BP Gulf of Mexico disaster (20-04-2010)

Broken barrier- and TRIPOD analysis

 

The BP investigation report (8 September 2010) of the

Horizon disaster shows that eight safety barriers have
been broken. See the picture below.
This broken barriers have been used for a Tripod analysis.

Underlying Factors ref. BP (Latent Failures):

• Responsibilities not clear
• Competence of leaders not adequate
• Procedures and Engineering instructions problematic
• Risk Management and MOC procedure not adequate
• Several procedures not adequate
• HAZOP practice not good
• SIL concept (IEC 61511) not implemented
• BP in company knowledge of Blow-out Preventers (BOP) insufficient
• Practice of emergency planning and drilling not adequate.

The barrier concept

Incidents occur because one or more safety barriers have been broken. That concept is
published by James Reason, perfectly described in his book: ‘Managing the Risks of
Organizational Accidents’. He describes how the underlying factors should be addressed. He
introduced the term ‘Latent Failures’ in the organization. That is the basis for the TRIPOD
method (www.tripodincidentanalysis.com). From experience, SSC know that TRIPOD is a
powerful tool to help address the Latent Failures and to make a step change in Safety. From
the lessons learned.
On the basis of the BP report, SSC performed a TRIPOD analysis, with the same 8 broken
barriers. The Latent Failures mentioned above show the underlying organizational problems
of BP. The Tripod analysis diagram below gives an insight on the Tripod reasoning fromn
broken barriers to latent failures in the organisation. You will find the BP reports here.

www.safety-sc.com www.tripodincidentanalysis.com 1  
 configuration pits
difficult to
monitor

Preconditions could Well monitoring

Responsibilities
not be investigated bad cement quality procedure niet
are not clear
by BP adequaat
The crew was busy
Organisation Procedures with other
activities

influx not seen

3 possible failure timely
Procedures and Failure of non
modes: not yet
Engineering return valves Competentie van
further
practices problem investigated ('float collar') leidinggevenden en no lessons from
werkers previous near miss

www.safety-sc.com
Procedures incident (kick)
Organisation

Recommended design/ testing/

practice (API) does quality check
not exist failures criteria for
brittle cement: ETP GP "working succesful test was
nitrogen break out with pressure" niet missed
Organisation
adequaat

Procedures
Wrongly interpreted
Risk management
Risk analysis not
and MOC procedure HAZOP practice not Not designed for
adequate detailled HAZOP not performed
not adequate adequate it, does not vent
testinstruction not to safe location
Procedures present
Design

Oil and gas in

reservoir (high
pressure)

1. cement between 2. Mechanical

Failure of
wall and pipe barrieres
well-integrity/
influx

3. Pressure test 4. Well monitoring

No well control/
hydrocarbons to
separator

well/ drill hole 6. Separator tank as

buffer gas release at
platform /
explosion, fire/ 11
fatalities, large
hydrocarbons envronmental damage

5. well control
respons

practice of wrong action: riser

no emergency plan
eremency planning fluid to separator workers, platform,
for this situation
and drilling iso to the sea. environment

www.tripodincidentanalysis.com
Defences 8. Blow out preventer
7. Fire & Gas system (BOP)

Fire & gas system

niet adequaat

SIL concept not Gasdetection fails

implemented (IEC to stop the
61511) ventilation of the
Engine Rooms
Design
System inytegrity
(SIL) not adequate,
vulnerable for
human error

Failure by empty
battery en faling well was not closed
solenoid valve

BP in company BOP
knowledge
insufficient

Organisation
inadequate testing
and maintenance
Tripod Analysis of the BP Horizon disaster (for illustration/ training purposes)

2