the months after the spill, much of the attention focused on BP, which owned the blown-out well, and the other companies involved. And there was plenty of evidence that poor and even reckless decisions contributed to the disaster.
But there was also evidence of problems that extended far beyond BP. In the years leading up to the disaster, the industry pursued increasingly difficult drilling projects — deeper water, longer wells, higher pressures, trickier oil reservoirs — while ignoring signs that risks were growing beyond the technological capacity to control them. Indeed, many safety experts concluded that companies were thinking about risk all wrong, interpreting close calls as proof of their ability to avoid accidents rather than as evidence of mounting problems. They were failing to plan for what experts call “low-probability, high-impact events.”
Five years later, there are signs of progress. There is little doubt that today’s oil industry is better prepared both to prevent and, if necessary, recover from a Deepwater Horizon-style disaster. Watchdogs inside and outside of government are observing more closely and asking tougher questions. But there is also evidence that companies continue to push the limits of technology and continue to take risks as they do so. And it’s less clear that the industry has learned the deeper lesson about preventing low-probability events.
Anyone who has ever spent any time around the oil business knows the industry takes safety seriously. Work shifts begin with a “safety minute” discussing possible hazards. Offshore drilling rigs are plastered with signs reminding workers that all aboard, even visitors, have the power to shut down an operation if they see an unsafe condition; companies routinely give awards to workers who exercise this “stop-work authority.” When I visited a Chevron rig in the Gulf of Mexico in 2009, the company made me complete a two-day safety course that included a lesson in how to escape from a sinking helicopter. At many companies, executive bonuses are tied in part to injury rates, giving corporate leaders a financial incentive to improve safety.
Companies have similar policies in place to protect the environment. Workers aren’t allowed to so much as ash a cigarette over the edge of a rig, and companies are required to report even tiny spills to the authorities.
Those policies generally have succeeded in making the industry safer for both workers and the environment. The oil industry as a whole has cut its injury rate in half since 2004, to 1.2 cases per 100 full-time workers — lower than for the private sector as a whole, according to the Bureau of Labor Statistics — and injuries have become less common offshore as well.1 The amount of oil spilled annually, meanwhile, has trended downward even as production has increased.
But in its efforts to improve safety, the industry has tended to focus on the kind of day-to-day accidents that are easy both to measure and to resolve. Companies have cut down on slips and falls, welding accidents, dropped objects and other routine hazards that account for the majority of workplace injuries.
Those efforts are commendable; hundreds of oil industry workers are alive today because of them. But they don’t necessarily do much to reduce the risk of a catastrophic accident like the one that destroyed the Deepwater Horizon.2
The causes of the 2010 accident are complex and highly technical; the numerous reports on the accident run hundreds of pages in length. But the broad strokes go something like this: The well that the rig was drilling was particularly difficult to control, which forced the rig crew to finish its work in a way that was unconventional and, depending on whose version of events you believe, risky. A pressure test that should have revealed problems in the well was either performed incorrectly or misinterpreted (possibly both), and the crew failed to detect other signs of trouble. Fail-safe systems that should have shut down the well didn’t work as designed, allowing gas to flood the rig, where it ignited.
That sequence of events was, in one sense, highly unlikely. If things had turned out differently at any step along the way — and there were actually many more steps than that brief summary describes — the disaster would have been avoided. That was the oil industry’s analysis of events: The explosion and spill were the result of a combination of bad decisions and bad luck that would never be repeated. As proof, they pointed to the industry’s record: dozens of rigs drilling thousands of wells over decades of work without a single accident, at least in the U.S., that rivaled the Deepwater Horizon disaster.
But to safety experts, that analysis gets things backward. With so many rigs drilling so many wells, a catastrophe was all but inevitable.
Safety experts sometimes liken disaster prevention to slices of Swiss cheese stacked on top of one another. Each slice is a barrier against disaster — an alarm, a shutoff valve, a pressure test — but, like all barriers, it is imperfect. The more slices of cheese in the stack, and the smaller the holes in each slice, the less likely there is to be a hole all the way through. But keep rearranging the slices, and the chances of a disaster will keep rising.
Even before the Deepwater Horizon explosion, there was evidence that the offshore oil industry had more holes and fewer cheese slices than outsiders might have assumed. There had been a growing number of close calls, some of them disturbingly similar to the chain of events that led up to the Deepwater Horizon explosion. As far back as 2004, researchers had called into question the ability of the final failsafe device, known as the blind-shear ram, to shut off a well in an emergency; a report after the Deepwater Horizon disaster found the rig’s shear rams had failed in exactly the way the earlier study predicted.
“This accident was bound to happen,” safety expert Nancy Leveson told me in 2010. “It might not happen on that day. It might not happen on that rig. But it was bound to happen.”
In the years since the disaster, the industry has made clear improvements, in part due to a new, more independent and more aggressive offshore drilling regulator. Companies have developed more powerful shear rams and must certify that they can shut off a well in an emergency. They must also have plans in place to contain an oil spill in case the rams fail after all. And regulators are giving much more scrutiny to well design and similar issues that had gone all but ignored in the years before BP’s disaster. A repeat of the problems aboard the Deepwater Horizon would be unlikely to catch the industry off-guard this time around.
But it’s less clear that the industry has learned the deeper lesson about preventing low-probability events. Injuries and spills continue to decline; only one worker died in an offshore accident in the Gulf of Mexico last year, the fewest since at least the mid-1990s. But there were 105 fires and explosions on offshore facilities in the Gulf of Mexico last year and an additional 25 incidents in which natural gas escaped but didn’t ignite. There were also seven “losses of well control” — the precursor to a blowout like the one that felled the Deepwater Horizon. Some experts have expressed concern that the industry will cut corners on safety amid falling oil prices.
Meanwhile, the industry continues to tackle ever more challenging projects. In the Gulf of Mexico, Shell is drilling in nearly 10,000 feet of water — more than 4,000 feet deeper than the water the Deepwater Horizon was drilling in — to develop what it says will be the world’s deepest oil production facility. Separately, the company said last month that it plans to resume drilling in Alaska, where the harsh environment has repeatedly stymied its efforts. Other companies are pursuing complex deep-water projects off the coasts of Brazil, India, Australia and West Africa.
The greatest danger of all may be time. The 2010 disaster was a powerful reminder to the industry of what can go wrong — and what the consequences of a worst-case scenario can be. But memories fade. In 2010, Jane Cutler, then the head of Australia’s offshore oil regulator, said accidents happen because “people can forget to be afraid.” People forgot to be afraid five years ago. The challenge for the industry and its watchdogs — including those of us in the media — is not to forget again.