University of Southern California Dissertations and Theses

A risk analysis methodology to address human and organizational factors in offshore drilling safety: with an emphasis on negative pressure test

(USC Thesis Other)

A risk analysis methodology to address human and organizational factors in offshore drilling safety: with an emphasis on negative pressure test

PDF

Download a page range

Download transcript

Copy asset link

Request this asset

Transcript (if available)

Content i

A Risk Analysis Methodology to Address Human and
Organizational Factors in Offshore Drilling Safety:
With an Emphasis on Negative Pressure Test

By
Maryam Tabibzadeh

Dissertation Submitted to the Faculty of the Graduate School
of the University of Southern California
In Partial Fulfillment of the Requirements for the Degree of
Doctor of Philosophy
May 2014

PhD Dissertation Committee:

Professor Najmedin Meshkati, Committee Chair
Professor Iraj Ershaghi, Committee Member
Professor Richard John, Committee Member
Professor Detlof von Winterfeldt, Committee Member
ii

© Copyright by
Maryam Tabibzadeh
2014

iii

To My Parents,
who have supported me all my life

iv

Acknowledgements
I would like to express my deepest gratitude to my advisor and mentor, Professor Najmedin
Meshkati, for his guidance, support, patience and encouragement during my graduate studies and
also within the scope of this dissertation. I am forever grateful to him for all he has taught me.
My sincere thanks go to Professor Detlof von Winterfeldt who took so much time out of his busy
schedule to guide me throughout this research; especially, regarding the developed quantitative
methodology in this dissertation. I would also like to thank Professors Iraj Ershaghi and Richard
John who served on my doctoral committee and kindly guided me in this research.
Many thanks go to Mr. Stan Christman, retired ExxonMobil executive engineering advisor; Mr.
Fred Dupriest, retired ExxonMobil chief drilling engineer and lecturer at the Texas A&M
University; Mr. Juan Garcia, retired ExxonMobil Worldwide drilling manager; and Mr. Roger
Gatte, BP retired wells superintendent, for their invaluable inputs and insightful remarks
regarding negative pressure testing.
I would like to thank Dr. Robert Bea, professor of the University of California, Berkeley; Dr.
Keith Millheim, president of the Strategic Worldwide LLC; Dr. Ali Mosleh, professor of the
University of Maryland; Dr. Elisabeth Pate-Cornell, professor of the Stanford University; and Dr.
Greg Placencia; adjunct professor of the University of Southern California, for their guidance,
advice and multiple fruitful discussion sessions during this study.
I would also like to acknowledge the generous guidance of Dr. Fred Aminzadeh, professor of the
University of Southern California; Dr. Paul Bommer, professor of the University of Texas at
Austin; Dr. Peter Friis Hansen, Energy Program director at DNV, Norway; Mr. Bill Nelson and
Dr. Robin Pitblado of DNV, Houston; and Dr. Mansour Rahimi, professor of the University of
Southern California, during this research.
I would like to thank the faculty and the staff of the Daniel J. Epstein Department of Industrial
and Systems Engineering for their support throughout my PhD program at USC. I would
especially like to thank professors Thomas Booth and Erich Kreidler, whom I was their Teaching
Assistant, for their continuous support and encouragement throughout my studies.
My gratitude is extended to my parents and my brothers for their constant encouragement, love
and support.

v

Table of contents

Acknowledgments .........................................................................................................................iv
List of Figures ............................................................................................................................... vii
List of Tables .................................................................................................................................... x
Abbreviations ................................................................................................................................. xi
Abstract ............................................................................................................................................... 1

1) Introduction .................................................................................................................................. 3
1.1) History of Offshore Drilling .............................................................................................. 3
1.2) Offshore Drilling Accidents ................................................................................ 5
1.2.1) Human and Organizational Factors and Safety Culture .............................. 7
1.3) Motivation and Significance of Research ...................................................................... 8
1.4) Research Objective .......................................................................................................... 10
1.5) Summary of Methodology .............................................................................................. 11
1.6) Dissertation Outline .......................................................................................................... 13
2) Literature Review .................................................................................................................. 14
2.1) Overview ............................................................................................................................. 14
2.2) Technical Risk Analysis Approaches .......................................................................... 17
2.3) Human Factors in Risk Analysis ................................................................................... 28
2.4) Human and Organizational Factors in Risk Analysis ............................................. 35
2.5) Evolution of Research Methodology and Summary of Comparisons ................. 49
3) Methodology ........................................................................................................................... 54
3.1) Overview ............................................................................................................................. 54
3.2) Comparative Analysis ...................................................................................................... 54
3.2.1) Model Introduction ................................................................................................... 54
3.2.2) Model Description .................................................................................................... 55
vi

3.3) Conceptual Risk analysis Framework ......................................................................... 68
3.3.1) General Model Introduction ................................................................................... 68
3.3.2) Model Description ..................................................................................... 69
3.3.2.1) Organizational Factors Level .......................................................... 69
3.3.2.2) Decisions/Actions Level ................................................................. 76
3.3.2.3) Physical States of System/Basic Events Level ............................... 83
3.3.3) Summary of Results ................................................................................... 87
3.4) Rational Decision Making Model .................................................................... 91
3.4.1) General Model Description ....................................................................... 91
3.4.2) Decision Processes in Signal Detection Theory ........................................ 98
3.4.3) Model Quantification ............................................................................... 101
3.4.4) Model Sensitivity Analysis ...................................................................... 114
3.4.5) Summary of Findings ............................................................................... 123
4) Summary and Conclusion ................................................................................................ 126
5) Recommendations ............................................................................................................... 130
6) Future Work .......................................................................................................................... 132
Appendix A: A Proposed Model to Study Interoperability and Interactions of
Multiple Organizations............................................................................................ 134
A.1) Model Description ...................................................................................................... 135
A.2) Case Study of the BP Deepwater Horizon Accident ........................................ 138
References .................................................................................................................................... 148

vii

List of Figures
Figure 1.1. Wells drilled in the GOM by water depth from 1940 to 2010 .....................................4
Figure 1.2. A view of the Deepwater Horizon rig ...........................................................................5
Figure 2.1. RAM (Risk Assessment and Management) process ...................................................15
Figure 2.2. Hazard source characteristics and risk management strategies ...................................16
Figure 2.3. Bow-tie methodology ..................................................................................................20
Figure 2.4. Loss Causation model..................................................................................................20
Figure 2.5. SCAT and BSCAT conceptual models .......................................................................21
Figure 2.6. Example of a fault tree structure .................................................................................23
Figure 2.7. Example of an event tree .............................................................................................23
Figure 2.8. A Bayesian network example ......................................................................................25
Figure 2.9. HCL framework...........................................................................................................26
Figure 2.10. Relationship between the four human factors analysis approaches ..........................28
Figure 2.11. The HRA process ......................................................................................................29
Figure 2.12. QMAS three-level process to evaluate components, factors, and attributes .............36
Figure 2.13. QMAS grading scale .................................................................................................37
Figure 2.14. Nominal human task performance reliability ............................................................39
Figure 2.15. QMAS qualitative grading translation to quantitative PSF used in SYRAS.............40
Figure 2.16. Hierarchy of root causes of system failure ................................................................41
Figure 2.17. Summary of main steps of the BORA methodology .................................................45
Figure 2.18. Overall structure of the I-Risk model ........................................................................46
Figure 3.1. Workflow process for the proposed “standard” negative pressure test .......................58
Figure 3.2. Work flow process for the Deepwater Horizon negative pressure test .......................62
Figure 3.3. Drilling crew’s justification of the “bladder effect” ...................................................65
viii

Figure 3.4. Three-layer conceptual framework to analyze the contributing causes of a negative
pressure test misinterpretation .......................................................................................................73
Figure 3.5. Structure of the proposed rational decision making model .........................................93
Figure 3.6. Leak in the BOP annular preventer .............................................................................94
Figure 3.7. Possible flow paths for hydrocarbon ..........................................................................54
Figure 3.8. Signal detection theory and decision processes ...........................................................98
Figure 3.9. Matrix representing decision outcomes .......................................................................99
Figure 3.10. Matrix representing possible outcomes for a binary decision ...................................99
Figure 3.11. A decision tree for accepting or rejecting a NPT ....................................................102
Figure 3.12. Probability distrubution for ) | (
0
h x f ........................................................................107
Figure 3.13. Probability distrubution for ) | (
1
h x f .......................................................................109
Figure 3.14. Probability distrubution for ) | (
2
h x f .......................................................................110
Figure 3.15. Joint diagram of all ) | (
i
h x f ’s .................................................................................113
Figure 3.16. Sensitivity analaysis of the cut-off point value based on ) 1 (var Y P  ......................116
Figure 3.17. Sensitivity analaysis of the cut-off point value based on ) 1 (var Y P  with the
highlighted interval [0,0.1] .........................................................................................................117
Figure 3.18. Sensitivity analaysis of the cut-off point value based on ) 2 (var Y P  ......................118
Figure 3.19. Sensitivity analaysis of the cut-off point value based on ) 2 (var Y P  with the
highlighted interval [0,0.1] .........................................................................................................118
Figure 3.20. Sensitivity analaysis of the cut-off point value based on (C
20
/C
01
) or (C
30
/C
01
) .....120
Figure 3.21. Sensitivity analaysis of the cut-off point value based on (C
20
/C
01
) or (C
30
/C
01
) with
the highlighted interval [1,500] ...................................................................................................120
Figure 3.22. Sensitivity analaysis of the cut-off point value based on  for f(x|h
0
) ....................122
Figure A.1. A multi-layer interaction model for top-down and bottom-up coordination ............135
ix

Figure A.2. Four-layer framework for risk analysis of interactions among multiple organizations
......................................................................................................................................................137
Figure A.3. “Work-as-done” versus “work-as-planned” ............................................................138
Figure A.4. Four-layer framework for risk analysis of interactions in the Deepwater Horizon case
study .............................................................................................................................................140
Figure A.5. Deepwater Horizon Organizational Structure ..........................................................142
Figure A.6. Illustration of the main deck of the DWH ................................................................145

x

List of Tables
Table 2.1. Summary of comparisons of risk analysis methods .......................................................... 51
Table 3.1. Cost matrix for state-judgment combinations .................................................................. 111

xi

Abbreviations
ABS: American Bureau of Shipping
API: American Petroleum Institute
APJ: Absolute Probability Judgment
BBN: Bayesian Belief Network
BOEMRE: Bureau of Ocean Energy Management, Regulation, and Enforcement
BOP: Blowout Preventer
BORA: Barrier and Operational Risk Analysis
BSCAT: Barrier based SCAT
BSEE: Bureau of Safety and Environmental Enforcement
DP: drill pipe
DSS: Decision Support System
DHSG: Deepwater Horizon Study Group
DWH: Deepwater Horizon
EDS: Emergency Disconnect Sequence
ETA: Event Tree Analysis
FMEA: Failure Mode and Effect Analysis
FTA: Fault Tree Analysis
GOM: Gulf of Mexico
HAZOP: Hazard and Operability Study
HCL: Hybrid Causal Logic
HEA: Human Error Analysis
HEART: Human Error Assessment and Reduction Technique
HEP: Human Error Probability
xii

HFE: Human Factors Engineering
HOFs: Human and Organizational Factors
HRA: Human Reliability Assessment
HSE: Health and Safety Executive
IEA: International Energy Agency
MMS: Mineral Management Service
MOC: Management of Change
MODU: Mobile Offshore Drilling Unit
NAE/NRC: National Academy of Engineering/National Research Council
NPT: Negative Pressure Test
OIM: Offshore Installation Manager
PHA: Preliminary Hazard Analysis
ppg: pounds per gallon
PSA: Petroleum Safety Authority
PSF: Performance Shaping Factor
psi: pounds per square inch
QMAS: Quality Management Assessment System
QRA: Quantitative Risk Assessment
SAM: System-Action-Management
SCAT: Systematic Cause Analysis Technique
SDT: Signal Detection Theory
SHERPA: Systematic Human Error Reduction and Prediction Approach
SPE: Society of Petroleum Engineers
THERP: Technique for Human Error Rate Prediction
1

Abstract
According to the final Presidential National Commission report on the BP Deepwater Horizon
(DWH) blowout, there is need to “integrate more sophisticated risk assessment and risk
management practices” in the oil industry. Reviewing the literature of the offshore drilling
industry indicates that most of the developed risk analysis methodologies do not fully and more
importantly, systematically address the contribution of Human and Organizational Factors
(HOFs) in accident causation. This is while results of a comprehensive study, from 1988 to 2005,
of more than 600 well-documented major failures in offshore structures show that approximately
80% of those failures were due to HOFs. In addition, lack of safety culture, as an issue related to
HOFs, have been identified as a common contributing cause of many accidents in this industry.
This dissertation introduces an integrated risk analysis methodology to systematically assess the
critical role of human and organizational factors in offshore drilling safety. The proposed
methodology in this research focuses on a specific procedure called Negative Pressure Test
(NPT), as the primary method to ascertain well integrity during offshore drilling, and analyzes
the contributing causes of misinterpreting such a critical test. In addition, the case study of the
BP Deepwater Horizon accident and their conducted NPT is discussed.
The risk analysis methodology in this dissertation consists of three different approaches and their
integration constitutes the big picture of my whole methodology. The first approach is the
comparative analysis of a “standard” NPT, which is proposed by the author, with the test
conducted by the DWH crew. This analysis contributes to identifying the involved discrepancies
between the two test procedures. The second approach is a conceptual risk assessment
framework to analyze the causal factors of the identified mismatches in the previous step, as the
main contributors of negative pressure test misinterpretation. Finally, a rational decision making
model is introduced to quantify a section of the developed conceptual framework in the previous
step and analyze the impact of different decision making biases on negative pressure test results.
Along with the corroborating findings of previous studies, the analysis of the developed
conceptual framework in this paper indicates that organizational factors are root causes of
accumulated errors and questionable decisions made by personnel or management. Further
analysis of this framework identifies procedural issues, economic pressure, and personnel
management issues as the organizational factors with the highest influence on misinterpreting a
2

negative pressure test. It is noteworthy that the captured organizational factors in the introduced
conceptual framework are not only specific to the scope of the NPT. Most of these organizational
factors have been identified as not only the common contributing causes of other offshore
drilling accidents but also accidents in other oil and gas related operations as well as high-risk
operations in other industries.
In addition, the proposed rational decision making model in this research introduces a
quantitative structure for analysis of the results of a conducted NPT. This model provides a
structure and some parametric derived formulas to determine a cut-off point value, which assists
personnel in accepting or rejecting an implemented negative pressure test. Moreover, it enables
analysts to assess different decision making biases involved in the process of interpreting a
conducted negative pressure test as well as the root organizational factors of those biases.
In general, although the proposed integrated research methodology in this dissertation is
developed for the risk assessment of human and organizational factors contributions in negative
pressure test misinterpretation, it can be generalized and be potentially useful for other well
control situations, both offshore and onshore; e.g. fracking. In addition, this methodology can be
applied for the analysis of any high-risk operations, in not only the oil and gas industry but also
in other industries such as nuclear power plants, aviation industry, and transportation sector.

3

1) Introduction
1.1) History of Offshore Drilling
Crude oil has always been one of the major and critical sources of energy in different industries.
Some of the main applications of oil are producing heat and making electricity. It can also be
used as the fuel for vehicles and machineries or as the main component of industrial products
such as plastics and petroleum products.
For many years, onshore drilling was the only means of oil production. The main reason for
being confined to onshore was the limited technologies of both oil exploration and drilling at that
time. In 1938, the first offshore oil production took place in the Gulf of Mexico (GOM)
(Presidential Commission report, 2011, page 21). The location of that reservoir was a mile and a
half offshore at a radius of 13 miles from Cameron, Louisiana, and its depth was 14 feet below
the sea level (Presidential Commission report, 2011, page 21).
Since then, there have been many offshore drilling developments all over the world. New
developing technologies helped the oil companies to expand their boundaries and depth of
drilling in order to access the reservoirs with higher amount of oil.
A new introduced concept in the context of offshore oil exploration was deepwater drilling.
Based on the modern definition, any oil production at the depth of 1000ft or more from sea level
is considered as deepwater drilling (Presidential Commission report, 2011, page 31). In 1978, the
first deepwater drilling took place in the Mississippi Canyon by Shell in 1000ft of water. The
estimated amount of oil extracted from that reservoir was around 100 million barrels
(Presidential Commission report, 2011, page 31). It is needed to state that the
aforementioned1000ft threshold for distinguishing deepwater drilling has been changed to 500ft
(U.S. Department of the Interior report, 2012).
In today’s oil production, the critical role of offshore and deepwater drilling is uncontested
(Pitblado, Bjerager, Andreassen, and Tørstad, 2011). According to the International Energy
Agency (IEA) (2010), a third of the world oil production came from offshore drilling in 2010,
and this number will increase to about a half in 2015. As an example, figure 1.1 shows the
number of wells drilled versus water depth in the Gulf of Mexico from 1940 to 2010. This
4

indicates that in the past few decades alone, offshore and deepwater drilling has increased
exponentially.

Figure 1.1. Wells drilled in the GOM by water depth from 1940 to 2010 (Presidential Commission report, 2011, page 41)
In February 2009, BP filed an exploration plan with the United States Minerals Management
Service (MMS) to drill two exploratory wells in Mississippi Canyon Block 252. Both of those
wells were located 48 miles from the shore in approximately 5000ft water depth (Chief
Counsel’s report, 2011, page 25). BP’s intention was to drill down both of the wells to a total
depth of 20600 feet below sea level. On May 22, 2009, MMS approved BP’s plan to drill the
first of the two wells. That well was named “Macondo” after a fictional Columbian village
(Chief Counsel’s Report, 2011, page 25).
BP started drilling the Macondo well in October 2009 using the semi-submersible rig Marianas,
which was owned by Transocean (Presidential Commission report, 2011, page 92). They drilled
for 34 days reaching a depth of 9090ft. Then, they needed to stop their operation on November 9,
2009 due to Hurricane Ida (Chief Counsel’s Report, 2011, page 26).
The Marianas rig was damaged in the Hurricane Ida. Therefore, another semi-submersible rig
called “Deepwater Horizon (DWH)” was used to continue drilling the Macondo well in February
2010 (Chief Counsel’s Report, 2011, page 26). This rig was also owned by Transocean.
BP continued drilling the Macondo well to a total depth of 18034ft below sea level, which was in
a depth of 13034ft from the sea floor. Figure 1.2 shows a view of the Deepwater Horizon rig.
5

Figure 1.2. A view of the Deepwater Horizon rig (DWH image, 2010)

1.2) Offshore Drilling Accidents
As stated in section 1.1, offshore and deepwater drilling has been a vital source of oil supply in
the world. Conversely, this industry is among high-risk industries in which large scale accidents
do occur. Major issues, such as high operational pressures and temperatures, large seismological
uncertainties, difficult formations, and very complex casing programs, associated with deepwater
drilling make this type of drilling very risky (Skogdalen and Vinnem, 2012).
Higher risks associated with offshore and deepwater drilling increase the probability of accidents
in this industry. In fact, several accidents and blowouts on offshore platforms have occurred,
some of which operated in deepwater areas. Some key historical examples of oil and gas drilling
and production accidents are: the Mobil Ocean Ranger drilling platform (Gulf of Mexico, 1982);
the Piper Alpha production platform (North Sea, 1988); the Petrobras, P-36, production platform
(Brazil, 2001); and the Deepwater Horizon drilling platform (Gulf of Mexico, 2010).
Bea (1998) introduces blowouts as the primary cause of accidents in offshore platforms, as
illustrated by the case of the BP DWH in the Gulf of Mexico on April 20, 2010. In that accident,
failure in well integrity led to a blowout caused by a gas explosion resulting in 11 deaths and 16
injuries, a massive oil spill of 5 million barrels, and billions of dollars of damage.
6

The DWH crew realized the flow from the well around 21:40 on the night of April 20

when the
mud overflowed and came to the riser. By 21:41, mud shot up through derrick. At this time, the
crew sent the fluid to the mud-gas separator and activated the Blowout Preventer (BOP). The
BOP could not seal the well, and the mud-gas separator did not function properly due to the large
volume of fluid (BP report, 2010, page 28).
It was around 21:46 that the gas spread out on the rig floor and the first explosion happened
around 21:49 when the gas reached the engine room area. The second attempt to seal the well by
activating the Emergency Disconnect Sequence (EDS) on the BOP failed as well, so the fluid
continued to flow on the rig floor (BP report, 2010, pages 28 and 29). With the help of the U.S.
Coast Guard, 115 personnel including 17 injured were saved. However, unfortunately, 11 people
went missing and found dead at the end.
The DWH rig sank three days later after the accident. However, the oil spill continued for 87
days after the first blowout. The amount of oil spill from that accident was around 5 million
barrels of oil, which is approximately equivalent to 682,000 tons (Presidential Commission
report, 2011, page 87).
The consequences of the BP Deepwater Horizon accident have not only been limited to the death
of 11 personnel and the damage of the DWH rig. The oil leakage to the Gulf of Mexico caused
many environmental damages as well. The gulf water got polluted and as a result of that, lives of
many sea creatures and birds were exposed to risk. This issue affected the career of the local
fishermen and small businesses. In addition, the Gulf coastline was polluted for a long time.
Consequently, the businesses in that area lost their income opportunity from tourism. In total, the
cost of the DWH accident was estimated to be tens of billions of dollars based on the National
Academy of Engineering/National Research Council (NAE/NRC) report (2011).
Considering the stated trade-off between the increasing risk of offshore and deepwater drilling
and the rising dependence on oil and gas, there is a growing need for oil companies to
incorporate suitable risk analysis practices into their operations. Risk assessment frameworks
enable oil companies to analyze the increasing risks of offshore and deepwater drilling and
develop appropriate contingency and mitigation plans for risk reduction. The main intention of
developing such frameworks is to prevent accidents like the BP Deepwater Horizon in the future.

7

1.2.1) Human and Organizational Factors and Safety Culture
The original framework of safety culture is still considered to be the market standard by many
safety-critical industries. It defines safety culture as five primary composing elements,
characteristics or sub-cultures, which include an informed culture, a reporting culture, a learning
culture, a just culture, and a flexible culture (Reason 1997, 1998, and 2000).
The United Kingdom Health and Safety Executive defines the safety culture of an organization
as “the product of individual and group values, attitudes, and perceptions, competencies, and
patterns of behavior that determine the commitment to, and the style and proficiency of, an
organization’s health and safety management” (Presidential Commission report, 2011, page 218).
The term “safety culture” was first applied to nuclear power by the International Atomic Energy
Agency (IAEA) to explain how the lack of knowledge of risk and safety by operators and the
organization contributed to the Chernobyl disaster (IAEA safety report, 1986). Although the
term of safety culture is open to interpretation (Guldenmund, 2000), the concept is focused on
the idea that where safety culture is practiced, and whether individuals and organizations give
emphasis to safety over competing goals such as production or costs.
Lack of safety culture and issues related to human and organizational factors have been the
contributing causes of many offshore drilling and production accidents as well as accidents in
other high-risk industries. According to Pate-Cornell (1993), most significant causes of the Piper
Alpha accident were “rooted in the organization, its structure, procedures, and culture”. In
addition, failure to implement a safety-first approach contributed to the Macando Well blowout
(Christou and Konstantinidou, 2012; Presidential Commission report, 2011; and NAE/NRC
report, 2011).
In this regard, different credible references recommended that the Bureau of Safety and
Environmental Enforcement (BSEE) of the U.S. Department of the Interior, as the responsible
regulatory agency for offshore operations in the Outer Continental Shelf, has to promote safety
culture. According to the Transportation Research Board report (2012, page 69), BSEE has to
“encourage a culture of safety so that individuals know the safety aspects of their actions and are
motivated to think about safety”. In addition, the NAE/NRC report (2013, page 21) on the best
available and safest technologies for offshore operations stated that “BSEE should appropriately
consider human factors aspects given their impact on recent offshore disasters worldwide”.
8

It is noteworthy that the BSEE itself developed a safety culture policy statement (2013) in which
announces its expectations from all individuals and organizations performing or overseeing
activities regulated by BSEE. According to this statement, all those individuals and organizations
have to establish and maintain a positive safety culture, foster in personnel an appreciation for
the importance of safety and environmental stewardship, and emphasize the need for integrating
safety into performance objectives in order to achieve optimal protection and production.

1.3) Motivation and Significance of Research
As stated in the previous section, there is a growing need for developing risk assessment
frameworks in the context of offshore drilling in order to analyze different contributing causes of
previous incidents/accidents. Such frameworks appear more essential given recent investigations
of the BP DWH blowout. The final report of the Presidential National Commission (2011, page
251) emphasized the need to “integrate more sophisticated risk assessment and risk management
practices” into the oil industry. Similarly the National Academy of Engineering and National
Research Council recommended that “the United States should fully implement a hybrid
regulatory system that incorporates a limited number of prescriptive elements into a proactive,
goal-oriented risk management system for health, safety, and the environment” (NAE/NRC
report, 2011, page 5). They further recommended that the industry expands its R&D efforts and
focuses on improving the overall safety of offshore drilling in the area of risk assessment as a
key area to aid safety culture. In addition, according to a study of a range of accidents over the
last 100 years in the oil and gas industry, the area of risk assessment needs to be improved for the
purpose of preventing major catastrophes (Ferrow, 2011).
Another important element in analyzing offshore drilling accidents is the critical role of human
and organizational factors as a main contributor to such accidents. A comprehensive study, from
1988 to 2005, of more than 600 well-documented major failures in offshore structures was
performed by the Marine Technology and Management Group, the Center for Risk Mitigation,
and the Center for Catastrophic Risk Management at the University of California Berkeley. The
study indicated that approximately 80% of those failures were due to human and organizational
factors (Bea, 2002b and 2006). In another study, Bea (1999) introduces the HOFs as the “single
largest threat” to the reliability of offshore platforms.
9

Moreover, a recent analysis of past offshore accidents, which was performed by the European
Union Joint Research Centre, showed evidence of human error in 92% of the analyzed cases
(Christou and Konstantinidou, 2012).
Human and organizational factors had a critical role in causing the BP DWH accident as well.
According to Chief Counsel’s report (2011, page ix, emphasis added), “what the investigation
makes clear, above all else, is that management failures, not mechanical failings, were the
ultimate source of the disaster”.
Our study noted a critical gap in the literature regarding the existence of enough risk assessment
approaches analyzing the crucial role of human and organizational factors, as a main contributing
cause in offshore drilling accidents. It is noteworthy that methods incorporating HOFs in
offshore related operations date back 20 years (Aven, Sklet, and Vinnem, 2006). However, most
have excluded the context of offshore drilling, focusing rather on other offshore related issues
like collisions, maritime transportation safety, and offshore installations. This would seem to
indicate that HOFs considerations have not been integrated into a critical component of risk
analyses within the offshore drilling industry. (The complete explanation regarding the existing
risk analysis methodologies in the context of the oil and gas industry will be provided in the next
chapter.)
The scope of this study has focused on critically analyzing the DWH accident as a seminal
example of offshore drilling blowout that resulted from sequential failures in a tightly coupled
and interactively complex system (Visser, 2011). We further narrowed our scope to analyze
issues with a specific test known as the Negative Pressure Test (NPT), which we identified as the
key contributing cause to the DWH accident. NPTs are currently the only way to test cement
integrity at the bottom of a well (Chief Counsel’s report, 2011, page 143). They are used to
indicate whether a cement barrier and other flow barriers can isolate the well and prevent the
hydrocarbon influx (NRE/NRC report, 2011, page 18).
Formal investigations of the Deepwater Horizon accident indicate that the crew misinterpreted
the results of the negative pressure test, which was reported as a main cause of the loss of well
control and the subsequent blowout on the DWH rig (Bea, 2011b; BP report, 2010, page 10;
Bureau of Ocean Energy Management, Regulation, and Enforcement (BOEMRE) report, 2011,
page 109; Chief Counsel’s report, 2011, page 143; and SINTEF executive summary, 2011, page
10

7). This view is shared by several leading experts in petroleum engineering and well design.
According to those experts, one single item that could have saved the day for the DWH was the
correct interpretation of the negative pressure test conducted by the DWH crew on the day of the
accident. For instance, the Honorable Dr. Donald Winter, chairman of the National Academy of
Engineering/National Research Council committee on the BP DWH accident, stated in his
interview with Platts that the blowout was precipitated “not by a piece of hardware, but by the
decision to proceed to temporary abandonment in spite of the fact that the negative pressure test
had not been passed” (Gentile, 2013).
It is noteworthy that the NPT was not only specific to the Macondo well operations nor is
restricted to exploratory drilling; rather it is an important procedural step for temporary
abandonment in most offshore drilling. As a result, a prescriptive model that details the most
influential factors for correctly conducting and interpreting the NPT could significantly reduce
the risk of future accidents in offshore platforms.
Based on the above analyses, the main objective of this study is to develop a risk analysis
methodology to assess human and organizational factors contributions in negative pressure test
misinterpretation. It is needed to state that we intend to propose a methodology that can be
generalized and be potentially useful for risk analysis of future oil and gas drilling as well as
other high-risk operations in different industries.

1.4) Research Objective
As we stated briefly before, the main objective of this research is to propose a risk analysis
methodology to systematically assess the critical role of human and organizational factors as a
main contributing cause of any negative pressure test misinterpretation. As discussed in section
1.3, this test is a critical step towards ascertaining well integrity in offshore drilling. As a result,
development of such methodology is beneficial for the safety and reliability of offshore drilling.
Therefore, it can be useful for preventing future accidents in this industry.
The following are the sub-objectives of this research:
 Reducing the probability of misinterpreting a negative pressure test
11

 Proposing a risk assessment methodology which is capable of both qualitative and
quantitative analysis of conducting and interpreting a negative pressure test
 Filling the gap in the literature for the existing risk assessment approaches, which
consider HOFs in their analysis
 Developing a framework that can be generalized and be potentially useful for risk
analysis of future oil and gas drilling as well as other high-risk operations in different
industries
It is needed to state that the used terminologies in this research are based on the author’s
understanding of the stated issues by the published investigation reports on the BP DWH
accident and also by the contacted experts in the field of petroleum engineering and well design.
All those terminologies are utilized for the sake of labeling in this research and there are no legal
issues involved in this regard.

1.5) Summary of Methodology
The methodology of this research consists of three different approaches, which their integration
constitutes the big picture of the whole methodology. Each approach resembles a building block
for the next one, which means it is a prerequisite step for developing the next approach.
The first introduced approach in this research methodology is a comparative analysis. As stated
in the previous sections, the concentration of this research will be on a critical procedure called
negative pressure test. Firstly, there is a need to learn how a “standard” negative pressure test is
conducted. It is then possible to compare the performance of the Deepwater Horizon crew in
conducting the test with the identified “standard” procedure for implementation of such test.
In this dissertation, we propose a general “standard” framework for negative pressure test
procedure based on our extensive research on oil and gas drilling and our personal contact with
many well-known experts in the area of petroleum engineering and well design.
In the next step, the comparative analysis of a “standard” NPT and the test conducted by the
DWH crew will be displayed using workflow processes. There will be a separate workflow
process for each of the stated NPT procedures. Then, it will be possible to compare the two
procedures with each other and identify the involved discrepancies.
12

Identifying the aforementioned discrepancies will be useful in developing the next approach or
the next phase. The main objective of that approach is the recognition and the analysis of causes
of the identified mismatches and building a model showing the causal relationship between those
recognized factors.
The proposed approach in this phase is a conceptual risk assessment framework to analyze
different contributing causes of misinterpreting a negative pressure test. This framework displays
different influencing factors of NPT misinterpretation in three layers. The bottom layer, which is
called the physical state of system or basic events, includes the system related elements that
affect implementation and interpretation of NPT. The second layer indicates decisions or actions
made by crew or management, which influence results of a conducted NPT directly or indirectly.
Finally, the top level consists of the root organizational factors influencing the decisions or
actions displayed in the middle layer.
In the final step, there is a need for a method that can quantify the developed conceptual
framework in the second phase. Based on the conducted analysis in the literature review chapter
(Please refer to chapter 2 for more information.), a Bayesian Belief Network (BBN) is an
appropriate tool for this purpose. BBNs can model causal and probabilistic relationships in a
graph consisting of nodes and arrows.
Based on this analysis, we chose a Bayesian belief network to quantify our proposed three-layer
conceptual framework in phase 2 and to calculate the probability of a negative pressure test
misinterpretation. However, due to the lack of access privilege to any hard data in the case of our
research, applying BBN for quantifying all the captured human and organizational factors in our
conceptual framework was not practical.
As a result, we proposed a rational decision making model, using the Signal Detection Theory
(SDT) as a foundation, in order to quantify a section of our developed conceptual framework. It
is noteworthy that our proposed model can be categorized as a Bayesian network with both
discrete and continuous variables based on its structure and derived probability formulas. We
also added a decision making component to the model in order to be able to assimilate the
interpretation of a negative pressure test, as the main element that we intend to analyze. In
general, our proposed quantitative model is a combination of a Bayesian approach and a decision
13

making process based on the SDT. It is needed to state that expert judgment elicitation is the
source of data for quantifying the aforementioned rational decision making model.
From a different angle, we propose a model to assess the interoperation of multiple organizations
in complex systems as a bi-product of this dissertation. The combination of this model and our
introduced conceptual risk analysis framework can be used as an integrated approach to analyze
multi-organizational interactions with the focus on ineffective communication. The main reason
for proposing such approach is due to the fact that ineffective communication between
companies and their contractors has been introduced as a major root organizational factor
causing large-scale accidents.
The stated model is a generic framework which analyzes the interoperation and communication
of multiple organizations in four different layers. These four layers from top to bottom are: level
of meta-system interactions, level of bi-lateral organizational interactions, level of bi-lateral
work interactions, and level of work site operations interactions. In the next step, this model has
been applied for risk analysis of multi-organizational interactions in the case of the Deepwater
Horizon.
This model is described in a separate chapter since it is not part of the developed integrated risk
analysis methodology stated in section 1.5; rather it is a proposed model that can be used for the
future analysis of interactions among multiple organizations.

1.6) Dissertation Outline
Chapter 2 of this dissertation reviews the concept of risk assessment and risk management as
well as some of the most important proposed risk analysis methodologies in the literature;
especially in the context of offshore operations.
Chapter 3 introduces the methodology of this research in detail. The summary of the developed
approaches in this dissertation was described in section 1.5.
Chapters 4 and 5 will respectively be the conclusion and some recommendations based on this
dissertation analysis and chapter 6 will be the summary of some of our future work in this area.
Finally, the aforementioned model for assessing the interoperation and interaction of multiple
organizations is introduced in the appendix “A” section.
14

2) Literature Review
2.1) Overview
In the dynamic society in which we live, there are sources of hazards as potential causes of harm
and risks as the possibility of hazards becoming incidents or accidents (MMS final report, 2008).
Risks are product of uncertainties. One way of defining risk is to express it as the likelihood of
loss × the consequence(s) (Bea, 2011a).
According to Rasmussen and Svedung (2000), different accidents and incidents happen because
of the loss of control. Based on this, there is need for some controlling mechanisms, some
approaches to treat uncertainties and manage risk, and some methods to bring safety to
organizations and to the society. We call these approaches risk analysis, risk assessment, or risk
management methods.
In general, risk management utilizes multiple approaches and barriers to address both likelihood
and consequence(s) of failure (Bea, 2011a). There exist different methods of categorization for
the risk management methods in the literature. According to Bea (2002a), there are three general
categories of risk management approaches: 1) proactive; before activities are carried out, 2)
reactive; after activities are carried out, and 3) interactive; during performance of activities.
These risk management approaches are employed to minimize the likelihoods and effects of
malfunctions and/or to increase the proper detection and remediation of those malfunctions.
Figure 2.1 shows a simple but meaningful process for the risk assessment and management
(RAM). It is important to mention that an effective RAM is a continuous improvement process
throughout the life-cycle of a system (Bea, 2011a).
To determine the level of improvement in risk reduction, we must first have a risk assessment
baseline. Once the baseline is established, progress (or lack of it) can be measured periodically
with continuous assessment (MMS final report, 2008).
One important issue in the process of risk analysis is the cost of risk reduction, which increases
with the amount of achieved reduction. As much as we like to reduce risks, we need to pay more
to have more risk reduction. In addition to that, risk is usually impossible to eliminate. So, there
has to be a cut-off point for the risk reduction. In other word, we have to decide on a balance
15

between cost of reducing risk and acceptable risk. This is the principle of ALARP (As Low as
Reasonably Practical) (MMS final report, 2008).

Figure 2.1. RAM (Risk Assessment and Management) process (Bea, 2011a)
Going back to the expression of risk as the combination of likelihood of failure and its
consequence(s), there are three main categories of accidents based on their frequency of
occurrence and their magnitude of loss shown in figure 2.2. These three categories are: frequent,
small scale accidents; major accidents; and large scale accidents (Rasmussen, 1997).
Based on this categorization, accidents such as offshore platform blowouts and oil spills; which
are the main focus of this research, are the ones with low likelihood of occurrence but high level
of severity or magnitude of loss. As a result, the main concentration in this category is preventing
those types of accidents from occurring, and analytical risk assessment methods can be useful for
this purpose.
There are some main characteristics for high-risk systems in which large scale accidents occur.
First, the technology they use changes very rapidly at the operative level (Rasmussen and
Svedung, 2000). Second, they have complex interactions resulting from unfamiliar or unexpected
sequences of events that are often either imperceptible or not immediately comprehensible
16

(Wang, 2008). Third, they are tightly coupled indicating their components are highly
interdependent and tightly linked together (Perrow, 1984). An important aspect of such systems
is that the interactive complexity and coupling in such systems are particularly sensitive to
perturbations (Leveson, 2004 and 2011) where changes in one part of the system rapidly affect
the status of the others, often with disastrous results (Wang, 2008).

Figure 2.2. Hazard source characteristics and risk management strategies (Rasmussen, 1997)
There have been many different developed methods of risk analysis in the offshore operations
and related fields for the purpose of risk reduction and prevention of similar accidents. However,
it is needed to state that many of the developed techniques have concentrated on technical issues
as the contributing causes of accidents while based on our analysis in the introduction, around 80%
of accidents in offshore installations were due to human and organizational factors. According to
Pate-Cornell (1993), those types of accidents happened because of an accumulation of errors and
questionable decisions, which most of them were “rooted in the organization, its structure,
procedures, and culture”.
Moreover, the aforementioned characteristics of systems in which large scale accidents occur
indicate that there is need for cross-disciplinary methodologies considering both technical
problems and human and organizational factors influencing the system status.
17

Based on the description above, the outline for this chapter is as follows. In section 2.2, risk
analysis techniques which mostly consider the technical causes of accidents in offshore platforms
or related fields are presented. Section 2.3 introduces some of the risk assessment models which
are concentrated on human performance and human error analysis. Section 2.4 presents some of
the main risk assessment methodologies which have incorporated human and organizational
factors in addition to technical problems in their analysis. It is needed to state that the description
of each risk analysis methodology includes a brief explanation about that technique, some of its
applications, and its advantages and disadvantages.
Finally, section 2.5 summarizes the results of comparing the stated approaches in previous
sections with each other, points out the existing gap in the literature, and presents the best
potential risk assessment methodology or methodologies that can be developed based upon the
existing models in the literature.

2.2) Technical Risk Analysis Approaches
As stated in the overview of this chapter, the concentration of most of the developed risk analysis
methodologies in the literature of the offshore industry has been on technical problems and
operational contributing factors. Based on this, it is important to have an overview of the existing
risk analysis approaches that have been proposed to consider the technical contributing causes of
offshore accidents.
One of the first steps in the process of risk assessment and risk management, as shown in figure
2.1, is hazard identification. There have been different developed techniques in the literature for
that purpose. Some of those techniques are as follows:
 HAZOP (Hazard and Operability) Study; this technique is a qualitative approach to
identify hazard and operability problems (Vinnem, 2007). The HAZOP method was
initially developed to analyze chemical process systems, and the first guideline for that,
“A Guide to Hazard and Operability Studies” was published by the Chemical Industries
Associations in 1977 (Rausand, 2005). However, this method has been applied into
different industries after its first development.
18

This technique is a systematic way to identify failure modes (Slater and Cox, 1985). In
this method, an interdisciplinary team examines existing processes and operations to
identify possible deviations from the intended design and to evaluate problems that might
represent risks to personnel or equipment (Vennim, 2007 and Rausand, 2005).
This method utilizes the creativity of team members in identifying deviations from the
intended design and in evaluating potential hazards. The results of this study come from
the discussion of a multidisciplinary team in several meetings, which make it more
reliable than the analysis of one expert. However, this technique could be really time
consuming and costly. Moreover, few of team members might dominate the discussion.
This way, the final results of the HAZOP study can be biased or at least, not based on the
opinion of all the team members.
 PHA (Preliminary Hazard Analysis); this is another analytical technique to identify
hazards, which will lead to harmful events if they are not sufficiently prevented from
occurring. Some of the examples of the typical hazardous sources of energy considered
here are high pressure oil and gas, high temperature fluids, explosives, and radioactive
materials.
PHA is usually used to evaluate and identify hazards early in the life-cycle of a project.
The general process for the PHA consists of the following steps:
1) Definition of subsystems and operational modes
2) Identification of hazards associated with each subsystem or operational mode
3) Defining the particular hazardous event that can result from the realization of each
hazard
4) Estimating the probability of the occurrence of each of the events and their possible
consequence(s)
5) Identifying and evaluating the needed actions to reduce the probability of the
hazardous events or limit their consequence(s)
6) Evaluating the interacting impact of different hazardous events and considering the
effects of common mode and common cause of failures
19

The PHA structure is usually presented in a table form, in which the analysis of each of
the identified hazardous events is shown in one of the rows of that table.
As a summary, this method is capable of identifying potential major hazards at the very
early stage of the project development. In addition, it can provide a basis for design
decisions. However, PHA is not a comprehensive method, and it needs to be followed by
a HAZOP study.
 Bow-tie Methodology; this is a process which can be utilized to effectively demonstrate
how a safety management system can be implemented in a facility (Vinnem, 2007). The
Bow-tie method originated separately in Australia and Netherlands in late 1980s, and it
has become popular afterward (Pitblado and Fisher, 2011).
This tool assists companies/operators in analyzing the hazards and risks exposed to their
business or operations through the use of graphics and by connecting hazards to their
possible causes and consequences; figure 2.3.
As it is shown in figure 2.3, the reason for calling this method bow-tie is obvious. Each
hazard, which can result in a top event; e.g. loss or accident, is originated from some
threats or causes. For instance, corrosion or mal-operation could affect the flammable gas
as a hazard and causes loss of containment as a hazardous event. One way to prevent
threats from realizing a hazard and interacting with it is to incorporate some barriers
between each threat and the top event, as illustrated in figure 2.3. Each barrier can be any
type of control like design, technical, procedural, human, or organizational (Pitblado and
Fisher, 2011). Those types of barriers are called prevention controls.
Another way of hazard and risk control is incorporating barriers between the top event
and consequences. Sometimes, accidents prevention is not very easy, but controlling the
consequences of those accidents is more practical. Those types of barriers are called
mitigation controls.

20

Figure 2.3. Bow-tie methodology (Bow-tie image, 2014)

One new technique developed (Pitblado and Fisher, 2011) based on the concept of the
bow-tie methodology is BSCAT (Barrier based-SCAT). This technique analyzes the
performance of each of the barriers separately using the SCAT (Systematic Cause
Analysis Technique) model.
The SCAT analyzes each loss or accident in a step by step procedure (the reverse order of
the loss causation model shown in figure 2.4) until it tracks back to the root cause; the
lack of control specified in figure 2.4.
Inadequate
-- System
-- Standards
-- Compliance
Lack of Control
Personal
Factors
Job/System
Factors
Basic Causes
Unintended
Harm or
Damage
Loss
Event
Incident
Substandard
Acts/Practices
Substandard
Conditions
Immediate
Causes

T
H
R
E
S
H
O
L
D
L
I
M
I
T
Figure 2.4. Loss Causation model (Pitblado and Fisher, 2011)
As stated above, BSCAT looks at one barrier at a time while that is not the case in the
SCAT. Systematic Cause Analysis Technique (SCAT) maps different barriers together
and analyzes them simultaneously which make the analysis more complex. Therefore,
21

applying the BSCAT would be easier (Pitblado and Fisher, 2011). Figure 2.5 displays
both the SCAT and BSCAT conceptual diagrams.
Traditional SCAT BSCAT Method
CONSEQUENCE
e.g. FIRE
Type of Event
Actions to Improve
Recommendations
Basic or Root
Causes
Immediate Causes
Threat Top Event
CONSEQUENCE
e.g. FIRE
Type of Event
Actions to Improve
Recommendations
Basic or Root
Causes
Immediate Causes
Type of Event
Actions to Improve
Recommendations
Basic or Root
Causes
Immediate Causes
Type of Event
Actions to Improve
Recommendations
Basic or Root
Causes
Immediate Causes
Type of Event
Actions to Improve
Recommendations
Basic or Root
Causes
Immediate Causes
Prevention Controls Mitigation Controls
Figure 2.5. SCAT and BSCAT conceptual models (Pitblado and Fisher, 2011)
So far, we described some of the main hazard identification techniques. Referring to figure 2.1,
risk analysis and risk evaluation are next steps in the process of risk assessment and management.
There have been different developed methodologies in the literature for this purpose as well.
Most of the risk analysis methodologies described in this section are quantitative, which are
called Quantitative Risk Assessment (QRA) techniques. The use of QRA studies in the offshore
industry dates back to the second half of the 1970s (Vinnem, 2007). Those methodologies and
data were mainly the adaptation of what had been developed and used for few years in the
nuclear industry (Vinnem, 2007).
The next step in development of QRA techniques happened in 1981 when the Norwegian
Petroleum Directorate issued some guidelines for the safety evaluation of platform conceptual
22

design (Vinnem, 2007). Based on those regulations, all new offshore installations needed to carry
out QRA in their conceptual design phase.
For many years, Norway was the only country applying QRA methods systematically. Around
1990; more than 10 years after the systematic development of QRA methods in Norway, the UK
started introducing QRA in its legislations. This happened after the Piper Alpha accident in the
North Sea in 1988 and through the recommendation of the Lord Cullen for development of such
methodologies for risk assessment (Vinnem, 2007).
In 1992, the safety regulations came into force in the UK, and since then, the offshore industry in
the UK has been required to perform risk assessment and apply QRA methods for both existing
and new installations as part of safety (Vinnem, 2007).
With all the above analyses, some of the well-known risk analysis approaches are as follows:
 Fault Tree Analysis (FTA); this method has been used extensively in probabilistic risk
analysis. Fault tree is presented in a graphical; tree network, form for both qualitative and
quantitative risk assessment (Rathnayaka, 2011).
This approach provides a systematic description of the combinations of possible
occurrences in a system which can result in an identified, undesirable outcome (Vinnem,
2007). FTA has a top-down representation with a possible accident or undesirable
outcome on top. It then propagates downward to basic events at the bottom of the tree
(Rathnayaka, 2011). This technique utilizes logic gates (AND/OR) to define the
interaction between modes. In another word, those logic gates indicate the type of
interaction between different events in causing the occurrence of the top event. Figure 2.6
displays an example of a simple fault tree structure.
As stated above, fault tree approach is capable of both qualitative and quantitative risk
analysis. One can calculate the probability of the top event by knowing the probability of
basic events at the bottom of the tree. In addition, its graphical representation makes it
easy to read and understand. However, the fault tree analysis can get complex and time
consuming to solve if the number of components in the tree grows. Moreover, its
quantitative analysis needs to be properly performed, and sometimes, accessing
appropriate quantitative data is not easy.
23

Figure 2.6. Example of a fault tree structure (fault tree image, 2014)
 Event Tree Analysis (ETA); this is another form of logic diagram, which is somehow
the reverse of the fault tree. It starts from an initiating event and explores all possible
outcomes that can be caused by that (Slater and Cox, 1985). Therefore, an event tree can
show all possible scenarios. Then, the probability of occurrence of each scenario can be
calculated by knowing the probability values for each of the branches.
As figure 2.7 shows, an event tree can demonstrate paths by which consequences occur.
In addition, it indicates how various safety barriers or safety functions could prevent or
mitigate the event sequence. We can see that the combination of failure or success of
each safety barrier/function could result into a specific event sequence (Rathnayaka,
2011).

Figure 2.7. Example of an event tree (Event tree image, 2014)
24

Similar to the fault tree, the event tree could be utilized for both qualitative and
quantitative risk analysis. This method can be used as a basis for decision making based
on the risk estimation that it provides. However, ETA has similar drawbacks to the fault
tree, which can become complex and time consuming to apply. Data gathering for the
quantitative analysis is another drawback for this technique.
 Failure Mode and Effect Analysis (FMEA); the objective of this technique is to
systematically identify all possible failure modes and their associated
consequences/effects on a technical system (Slater and Cox, 1985). FMEA analyzes the
underlying components of a system to eliminate or reduce the failure or mitigate the
failure effects. This method is a simple technique which does not require extensive
theoretical description. However, FMEA needs to be performed by some specialists or
experts who have broad knowledge about the system and its components (Vinnem, 2007).
Therefore, FMEA can be useful to assist in designing a technical system with a higher
level of reliability. In addition to that, it can be implemented to eliminate or minimize
failure possibilities or their consequences. However, applying this technique can be very
time consuming, and it needs specialist skills from different backgrounds for having
maximum efficiency.
 Bayesian Network (BN); this method, which is called Bayesian Belief Network (BBN)
as well, was developed around 1985 through the seminal work of Judea Pearl. This
approach has been recognized as modeling and inference tool for problems with high
degree of uncertainty (Pearl, 1988). The BN method is a graphical tool to represent the
interaction between variables and to model and analyze the involved uncertainty (Kazemi,
2011). This method handles probabilistic relations in a rigorous, yet simple and efficient
way (Mohaghegh, Kazemi, and Mosleh, 2009).
Each Bayesian network consists of a set of nodes representing variables and a set of arcs
indicating the probabilistic relationship among those variables (Mohaghegh et al., 2009).
When two nodes are not connected in a Bayesian network, it means that those two
variables are independent from each other (Kazemi, 2011). Figure 2.8 illustrates a very
simple example of a Bayesian network.
25

Figure 2.8. A Bayesian network example
While the arrangement of nodes and arcs in a Bayesian network can be useful for
qualitative analysis of the system represented by that network, the same BN can be
applied as a quantitative tool as well if the conditional probabilities defining relationships
between nodes are determined for the system.
The probabilities of variables in each BN can be updated upon the availability of new
data. New data in a system can become available in different ways; for instance, by
conducting new observations or by having changes in the situation of that system
(Rathnayaka, 2011).
In addition, BNs are very effective in modeling situations where data are uncertain and
vague, or even for cases that data are incomplete or partially available (Kazemi, 2011).
However, the data gathering for a Bayesian network can become quite complex when the
network grows and there exist many arcs in the network.
There have been many applications for BNs in different fields; for instance, BNs have
been used for medical diagnosis, structural system reliability assessment, and decision
making strategies (Rathnayaka, 2011).
Bayesian networks have had applications in the maritime and offshore industry as well.
One of those examples (Eleye-Datubo, Wall, Saajedi, and Wang, 2006) is applying the
Bayesian network as a decision support solution for a marine evacuation. Another
example is the application of Bayesian networks in risk analysis of bulk carriers with the
possibility of sinking (Psarros and Vassalos, 2010).

Cloudy

Wet grass

Rain

Sprinkler
26

 HCL (Hybrid Causal Logic); this is a newly introduced approach by Mosleh, Eghbali,
and Fazen (2004) to the literature with the application in the aviation industry. However,
HCL has been utilized in the offshore industry as well. Some of the studies in the
offshore literature have used HCL for the risk analysis of technical contributing causes of
accidents while some other applied this methodology as a tool to analyze human and
organizational factors contributing to offshore accidents.
Hybrid causal logic usually consists of three phases: 1) developing the event tree, 2)
developing a fault tree, and 3) developing a Bayesian network (Wang, Xie, Habibullah,
and Ng, 2011). The first phase helps with identifying possible risk scenarios based on the
aforementioned explanation of an event tree. The fault tree development phase is used to
identify the contributing factors causing the basic events or the initiating event. Finally,
the Bayesian network provides more precise quantitative connections between the
identified risk factors in the second phase (Wang, Xie, Habibullah, and Ng, 2011). Figure
2.9 illustrates a general framework for a HCL.

Figure 2.9. HCL framework (Roed, 2009)

27

This proposed methodology has been demonstrated by Wang, Xie, Habibullah, and Ng
(2011) in a study of a fire hazard on an offshore production facility. However, a fault tree
has been replaced with a fuzzy fault tree in the second phase due to the higher flexibility
of the fuzzy logic in uncertain issues. This study has considered only the technical factors
contributing to that fire hazard case. In another similar study with Wang, Xie, Ng, and
Meng (2011), the authors utilized a similar type method for an offshore fire hazard case
study. However, in that paper, they mapped their developed fuzzy fault tree into a
Bayesian network rather than developing a BN for some part of the proposed fuzzy fault
tree.
In summary, the hybrid causal logic is a multi-phase methodology, which provides a
combination of different risk assessment techniques for analysis of system components.
This method starts from a top level initiating event, analyzes all related risk scenarios,
and propagates downward into the contributing factors of the final failure. This means
that HCL is a comprehensive method for risk analysis. However, quantitative
development of each of the phases in this methodology requires considerable amount of
data, which is not easy to access for all hazard or accident investigations.
This section of chapter 2 was a summary of some of the main developed risk analysis
methodologies in the literature, which have had some applications in the offshore industry as
well. However, based on the stated analysis in the overview section, human and organizational
factors comprise a considerable percentage of contributing causes of accidents in the offshore
industry. As a result, there is need to review the main proposed methodologies in the literature
which have incorporated HOFs in their analyses. Based on this need, section 2.3 is assigned to
introducing some risk analysis techniques taking into account the human performance and
human error. After that, section 2.4 describes some of the risk assessment methods considering
human and organizational factors together, in addition to technical issues, as the contributing
causes of accidents.

28

2.3) Human Factors in Risk Analysis
Analysis of accidents in different industries; not only in the offshore operations, indicates that
human factors have been one of the main contributing causes of those accidents. Therefore,
Human Factors Analysis (HFA) is an important element in risk assessment of different accidents.
There have been different developed human factors analysis techniques in the literature. One of
the main models of HFA; figure 2.10, shows four of the human factors analysis approaches and
their relationship with each other.

Figure 2.10. Relationship between the four human factors analysis approaches (Kirwan, 1996)
The four HFA methods indicated in figure 2.10 are:
1) Human factors design database
2) Task analysis methods
3) Human Error Analysis (HEA)
4) Human Reliability Assessment (HRA)
As shown in figure 2.10, human factors theory feeds into all four areas. In addition, there is a
logical progression from human factors design database to HRA in terms of becoming more
quantitative-oriented. At the same time, there is a move from the reliance on the application of
hard data to more analytical methods (Kirwan, 1994).
29

We can see that human reliability assessment is one of the main methods in identifying errors
and failures caused by human factors. Based on this, studying a HRA process can be helpful in
understanding the whole process of human factors analysis. Figure 2.11 demonstrates the HRA
process.

Figure 2.11. The HRA process (Kirwan, 1996)
The first step in the HRA process, as shown in figure 2.11, is problem definition. The next step
in this process is data collection. There are different techniques for this purpose such as
observations, interviews, activity sampling, and verbal protocols. Problem representation is an
important step helping in task analysis and in figuring out whether or not there is any need for
human error analysis. At this stage, the human reliability assessment can come into play if there
are some noticeable human errors. Some of the HRA techniques can be helpful through
estimating Human Error Probabilities (HEPs). The following step is comparing the predicted
performance with some pre-set criteria or with the human performance guidelines. Finally, the
30

level of acceptance of the human performance based on the comparison in the previous step is
identified, and then analysts either accept and document this or revise and re-evaluate it.
As stated before, HRA consists of different qualitative and quantitative techniques for
identification and analysis of key tasks and human error in a system. Some of the main HRA
approaches that may be used in the assessment of offshore activities are as follows:
 THERP (Technique for Human Error Rate Prediction); this technique was developed
by Swain and Guttmann of the Sandia National Laboratories in 1983 for the US Nuclear
Regulatory Commission (Martins and Maturana, 2009). Then, it became a method
employed mostly in quantitative HRA. THERP allows quantitative human reliability
assessment by employing database of human error probabilities, which are based on field
experience or expert judgment (EQE International, 1995).
Besides that, event trees can be applied to represent the relation of causes and
consequences and propagation of errors in the system. Thereafter, it is possible to
determine the probable occurrences of accident scenarios (Martins and Maturana, 2010).
This method has been used in many industrial applications including offshore operations.
As an example, this methodology has been applied in a ship operating in the Brazilian
coast to isolate human actions in order to reduce the risk of an accident.
The THERP includes 5 major steps, which are: (Martins and Maturana, 2010)
1) System failure definition; identifying all the sub-systems that can be influenced by
human factors
2) Listing and examining human actions which are related to the system operation;
preparing a list of tasks and analyzing the influence of all human related operations
on each task
3) Estimating the probability of the important errors; determining the probability of
human error for those identified human related operations in the previous step
The THERP uses Performance Shaping Factors (PSFs) to define the value of human
error probabilities for each task. PSFs represent the factors, which affect each of the
tasks in the operational level.
31

It is needed to state that there has been a recent study by Groth and Mosleh (2012)
regarding the introduction of a framework as a governing tool for creation,
definition, and usage of performance shaping factors. In addition, these authors
introduced a hierarchical set of PSFs that can be used for both qualitative and
quantitative human reliability assessment.
4) Estimation of human error effects on the system failure events; determining human
error effects and integrating them into event trees (those probabilities can even be
integrated into fault tree analysis.)
5) RCO (Risk Control Options); recommending alternation in the system and
estimating the failure probabilities of the modified system
The following are some of the advantages and disadvantages of the THERP according to
the literature:
Advantages: (Martins and Maturana, 2009 and 2010)
 It is a good tool to compare relative risks.
 It forces analysts to obtain a thorough knowledge about the system and potential
human errors due to its required level of detail.
 It can be used with fault trees for a formal safety assessment.
 There is a possibility of new data insertion in the database and updating the
calculated human error probabilities.
 It allows consideration of error recovery.
Disadvantages:
 The prediction of human error is difficult due to lack of data in many situations
and also because of the dependability of human performance on many
components, which are different case by case (EQE International, 1995 and
Martins and Maturana, 2009).
 It is not appropriate for evaluating cognitive errors (EQE International, 1995).
32

 Some of the factors like humor, courage, and personality as human beings’
characteristics cannot be modeled in this technique (Martins and Maturana, 2009).
 The complete application of the THERP requires intensive level of resources
(Martins and Maturana, 2009).
 HEART (Human Error Assessment and Reduction Technique); this method was
developed in 1986 by Williams (Martins and Maturana, 2009) to generate human error
probabilities for probabilistic risk assessment at the design stage of a project (EQE
International, 1995).
In general, HEART involves the classification of tasks into groups with an associated
nominal HEP for each group. The final probability of human failure in performing each
task is obtained by multiplying that nominal HEP to some factors known as EPCs (Error
Producing Conditions) to consider the scenario in which the action develops (Martins and
Maturana, 2009). Those factors are well defined and specific which makes them easy to
measure.
This technique works based on a database of human error probabilities obtained from the
mixture of expert judgment and data from the ergonomics and psychology literature
(EQE International, 1995).
Some of the advantages and disadvantages of the HEART are as follows:
Advantages:
 It is implemented rapidly and clearly. As a result, it requires limited resources
(EQE International, 1995 and Martins and Maturana, 2009).
 It provides an immediate link between ergonomic factors and design features of
the system (Martins and Maturana, 2009).
 It allows cost-benefit analysis (Martins and Maturana, 2009).
 It is highly flexible and it can be applied in a wide range of areas (Martins and
Maturana, 2009).
Disadvantages: (Martins and Maturana, 2009)
 There is no fully validation of the data that is utilized for determination of EPCs.
33

 It is dependent on the opinion of specialists, so it can be really subjective.
 The interdependence of EPCs is not modeled in this technique.
 Human HAZOP (Hazard and Operability) Study; this method is the adapted classic
HAZOP to identify human failure potentials due to deviation from a design intent.
Human HAZOP technique systematically considers deviations from a set of keywords at
each stage of a task model, deviations from documented procedures, or deviations from a
work program (EQE International, 1995).
The advantages and disadvantages of human HAZOP technique are similar to what we
stated for the classic HAZOP.
 SHERPA (Systematic Human Error Reduction and Prediction Approach); this
technique was developed by Embrey in 1986 as a human error prediction technique
which also analyzes tasks and identifies potential solutions to errors in a structured
manner (Stanton, 2004).
SHERPA works rather like the human HAZOP technique (Maguire, 2005). This
approach is a structured question-answer routine and it is available in the form of a
computer program (EQE International, 1995).
In this approach, each task is classified into one of five basic types (checking, selection,
action, communication, and information retrieval). Each of the aforementioned types of
tasks includes some pre-defined list of errors. As a result of that, it is possible to assess
likelihood and criticality of each recognized error in each category (Maguire, 2005). At
last, there is a remedy analysis to determine whether errors can be recovered or whether
there is any strategy for error reduction (Stanton, 2004).
The following is some of the advantages and disadvantages of this method:
Advantages: (Stanton, 2004)
 It is a structured and comprehensive procedure.
 Existing taxonomies in this method prompts analysts for determining potential
errors.
 It Encourages validity and reliability of data.
34

 In addition to predicting errors, it offers error reduction strategies as part of the
analysis.
Disadvantages: (Stanton, 2004)
 It can be tedious and time consuming for complex tasks.
 It does not model cognitive components of error mechanisms.
 APJ (Absolute Probability Judgment); this is the most direct technique for quantifying
human error probabilities. It is the simple use of engineering judgment to predict a HEP
for a given action. There exist several methods to integrate the judgment inputs from
different experts into a single value (EQE International, 1995).
This approach has been applied to many industrial cases including the offshore operations.
APJ can be combined with other techniques like the THERP to create a more complete
framework for human reliability analysis.
Here are some advantages and disadvantage for APJ as follows:
Advantages:
 It is relatively quick and straightforward to employ.
 It can be applied in any industry.
 It uses the combination of different expert judgments, which gives it more
credibility.
Disadvantages
 It is subjective since it works based on expert judgment.
 The probabilities are prone to certain biases and group conflicts.
The aforementioned approaches are just some of the numerous human reliability assessment
techniques developed in the literature of human factors analysis. All those studies emphasize on
considering the role of human factors and human error in the involved operations of each
industry. Many of the human reliability assessment methods have been proposed in the context
of nuclear industry. However, some of those techniques like the THERP and APJ have been used
in different offshore operations applications as well.
35

It is needed to mention that although HRA can be fed into a QRA (Quantitative Risk Assessment)
or a PSA (Probabilistic Safety Assessment), considering humans an individuals and analyzing
their performance is not realistic enough. Operators are part of organizations with different
management styles, procedural structures, and cultures. Those elements, which are called
organizational factors, influence human performance and human error level. Hence, there is need
for a broader perspective to analyze human and organizational factors together. This issue is the
subject of the next section; 2.4, in this chapter.

2.4) Human and Organizational Factors in Risk Analysis
This section introduces some of the main risk analysis methodologies which have considered
human and organizational factors; in addition to technical issues, as contributing causes of
incidents/accidents. Most of those techniques have had applications in different industries
including the offshore operations. It is needed to state that the development of such
methodologies in offshore operations dates back almost 20 years (Aven et al., 2006).
Some of the main risk analysis approaches considering HOFs are as follows:
 QMAS (Quality Management Assessment System) and SYRAS (System Risk
Assessment Software); Bea (2000) introduced two techniques for the reliability of
offshore structures. One of these two approaches is QMAS. This method is a qualitative
process, which guides assessment teams in examining the important parts of offshore
structure systems at different times during their life-cycle. The second tool; SYRAS, is a
QRA method to develop quantitative results that are often required by engineers and
managers.
In addition, Bea (2000 and 2002b) proposed a model to link the two aforementioned
approaches together. It has been proven that the combination of those qualitative and
quantitative methods can be a very powerful way to consider different factors and
influences that cannot be well addressed in traditional QRA methods (Bea, 2000). This
advantage comes from the power of QMAS to define the PSFs addressing the influence
of human and organizational factors and other important affecting components in the
model. Then, the probabilities associated with system failure; which are used in the
36

SYRAS method, are updated by incorporating those PSFs through linking the QMAS and
the SYRAS.
The QMAS addresses seven major components of each system. These seven components
are:
1) Operators
2) Organizations
3) Procedures
4) Structure
5) Hardware or equipment
6) Environment
7) Interfaces
Each of the aforementioned components has its associated factors and attributes. Those
factors and attributes originate from the hierarchical breakdown for each of the
components (Bea, 2002b). Figure 2.12 displays the stated hierarchy with the
aforementioned components on the top level, the associated factors for one of the
components; operators in this figure, in the middle, and the attributes of one of the factors;
communications as an example in this figure, in the bottom level.

Figure 2.12. QMAS three-level process to evaluate components, factors, and attributes (Bea, 2000)
37

QMAS has an evaluation process based on a 1-7 scale to grade the attributes first and
then the factors and components based on that. There exists a three-point estimate; the
most likely, the best, and the worst, for the grade assignment to each of the attributes, as
shown in figure 2.13. This system of grade estimation is appropriate for expressing
uncertainty associated with the grading (Bea, 2000).
The grades for attributes are summed and then divided by the number of attributes used
in the model to develop a resultant grade for each associated factor. After calculating the
grades for all the factors, the components grades are determined based on a similar
explained averaging process. Figure 2.12 helps in determining the affecting attributes of
each factor and the influential factors of each component. In this system, components
with a grade higher than four are candidates for mitigation.

Figure 2.13. QMAS grading scale (Bea, 2000)
The second approach; SYRAS, deals with assessing system failure probabilities as a
quantitative method. The probability of failure is assessed in each of the four life-cycle
phases; design, construction, operation, and maintenance (Bea, 2000). There are four
factors; serviceability (i=1), safety (i=2), durability (i=3), and compatibility (i=4), as the
desirable quality factors for each phase to evaluate the probability of failure based on
them. In this case, P(F
i
); the probability of failure in developing the desirable quality of
type (i), would be:
) ( ) (
i i i
C D P F P   (2.1)
38

Where D
i
is the demand placed on the system and C
i
is the ability or capacity of the
system to meet or satisfy the demand.
The next probability decomposition is based on two sets of causes: intrinsic and extrinsic.
The intrinsic factors include extreme environmental conditions and other natural
uncertainties while the extrinsic causes are related to human and organizational factors,
which have been identified here as human error (Bea, 2000). Based on this
decomposition, equation (2.1) transfers into:
) ( ) (
SiE SiI Si
F F P F P   (2.2)
By using the conditional probability based on P(E
Si
), as the human error probability,
equation (2.2) gets extended into:
) ( * ) | ( ) ( * ) | ( ) ( * ) | ( ) (
Si Si SiE Si Si SiI Si Si SiI Si
E P E F P E P E F P E P E F P F P      (2.3)
Where:
) ( 1 ) (
Si Si
E P E P    , as the probability of no human error
Each of the above probabilities could be decomposed based on different life-cycle phases;
index (j), activities in each phase; index (k), and human error type; index (m). Equation
(2.4) shows all the stated decompositions:
) ( ) | ( ) (
8
1
Sijkm Sijkm SiEjk
m
SiEjk
E P E F P F P


 (2.4)
The base rate for the human errors of type “m”; P(E
Sijkm
), could be determined based on
the published values for the human task performance reliability shown in figure 2.14.
The last step is considering the performance shaping factors defined by the QMAS to
modify the base rates of human errors in order to recognize the effects of organizations,
structure, equipment, procedures, environment, and interfaces (equation (2.5)).
1 * ) ( ) (   
 jkm jkm jkm
PSF E P E P  (2.5)
39

Figure 2.14. Nominal human task performance reliability (Bea, 2002b)
At this stage, the QMAS and the SYRAS connect together by using the mean value
) (
jkm
G

and the coefficient of variation
) (
) (
jkm
G
V

for the grade in each QMAS category
(equation (2.6)).

) 4 ( ) (  
jkm
G PSF Log
jkm 

(2.6)

) (
jkm
G

values can be extracted from figure 2.15.
As stated before, the combination of the QMAS and the SYRAS is a powerful tool for
risk analysis of offshore structures. However, when it comes to the quantitative section of
this methodology, accessing all the needed prior and conditional probabilities indicated in
equation (2.5) will be costly, time consuming, and sometimes impractical. It is needed to
state that the utilized base rates in figure 2.14 for human errors might not be applicable
for analyzing other cases and applications since each situation has its own specific
elements, which might not be generalizable.
40

Figure 2.15. QMAS qualitative grading translation to quantitative PSF used in SYRAS (Bea, 2002b)
 SAM (System-Action-Management) approach; this approach has been introduced by
Pate-Cornell and Murphy (1996) for the risk analysis of accident scenarios. However, the
concept of this framework has been used before by Pate-Cornell (1993).
Pate-Cornell (1990 and 1993) states that accidents happen because of an accumulation of
errors and questionable decisions, which most of them were rooted in the organization, its
structure, procedures, and culture. This idea is the basis for the SAM framework, which
has been conceptually shown in figure 2.16. The hierarchy in figure 2.16 consists of three
levels: system in the bottom, decisions in the middle, and organizational level on top.
And, the reason for calling this framework SAM (System-Action-Management) is due to
having the three aforementioned layers.
The bottom level in the SAM framework comprises the basic events. System failure is
one of the main basic events. Some of the examples of this can be fire and explosion in
an offshore platform, loss of life, system damage, or loss of system control.
The middle level includes the decisions or actions made by the involved people in each
case. Those decisions influence the occurrence of the basic events in the third layer of the
model. On the other hand, those decisions have been affected by some organizational
41

factors which have root in the organization, its culture, and its management system.
Those organizational factors constitute the top level of the SAM framework.

Figure 2.16. Hierarchy of root causes of system failure (Pate-Cornell, 1993)

The SAM approach has been used in different applications. Pate-Cornell (1993) utilized
this methodology to analyze the contributing causes of the Piper Alpha accident. This
accident occurred in an offshore production platform in July 1988, which caused 167
deaths and billions of dollars of damage. In addition, the SAM framework has been used
in the analysis of the Challenger accident as a tool to develop risk-based priorities for the
maintenance of tiles in the space shuttle orbiter (Pate-Cornell and Fischbeck, 1993).
Moreover, this approach has been used for the risk analysis of anesthesia patient safety
(Pate-Cornell and Murphy, 1996) and the risk assessment of hazardous materials
transport (Murphy and Pate-Cornell, 1996).
This methodology is a great framework to model a system failure by considering
supporting human and organizational factors influencing the situation of system
components. However, quantification of this model includes similar challenges that any
other quantitative methodology would have, which is data gathering and access to data.
 BBN (Bayesian Belief Network); this methodology has been explained in section 2.2 as
a technical risk analysis technique. However, this can be used for incorporating human
and organizational factors in risk analysis as well.
Since the Bayesian network has been described in another section before, only some of
the applications of it are explained in this section. In a very recent study, Bayesian
network has been applied for risk and reliability assessment of subsea Blowout
Preventers (BOPs) (Cai et al., 2012a, 2012b, and 2013).This study considers the role of

Organizational Level
Decisions/Actions Level
Basic Events
42

both human and organizational factors as contributing causes of subsea BOP
malfunctions.
Another application of the BN methodology is operational risk analysis of LNG loading
(Chin et al., 2010). This study presents a risk assessment framework using a Bayesian
network in order to analyze the causes of different technical failures in the system with
consideration of human performance errors and the root organizational factors
influencing the operations. This paper integrates different possible losses in the system of
LNG loading by aggregating their values into a single monetary measure. This helps in
the BN utilization by identifying the most likely configuration that generates a specific
unwanted event (Chin, Hansen, and Saetren, 2010).
Ren, Wang, Jenkinson, Xu, and Yang (2007) apply BN for the risk analysis of collision
between a Floating Production, Storage, and Offloading (FPSO) unit and authorized
vessels. However, the developed model in this paper only considers the human elements
as influencing factors to the collision, and there is no statement of organizational factors
as affecting elements.
The utilized Bayesian network in the above study is a fuzzy version. The authors of that
study believe that applying fuzzy functions can make the model more flexible. In other
word, fuzzy functions are better fits for available uncertain knowledge caused due to
randomness, vagueness, or ignorance (Ren et al., 2007).
Ren, Jenkinson, Wang, Xu, and Yang (2009) have similar study for the risk of collision
between a FPSO and the authorized vessels due to human errors. The authors utilize the
fuzzy BN again to model the risk factors as possible causes of accidents in offshore
operations.
Additionally, Ren, Jenkinson, Wang, Xu, and Yang (2008) utilize Bayesian networks to
model the contribution of human and organizational factors in the aforementioned
application of collisions between a FPSO and authorized vessels.
The last study that we mention in this section is applying fuzzy Bayesian network for
marine and offshore safety assessment (Eleye-Datubo et al., 2008). This paper
incorporates human and organizational factors into the model by introducing some
43

performance shaping factors, which affect the human performance. It is needed to state
that the whole BN model proposed in the paper is not fuzzy. The only fuzzy section is the
human performance part affected by the performance shaping factors. The reason for that
is the high uncertainty existing in the nature of operations related to human and
organizations.
In summary, we could see that Bayesian networks have been applied in many different
cases and studies. The BN methodology has a great way of representing problems
graphically, which makes it easier to understand. It can capture the causal and
probabilistic relationships between the elements of a system. It also has the ability to
analyze modeled problems both qualitatively and quantitatively. On the other hand,
accessing all necessary data and conditional probabilities for Bayesian networks;
especially big models, is not easy. Of course, this is a drawback for all quantitative
methodologies. However, there have been several techniques, such as parent divorcing,
proposed in the literature for reducing the number of needed conditional probabilities in a
Bayesian network.
 BORA (Barrier and Operational Risk Analysis); this methodology is a fairly new
technique for qualitative and quantitative analyses of risk scenarios. The BORA
technique has been outlined by Vinnem, Aven, Hauge, Seljelid, and Veire (2004) as a
methodology for failure analysis of operational barriers. It considers the effect of human
and organizational factors by introducing some Risk Influencing Factors (RIFs) in the
model, which affect the performance of barriers (Aven et al., 2006).
The main steps in implementing the BORA methodology are as follows (Sklet, Vinnem,
and Aven, 2005). These steps have been shown in figure 2.17 as well.
1) Development of a basic risk model; this risk model includes utilizing the barrier
block diagrams, event trees, and fault trees. A barrier block diagram similar to an
event tree; as described in section 2.2, displays paths by which consequences
occur. It also shows the role of barriers to prevent some of the event sequences.
The failure analysis of each of the event scenarios in a barrier block diagram or an
event tree can be implemented using a fault tree.
44

2) Assignment of industry average frequencies/probabilities for the initiating events
and the basic events; first, there is a need for assigning the industry average
probabilities to all the identified initiating events in the event trees and the basic
events in the fault trees. Those average values can be extracted from the generic
databases or can be determined using expert judgment.
3) Identification of Risk Influencing Factors (RIFs); those RIFs incorporate the
effect of human and organizational factors influencing the status of a system.
4) Assessment of RIFs and quantifying them; quantification of RIFs is based on
classifying them, scoring each category, and quantifying their importance by
assigning weights to each class.
5) Updating the industry average frequencies/probabilities by incorporating the RIF
scores calculated in step 4
6) Calculating any specific risk by considering the effect of all the technical issues
and the human and organizational factors identified in previous steps
BORA has been mainly used as a tool in the operational phase of the offshore
installations in order to analyze the barriers performance, which prevents hydrocarbon
release (Aven et al., 2006). For instance, Sklet et al. (2006) apply this methodology to
express the hydrocarbon release frequency of three different scenarios in an offshore oil
and gas production platform. These three scenarios are: hydrocarbon release due to
valve(s) being in wrong positions after flowline inspection, hydrocarbon release due to
incorrect fitting of flanges or bolts during flowline inspection, and hydrocarbon release
due to internal corrosion.
As stated above, BORA provides both qualitative and quantitative capabilities. In
addition, it has the advantage of presenting the big picture of each case as a whole in the
first step, which is really helpful for understanding the existing interactions in a system.
However, there are some drawbacks for the BORA methodology as well. First of all, it
needs data access like other quantitative methods, which can be challenging to provide.
Moreover, as stated above, this method shows each scenario as a linear sequence of
45

events and barriers to prevent the unwanted ones. In addition, illustrating all the
sequential events in a system; especially a complex system, is not possible all the times.

Figure 2.17. Summary of main steps of the BORA methodology (Vinnem, 2007)
 I-Risk; this is an integrated risk analysis methodology for hazardous installations. I-Risk
considers both technical and management risk level measures (Papazoglou et al., 2003).
This method consists of three main components: the technical model, the management
model, and their interface. Figure 2.18 shows the overall structure of the I-Risk
methodology.
The technical model includes developing a Master Logic Diagram (MLD), which is
similar to a fault tree. However, it does not get quantified like a fault tree. The goal of a
MLD is identifying the immediate causes of Loss of Containment (LOC) (Papazoglou et
al., 2003). The master logic diagram is followed by the development of an event tree
and/or a fault tree in order to quantitatively analyze the identified causes of LOC.
46

Figure 2.18. Overall structure of the I-Risk model (Papazoglou et al., 2003)
The Management model comprises some tasks that must be carried out systematically in
the main business functions like operations and maintenance (Papazoglou et al., 2003). In
47

addition, there are some management audits in order to quantify the stated management
tasks.
Finally, the management-technical interface modifies some of the parameters of the
technical model in order to incorporate the management issues identified before in the
overall risk analysis model.
One of the applications of the I-Risk methodology has been for the risk analysis of the
loss of containment in chemical installations. As a specific case study, Papazoglou et al.
(2003) utilize the I-Risk technique to analyze the risk of the loss of containment in an
ammonia storage facility.
In summary, we can see that the I-Risk method enables users to incorporate the
managerial aspects in the risk analysis of the studied system. Moreover, it provides both
qualitative and quantitative tools for the sake of risk assessment. However, besides the
difficulty of quantification, the analysis of the management model is quite challenging as
well. This is due to the need for having an audit team to be able to identify management
tasks and quantify them. This process can be time consuming, costly, and even hard to
manage due to the interaction of different people in the audit team.
 HCL (Hybrid Causal Logic); this methodology has been introduced in the technical risk
analysis section. As stated in section 2.2, HCL in general consists of three consecutive
phases: 1) event tree development to identify possible risk scenarios, 2) fault tree
development to determine contributing causes of failure in a system, and 3) Bayesian
network development to quantify the identified causal and probabilistic relationships
more precisely.
The hybrid causal logic approach is also able to analyze human and organizational factors
contributions in addition to the technical issues contributing to accidents. The HCL has
been used for different applications. Analysis of accidents in the aviation industry is one
of the main applications of HCL. For instance, Groth, Wan, and Mosleh (2010)
developed a software platform based on the concept of three phases of HCL to analyze
the risk of an aviation accident, which was aircraft taking off from the wrong runway.
48

Roed, Mosleh, Vinnem, and Aven (2009) propose the use of HCL in offshore risk
analysis. In this paper, the authors introduce some techniques for estimating the
conditional probabilities in the Bayesian network based on the relationship between the
nodes in the model and also based on the similarity of nodes from their direct
predecessors or parent nodes.
Another application of HCL is in risk analysis of collisions due to human errors (Martins
and Maturana, 2009). However, the methodology applied in that paper is slightly
different from the explained HCL in this section. Martins and Maturana (2009) apply
some human reliability analysis techniques like THERP and HEART; which were
explained in section 2.3, to identify the performance shaping factors originated from
human performance. The authors then incorporate the identified PSFs into their risk
analysis procedure using a fault tree. They finally map their developed fault tree into a
Bayesian network believing that a BN can illustrate uncertainties and probabilistic
relationships in a more appropriate way.
The final analyzed study in this section is the application of a methodology; which
somehow can be called HCL, in the maritime transportation system for the risk analysis
of a collision in open sea. Trucco, Cango, Ruggeri, and Grande (2008) introduce a hybrid
methodology consisting of the combination of a fault tree and a BN to model both the
technical and organizational contributing causes of collisions in the maritime
transportation. This paper assigns the fault tree development for analyzing the technical
issues. Then, it utilizes the BN for the analysis of the involved human and organizational
factors based on the outcome of the fault tree analysis in the previous step. The authors
perform a sensitivity analysis at the end in order to identify the configurations that can
lead to significant reduction in the accident probability.
In the previous sections of this chapter, we introduced some of the main risk assessment
approaches analyzing different contributing causes of accidents. In the next section, those
explained methods will be compared with each other in order to identify the existing gap in the
literature in this regard and to introduce some potential risk analysis methodologies for
improving the existing situation.

49

2.5) Evolution of Research Methodology and Summary of Comparisons
The main intention of this section is to present a summary of the techniques explained in the
previous sections, and by comparing them, point out the gap in the literature for the existence of
enough risk analysis methodologies that can be applied in offshore operations; especially
offshore drilling, with the consideration of human and organizational factors.
As explained in the previous sections, the formal use of risk analysis techniques in the offshore
industry has started since 1970s/1980s. The first risk assessment methods have been introduced
and applied only in Norway for one or two decades. Then, they got expanded in other countries
as well.
Most of the developed frameworks for the risk assessment of offshore operations are focused on
the analysis of technical issues contributing to incidents/accidents in this industry. Being more
precise, the development of risk analysis methodologies considering human and organizational
factors dates back just to the last 20 years; which is fairly recent in comparison with the history
of offshore oil production and even comparing to the history of development of quantitative risk
analysis approaches. Even within these 20 years, those models have not become an integrated
part of the risk analysis system in the offshore industry (Aven et al., 2006 and Skogdalen and
Vinnem, 2011).
In addition, over the past twenty years, several regulators and industry bodies such as American
Bureau of Shipping (ABS), the UK’s Health and Safety Executive (HSE), and Norway’s
Petroleum Safety Authority (PSA) have developed guidelines and documents for Human Factors
Engineering (HFE) in the design and operation of oil and gas projects (Robb and Miller, 2012).
However, despite the existence of those documents and guidelines and the proof of their value to
enhance safety, HFE is still not well understood across the oil and gas industry (Robb and Miller,
2012).
All the above analyses indicate that the HOFs consideration in risk analysis of offshore
operations has not become an integrated part of that system.
At this stage, we would like to compare the risk analysis models introduced in the previous
sections based on some evaluative criteria. The purpose of those criteria is to be able to evaluate
the explained risk analysis methodologies, their abilities, and their applications and to identify
50

the potential methodology or methodologies that can be applied in this dissertation and also can
generally be utilized as a framework for the risk assessment of accidents like blowouts and oil
spills in offshore drillings.
The evaluative criteria for the comparison of the aforementioned methodologies are as follows:
 Area of application; whether or not the model has been used in offshore drilling risk
analysis
 Qualitative capability
 Quantitative capability
 Ability to model human and organizational factors
 Graphical representation
 Ability to run with incomplete data
Table 2.1 indicates each of the discussed methodologies in the previous sections and its status
against each of the aforementioned criterion.
It is needed to state that the human reliability methods explained in section 2.3 have not been
included in table 2.1 since they are only focused on the human performance analysis without
considering the root organizational factors affecting them. Those methods have to be combined
with some other risk analysis techniques in order to represent a complete picture of a whole
studied problem.
As stated before, the main focus of this research is to propose a methodology as a risk
assessment framework for analyzing accidents associated with offshore drillings such as
blowouts and oil spills. More specifically, there is need to a framework that can model the
critical role of human and organizational factors as a major contributing cause of negative
pressure test misinterpretation. Based on table 2.1, we can see that few of the developed
methodologies have been actually used for the risk analysis of offshore drilling. Most of the
offshore related applications of the described methods have been in cases like the maritime
transportation safety, collision of vessels, and offshore installations. In other word, there is a gap
in the literature for the existence of enough risk analysis frameworks concentrating on offshore
drilling related accidents. This issue is one of the main reasons for the novelty of this research.
51

Table 2.1. Summary of comparisons of risk analysis methods
Method
FTA
ETA
FMEA
BBN
QMAS & SYRAS
SAM
BORA
I-Risk
HCL
Comments
Criteria

Area of application G/O G/O G/O G/OD O A/T/O A/O/OD CI A/O
When the "G" status is mentioned for
the area of application of a method,
we skipped stating the rest of its
applications which are not related to
the offshore industry.
Qualitative capability Yes Yes Yes Yes Yes Yes Yes Yes Yes
Quantitative
capability
Yes Yes No Yes Yes Yes Yes Yes Yes
FMEA can be quantified, but it is
possible mainly through combining it
with other methods.
Ability to model
HOFs
Yes* Yes* No Yes Yes Yes Yes Yes Yes
*FTA and ETA are mostly used in
combination with other risk analysis
techniques to model HOFs.
Graphical
representation
Yes Yes No Yes No* Yes Yes* Yes Yes
No*: Not for all the decomposed
elements
Ability to run with
incomplete data
No* No* --- Yes No No No No Yes/No
No*: For the quantification of them
Yes/No: The ETA and FTA parts
cannot run with incomplete data, but
the BN part could.
G: General Application; A: Aviation; N: Nuclear; T: Transportation; CI: Chemical Installations; O: offshore operations; OD: Offshore Drilling
One of the required potentials for a proper risk analysis methodology is its ability for both
qualitative and quantitative analysis. The qualitative capability provides general insights about
the relationships and effects of system components, and the quantitative capability helps with
converting those relationships into numeric values, which can be more tangible for users.
Another important characteristic of a desired risk assessment model is the ability to model
human and organizational factors. As stated in the introduction, almost 80% of the contributing
causes of major failures in offshore installations were due to HOFs. As a result, capability of
considering HOFs is an important element for a risk analysis approach.
Graphical representation is another important factor, which facilitates the easier understanding of
modeled problems. Moreover, presenting a model visually is useful in following relationships
between different elements of the model.
Finally, the ability to run with incomplete data is critical for quantitative risk analysis methods.
We often encounter uncertain situations which the available data is vague or incomplete. This
issue indicates that accessing data can be quite challenging.
52

Based on all the above analyses and the indicated comparisons in table 2.1, Bayesian network or
Bayesian belief network sounds an appropriate risk analysis technique to be used in this research.
The BBN has the ability to model uncertainty both in qualitative and quantitative ways and it can
even be run for the cases with incomplete data. In addition, BBN is capable of modeling human
and organizational factors as a main contributing cause of accidents in offshore drillings.
Another important characteristic of a BBN is being a graphical tool, which captures the cause
and effect relationship between the elements of a system and helps in better understanding of the
modeled problem. There are even different software platforms for developing a BBN which
makes the model representation and the related probability calculations much easier. In addition
to that, the calculated probabilities in a Bayesian network can be updated by availability of new
information in the modeled system.
In summary, “with the ever-increasing computing power, Bayesian networks are now powerful
tools for deep understanding of very complex, high-dimensional problem domains. Their
computational efficiency and inherently visual structure make them attractive for exploring and
explaining complex problems” (Conrady Applied Science website, 2012).
However, the complex nature of offshore drilling accidents needs incorporating many
contributing factors into the model. This issue will make the Bayesian network modeling very
complicated and expanded in size. And, this means the need for many conditional probabilities
as inputs to the model. In addition, it seems there is a need for another complementary
methodology to analyze the problem qualitatively before quantifying it through Bayesian
network modeling.
In this research, we have introduced a multi-phase risk analysis methodology, which will be
described in detail in chapter 3. As part of this multi-phase methodology, we have proposed a
conceptual risk analysis framework to qualitatively assess the critical role of human and
organizational factors as a major contributing cause of negative pressure test misinterpretation. It
is needed to state that we first developed a Bayesian belief network to quantify the
aforementioned conceptual framework. A BBN was selected for this purpose based on the results
of the above analyses. In addition, in our personal communication with Dr. Mosleh (2011), as an
expert in the area of risk and reliability analysis, he recommended the utilization of a Bayesian
network for quantitative analysis of our developed conceptual framework. However, as we
53

explained before, data collection for a complex and fairly large BBN is challenging. Similarly,
due to the lack of access privilege to any hard data in the case of our research, applying Bayesian
belief network for quantifying all the captured human and organizational factors in our
conceptual framework was not practical.
As a result, we proposed a rational decision making model using the signal detection theory as
the foundation for the purpose of quantifying a section of our developed conceptual framework.
It is noteworthy that our proposed model can be categorized as a Bayesian network with both
discrete and continuous variables based on its structure and derived probability formulas. We
also added a decision making component to the model in order to be able to assimilate the
interpretation of a negative pressure test, as the main element that we intend to analyze. In
general, our proposed quantitative model is a combination of a Bayesian approach and a decision
making process based on the signal detection theory.
The signal detection theory is a means to quantify the ability to distinguish a signal or a stimulus,
as a piece of information, from random patterns of distraction; noise. In addition to science and
engineering applications, the signal detection theory has been used in psychology and
psychophysics for many decades; e.g. Tanner and Swets (1954). Some of the recent applications
of this theory are in image analysis; e.g. Liaparinos, Kalyvas, Kandarakis, and Cavouras (2013),
and diagnosis and prognosis; e.g. Sheppard and Kaufman (2005). However, the concept of
decision processes in the signal detection theory has neither been used in the oil and gas industry
nor in any risk analysis applications.

54

3) Methodology
3.1) Overview
This chapter introduces the proposed risk analysis methodology in this research. As stated in the
introduction section, this methodology consists of three different approaches, which their
integration constitutes the big picture of the whole methodology. The main purpose of the
developed methodology is to systematically assess the critical role of human and organizational
factors in offshore drilling safety, and specifically in correct implementation and interpretation of
negative pressure tests, as critical steps in ascertaining well integrity during offshore drilling.
In this regard, section 3.2 describes the first proposed approach in this research methodology,
which is a comparative analysis. Section 3.3 introduces the developed conceptual risk analysis
framework in this research, as the second approach within the proposed integrated methodology.
In section 3.4, the developed rational decision making model for quantifying a section of the
stated conceptual risk analysis framework is explained.
In addition to the proposed risk analysis methodology in this research, an integrated four-layer
framework is developed in section 3.5 to assess the interoperation of multiple organizations in
complex systems. The combination of this model and the introduced conceptual risk analysis
framework can be used as a joint approach to analyze multi-organizational interactions with the
focus on ineffective communication, as a root organizational factor contributing to large-scale
accidents.

3.2) Comparative Analysis
3.2.1) Model Introduction
As stated briefly in the introduction chapter, the first approach in the proposed risk assessment
methodology is a comparative analysis of a “standard” negative pressure test, which has also
been proposed in this dissertation, and the NPT conducted by the DWH rig crew. The main
purpose of this comparative analysis is identifying the discrepancies between the two
aforementioned procedures.
55

As the first step, there is a need to learn how a “standard” negative pressure test is performed.
Then, it is possible to compare the conducted NPT by the DWH rig crew with the identified
“standard” test.
The comparative analysis model has been performed by representing each of the two stated tests
using a workflow process, comparing the two workflow processes with each other, and
identifying the mismatches between them. Workflow process is an appropriate tool to present
and analyze each of those test procedures due to the visual characteristic of it.
Based on this model introduction, section 3.2.2 describes the introduced approach in this section
after a brief explanation about the importance of temporary abandonment procedure in
exploratory wells.

3.2.2) Model Description
Oil companies look for potential petroleum reservoirs in different layers of ground under the sea
base in their geological studies. After locating the best possible options, they need to drill down
for actually accessing those identified reservoirs. The exploratory wells are the results of these
types of drillings.
Usually, production process does not start right after exploratory drilling operation. To secure the
well before the production begins, a procedure called temporary abandonment is required to
ensure there will be no influx to the well.
A key factor in well integrity is the robustness of the cement job. As part of temporary
abandonment process, the well integrity can become an issue as there is a lowering of the
borehole pressure when drilling mud is replaced with seawater.
According to the Chief Counsel’s report (2011), a test called negative pressure test is currently
the only means of evaluating cement integrity at the bottom of a well l; especially for offshore
drilling. As part of temporary abandonment, a negative pressure test indicates whether the
cement barrier and other flow barriers can isolate the well and prevent hydrocarbon influx into
the wellbore (NAE/NRC report, 2011). Negative pressure test confirms no leakage in the seal
assembly, the casing, or the cement job (Chief Counsel’s report, 2011). Developing a negative
56

pressure differential inside the well provides the opportunity to diagnose cementing problems
(Nelson, 1990).
Based on our extensive research in the literature of oil and gas drilling and our personal
communication with several experts in the area of petroleum engineering and well design, there
has been no detailed procedure for a “standard” negative pressure test in the existing guidelines
of oil companies or related regulatory agencies (American Petroleum Institute (API)/Society for
Petroleum Engineers (SPE) websites, 2014; Bea, 2011c, Bommer, 2011; Dupriest, 2014b; and
Millheim, 2011). However, there have been some very basic steps described in different sources
as the negative pressure test procedure, which are stated below: (Nelson, 1990 and Bommer,
2011)
1) Determine the reservoir pressure outside the casing
2) Lower the pressure inside the well by circulating a less dense fluid through the drill pipe
in order to create a pressure differential between inside and outside of the well
3) Monitor the inside of the casing for signs of flow or built-up of pressure inside the well;
if there is no flow or pressure change inside the well, then seal in holding
In addition to the aforementioned basic NPT procedural steps, the American Petroleum Institute
has included some examples of conducting this test, which is known as the inflow test as well, in
one of its published Recommended Practice (RP) documents entitled “API RP 96” (2013). This
document, which is considered as one of the main references of the oil and gas drilling industry
for conducting NPT, lacks some details regarding implementation and more importantly
interpretation of a conducted negative pressure test.
As stated in section 3.2.2, a “standard” framework for conducting a negative pressure test
procedure has been proposed in this dissertation. This framework has been presented as a
workflow process. The proposed workflow process has been developed using the stated basic
steps for conducting such test as the foundation. We also have used the provided information in
the Chief Counsel’s report (2011) regarding conducting NPT and the final report on the review
of the operational data on the Deepwater Horizon by Smith (2010a). In addition, insights of
several experts in the field of petroleum engineering and well design, whom we contacted in this
regard, have been used in developing the stated framework, which has been illustrated in figure
3.1.
57

According to figure 3.1, the first general step in conducting a “standard” negative pressure test is
to displace drilling mud in the drill pipe and the upper casing string with seawater (Box#1). This
process consists of two parts: 1) sending spacer, which separates drilling mud from seawater,
down the well through the drill pipe and 2) sending seawater down after pumping the spacer.
This displacement causes some pressure decline inside the well as a first step to simulate the
situation that will happen after completing the temporary abandonment.
The next phase is to close the annular preventer on the BOP in order to prevent the replaced mud
and spacer to go down below the BOP stack (Box#2). “The annular preventer is a hard rubber
donut that surrounds the drill pipe; when activated it expands and fills the space around the drill
pipe, sealing the well below” (Chief Counsel’s report, 2011, page 154). (An image of a leaking
in the annular preventer seal has been illustrated later in figure 3.2, for the arc#3.) It is really
important to make sure that there is no leaking from the annular preventer seal inside the well. In
addition, crew needs to ensure that there is nothing from the pumped spacer and pushed out mud
left below the BOP stack.
After closing the annular preventer, the pressure inside the well (P) will be measured. One of the
usual places for installing the pressure gauge is in the cement unit on the surface. The normal
case is to have the stated pressure close to the amount of pressure (P1) that is estimated for the
well at this stage. (P1 is estimated based on the amount of drilling mud that is replaced with
seawater and usually indicates the u-tube pressure caused after the displacement process right
before the BOP annular preventer is closed.) At this point, there exists a decision box in the
workflow process for this purpose (Decision box#3.) If the pressure inside the well is not more
than the estimated amount; P1, (Arc#1), then the situation is normal for this stage, and crew
could proceed to the next step to bleed off enough fluid from the well through the drill pipe to
make the pressure equal to zero (Box#4).
On the other hand, if the inside pressure is higher than P1 (Arc#2), that is a sign for having an
anomaly. In this case, there might be leaking in the annular preventer seal. As a result, crew
needs to check to find out whether or not there is leakage in that area (Decision box#5). If there
is leaking from the annular preventer seal (Arc#3), then crew has to open the annular preventer
and circulate the spacer, which might have leaked below the BOP stack, above that section
(Box#6).
58

Displace drilling mud with seawater to
required depth:
- Send spacer down through drill pipe
- Send seawater down after spacer
- Make sure all the spacer comes
above the BOP stack
Close annular preventer on
the BOP
P>P1 inside the
well?
Make “P=0”; bleed-off some
fluid from the well through
drill pipe
Can “P” bleed-
off to zero?
# of barrels of bled-
off fluid>”x” bbl?
Does “P” stay at
zero?
Flow from the
well?
Success in the negative
pressure test
Leaks in annular
preventer seal?
Mud and spacer
above the BOP stack?
Flow-Out>Flow-In in
the well?
Negative pressure test
failure
Open annular preventer and
circulate back the spacer
above the BOP stack
Y
N
Y
N
N
N
N
Y
Y Y
Y
N Y
Y
N
N
1
2
3
4
10
11
13
14
5
7
6
8
9
12
2
4
3 5
6
8
1
9
10
11
13
12
14
15
16
7

Figure 3.1. Workflow process for the proposed “standard” negative pressure test
59

If crew does not find any leaking in the annular preventer seal (Arc#4), they need to go one step
further and make sure that all the mud and spacer had been moved above the BOP stack in the
process of replacing them with seawater (Decision box#7). If there is any part of the mud or the
spacer below the BOP stack (Arc#5), they again need to open the annular preventer and circulate
that remained part above the BOP stack.
If there is no remaining mud or spacer below the annular preventer (Arc#6), the anomaly of
having higher pressure inside the well could be because of hydrocarbon flow from the well. At
this stage, crew should check to determine whether there is any flow from the well, which means
that the flow out from the well is higher than the flow in (Decision box#8). If there is any flow
from the well (Arc#7), it means that the cementing job was not robust enough to hold the
hydrocarbon pressure when the pressure inside the well declined to an amount less than the pore
pressure. And, this indicates a failure in the negative pressure test (Box#9).
On the other hand, there might be no flow from the well when crew tests the well for that
(Arc#8). However, this situation is almost impossible unless there was a broken gauge firsthand
in measuring the pressure inside the well, and even the pressure might have been normal at that
stage.
Let us go back to the situation that the pressure inside the well (P) was not higher than the
expected pressure P1 (Arc#1). As we stated before, crew will bleed off more fluid from the well
to make the pressure equal to zero (Box#4). When the pressure inside the well becomes zero, the
hydrostatic pressure inside the production casing will be less than the pressure exerted by the
fluid in the reservoir outside the casing (pore pressure).
Now, there is a conditional situation here to check whether or not the pressure could be bled off
to zero (Decision box#10). If the pressure cannot decrease to zero (Arc#9), either there is a
leaking in the annular preventer area or there is flow from the well. As a result, there is a need to
check for those possibilities by connecting this arc to the decision box#5.
On the contrary, consider the case that crew could bleed off the pressure inside the well to zero
(Arc#10). At this stage, the number of bled-off fluid has to be measured (Decision box#11). If
the amount of bled-off fluid is more than an estimated number “X” bbl. (Arc#11), this is an
anomaly which could be because of flow from the well. (The value for “X” depends on the
specific characteristics of each well and the depth of first mud displacement with seawater.) And,
60

if there is any flow from the well after checking for that option (Arc#12), this means a failure in
the negative pressure test (Box#9).
Now, imagine a situation that the pressure inside the well is zero and the number of bled-off fluid
for making the pressure equal to zero is not more than “X” bbl. (Arc#14). At this stage, if the
pressure inside the well stays at zero (Arc#15), then the negative pressure test is successful since
the well passes all the requirements for holding the hydrocarbon.
On the other hand, if the pressure inside the well, which had been reduced to zero, builds up
again (Arc#16), this is an anomaly and most likely means that the cementing does not hold the
hydrocarbon pressure. (Pressure built-up is another sign for a failed negative pressure test even if
crew cannot actually see the flow coming out of the well.)
At this stage, we describe the performance of the Deepwater Horizon drilling crew in each of the
steps of implementing the negative pressure test in the Macondo well as compared to the
proposed “standard” test framework explained above. The Deepwater Horizon drilling crew’s
implementation of the negative pressure test has been shown in figure 3.2. (The pictures in that
workflow process have been extracted from the Chief Counsel’s report (2011).) This workflow
process has been developed based on the detailed explanation of the BP DWH negative pressure
test in the Chief Counsel’s report (2011), the two animations related to this test that have been
published in the Oil Spill Commission website (2011), the information provided by the BP report
(2010) regarding this test, and the brief description of NPT in the NAE/NRC report (2011).
This way, we could identify the discrepancies existing between what needed to be done and what
actually the Deepwater Horizon drilling crew implemented in each stage of conducting NPT.
After identifying those mismatches, we can invetigate the root causes of the identified
discrepancies.
Indications are that the Deepwater Horizon drilling crew started the negative pressure test similar
to the outline of the proposed “standard” test framework (Fig. 2, Box#1). Drilling mud in the
drill pipe and the upper casing string was replaced with seawater at the depth of 8367 feet. For
this purpose, the crew pumped 454 barrels of spacer down the drill pipe to separate drilling mud
from seawater. The crew then sent 352 barrels of seawater inside the well after the spacer. (The
figure associated to box#1 shows this displacement.) However, they sent 30 barrels of fresh
water; which might have even been the pit wash having the spacer particles, between pumping
61

the spacer and seawater into the well. This was not part of their planned way of mud
displacement with seawater (BP report, 2010).
While drilling crew routinely uses water-based spacer fluids, the Deepwater Horizon crew used
the lost circulation material as the spacer (Report to the president, 2011). This spacer was almost
two times denser than the seawater (Chief Counsel’s report, 2011). In addition to that, they
pumped more barrels of spacer into the well than the normal amount. Both of these issues might
have caused some part of the spacer to stay below the BOP stack.
After displacement of drilling mud with seawater, the Deepwater Horizon drilling crew closed
the annular preventer on the BOP (Box#2) and measured the pressure inside the well (Box#3).
The pressure at this point was 2325psi (the figure associated to Acr#2), which was around 700psi
higher than the expected pressure for this specific stage.
Although the measured pressure was higher than what they had expected (Arc#2), the crew did
not check for leaking in the annular preventer seal or for determining whether or not there is any
part of the spacer remaining below the BOP stack (Box#5 and Box#6 in Fig. 1). They instead
proceeded with the negative pressure test and started to bleed off more fluid from the well
through the drill pipe in order to reach to the zero pressure (Box#4).
The crew was not successful in the first try to make the pressure inside the well equal to zero.
They could not reduce the pressure below 260psi (Arc#9 and the figure associated to that arc). At
this stage, the crew recognized that there is leaking in the annular preventer seal avoiding the
pressure to be reduced to zero (Arc#3 and the figure associated to it). Based on this diagnosis,
they tightened the annular preventer seal to make sure that there is no more leaking from that
seal. However, they did not follow the proposed “standard” framework to open the annular
preventer and circulate back the spacer that might have leaked below the BOP stack.
For the second time, the drilling crew bled off more fluid from the drill pipe. This time, they
were able to reduce the pressure to zero (Arc#10). However, the pressure started to build up after
closing the annular preventer on the BOP. (Pressure increased to 773psi; Arc#16 and the figure
associated to that arc.)
62

Figure 3.2. Work flow process for the Deepwater Horizon negative pressure test (Source of images: Chief Counsel’s report, 2011
Displace drilling mud with seawater:
- Send spacer down through drill pipe
- Send seawater down after space
Close annular preventer on
the BOP
P>P1 inside the
well?
Make “P=0”; bleed off some
fluid from the well through
drill pipe
Can “P” bleed off
to zero?
Does “P” stay at
zero?
Is there any leaking in
the annular preventer
seal?
Y
Y
N
N
1
2
3
4
10
5
3
9
10
16
Y
2
Arc#3
Arc#9
Arc#2
Box#1
Arc#16
Does “P” stay at
zero?
Flow from the
kill line?
Success in the negative
pressure test
N 13
Bleed off some fluid from the
kill line to make the drill pipe
pressure equal to zero
Does “P” stay at
zero?
N
17
Bleed-off some fluid from the
kill line to make the kill line
pressure equal to zero
Arc#17
N; Drill pipe
Y; Kill line
18
Arc#18
13
15
16
17
18
14
63

As the third trial, this time, they decided to open the kill line and bleed off the fluid from that line
instead of the drill pipe (Box#15). They were able to reduce the pressure inside the drill pipe to
zero by bleeding off the fluid from the kill line. However, the pressure did not stay at zero, and it
started to build up again; this time to 1400psi (Arc#17 and the figure associated to it). At this
stage, the crew justified the pressure built-up inside the drill pipe as a phenomenon called
“bladder effect”.
Based on the unsatisfactory results of the test in the previous stage, the Deepwater Horizon crew
decided to make another attempt as a negative pressure test. This time, they bled off the fluid
from the kill line to make the pressure inside the kill line; and not the drill pipe, equal to zero
(Box#17). After reducing the pressure of the kill line to zero, the crew opened the valve between
the kill line and the drill pipe to connect those two together.
With connected pipes, the pressure of the kill line and the drill pipe should have been the same.
However, the pressure inside the kill line stayed at zero while the drill pipe pressure increased to
1400psi (Arc#18 and the figure associated to that arc). At this time, the drilling crew opened the
kill line and observed the well for 30 minutes to see whether or not there is any flow from the
well through the kill line (Decision box#12). Because there was no observed flow from the kill
line (Arc#13), and the pressure inside the kill line stayed at zero, the drilling crew accepted the
negative pressure test as a successful one and continued with the rest of the temporary
abandonment procedures; while again there was a pressure built-up inside the drill pipe. (The
crew justified this pressure built-up as a “bladder effect” again.)
One possible explanation for having no flow from the kill line and a stable zero pressure down
there is that the kill line might have been plugged by the spacer. As a result, the pressure increase
in the drill pipe could not transfer to the kill line. This possibility is likely due to the
aforementioned facts that 1) the spacer used by the drilling crew was much denser than the
seawater and 2) the crew used more than normal amount of the spacer. In addition, as we stated
above, the drilling crew pumped 30 barrels of fresh water into the well before sending the
seawater down. BP report (2010) analyzed that the fresh water might have been “the tank
washings from the spacer tank”. In this case, there is a possibility of having the spacer particles
below the BOP stack. (Appendix Q in the BP report indicates that the fresh water base was 210
feet below the BOP stack.)
64

Moreover, we know that the annular preventer had leaking, and the crew did not circulate back
the possible penetrated spacer above the BOP stack, so some part of the spacer might have
remained below the BOP stack and plugged the kill line. In fact, the BP report (2010) indicates
that approximately 50bbls of spacer leaked below the BOP stack because of the leaking in the
annular preventer seal. In addition to that, when the crew opened the kill line for the bleed-off
purpose, there was a spurting flow coming out of the kill line (Smith, 2010b). This can be an
indicator for having a plugged kill line.
Comparing the performance of the Deepwater Horizon drilling crew in implementing the
negative pressure test with what we proposed as a “standard” framework for this test shows
different discrepancies. The summary of some of the main mismatches explained above is as
follows:
 Using heavier and denser spacer
 Using more amount of spacer than normal
 Not checking the reason for having a higher pressure than P1 inside the well (Arc#2 in
figure 3.1) and proceeding with the rest of the test procedure as a normal case
It is needed to state that there are more discrepancies between the two explained test procedures.
First of all, the crew did not calculate the expected amount of fluid needed to be removed from
the well to reach the zero pressure. Based on the Chief Counsel’s report (2011), the crew
removed 23bbl. of fluid from the well at their first attempt to implement the negative pressure
test. Even by removing that amount of fluid, they were not able to reduce the pressure to zero as
we stated before. In their second attempt after tightening the annular preventer seal, they
removed 15 barrels of fluid from the well to make the pressure equal to zero (Chief Counsel’s
report, 2011 and Smith, 2010b). Both of these numbers of barrels are higher than the expected
amount based on the calculation of the experts in this area (Smith, 2010c).
Secondly, the drilling crew decided to bleed off the fluid from the kill line in their third and
fourth attempt to reduce the pressure to zero. The reason for doing this is not clear in the
published investigation reports. According to the Chief Counsel’s report (2011), BP has claimed
that the procedure which they submitted to the MMS (Mineral Management Service) firsthand
indicated the bleed-off from the kill line. If that is the case, it is not clear why the drilling crew
chose the drill pipe in their first attempts for the fluid bleed-off.
65

In addition to that, even if we assume that the well pressure reduction from any of the lines; drill
pipe, kill line, or even chock line, is possible and logical, we cannot ignore the fact that the
drilling crew did not consider the pressure built-up inside the drill pipe every time after reducing
the pressure to zero; while that is an indicator for failure in a negative pressure test.
Finally, it is important to mention that the phenomenon known as the “bladder effect” cannot
happen in a situation like what BP encountered within its negative pressure test procedure. The
bladder effect could exist when the pressure is transmitted across a flexible membrane or bladder
(Bommer, 2012).
Here is the explanation of the drilling crew for their pressure built-up as a “bladder effect”
(figure 3.3): “heavier mud in the riser would push against the annular and transmit pressure into
the wellbore, which in turn you would expect to see up the drill pipe” (Chief Counsel’s report,
2011, page 157). This justification cannot be correct based on the main condition of the bladder
effect theory; which is having a flexible membrane. This is because the membrane existing in the
Deepwater Horizon case was the BOP annular preventer which is not flexible at all (Bommer,
2012). Even the BP onshore managers believed that the bladder effect phenomenon did not exist
in the case of the conducted negative pressure test by the DWH crew. In fact according to the
Chief Counsel’s report (2011), those managers stated that they would have insisted on further
testing before declaring the test a success had the well site leaders called the shore.

Figure 3.3. Drilling crew’s justification of the “bladder effect” (Chief Counsel’s Report, 2011)
66

All the aforementioned points indicate that there were discrepancies between what the DWH
drilling crew implemented as a negative pressure test and the proposed “standard” test. This
analysis shows that the DWH crew did not consider all the existing evidences and possibilities to
have a better understanding and judgment about their conducted test.
Our research in the literature of oil and gas drilling as well as our personal communication with
experts in this area indicated that there are other methods for conducting NPT in addition to the
process utilized by the DWH crew, which along with the main theme of our proposed “standard”
framework for implementing such test. In another defined version of negative pressure test
procedure, there exists one critical condition of not allowing the used spacer or seawater to enter
the annulus. Therefore, crew needs to make sure that all the spacer and seawater remains inside
the drill pipe. For fulfilling this condition in addition to being able to create fair amount of
differential pressure during the displacement process as part of NPT, crew has to run long
enough drill pipe down into the well.
The main reason for the stated condition is that if crew realizes that the drilled well is flowing
while conducting negative pressure test, they need to stop the flow and kill the well by reversing
the displaced mud back into the drill pipe through the annulus (Garcia, 2013). And, if there is
any seawater or spacer inside the annulus, the stated process for reversing back mud into the
system can be really hard or even impractical.
Existing of the aforementioned condition does not change the content and main steps of the
proposed “standard” framework for conducting NPT. The only change in that workflow process,
shown in figure 3.1, is that there is no need for the box#6 and the decision box#7 anymore since
crew does not allow the spacer to enter the annulus, which is equivalent to not having the spacer
below the BOP stack in the annulus. With these changes, arc#3 will be connected to the box#2
and acrt#4 enters the decision box#8. This means that if there is any leaking in the annular
preventer seal (Acr#3), crew has to tighten the seal (Box#2) and continue with the rest of the
negative pressure test procedure. On the other hand, if there is no leaking in the annular
preventer (Acr#4), crew needs to check whether there is any flow from the well (Decision
box#8).
Based on our personal communication with some experts in the area of drilling and well design,
some of the oil companies use packers; e.g. retrievable packers, for conducting negative pressure
67

test. This tool can be sent down to a well to any desired depth and be activated after the
displacement process in order to seal the well at that specific depth and assist the crew in
evaluating the well integrity below the packer. Some experts believe that utilizing packer for
negative pressure testing can help the crew in better diagnosing potential issues with well
integrity since it removes investigating all potential integrity problems together. However,
activating packers sometimes become challenging since this requires either pulling/pushing of
the packer inside the well or rotating it, in which the BOP annular preventer needs to remain
open (Ershaghi, 2014). This condition can be dangerous since closed annular preventer on the
BOP stack can operate as a barrier against any well kicking or influx.
Utilizing a packer in negative pressure test implementation does not also change the main steps
of our proposed “standard” NPT procedure. NPT procedure using packer will be similar to
conducting this test with no allowance of seawater or spacer inside the annulus. The only change
is to check the leaking in the packer seal and not the BOP annular preventer.
In this section, we described our proposed framework for a “standard” negative pressure test
procedure. Then, we compared the performance of the Deepwater Horizon crew in implementing
the NPT with the identified “standard” procedure. This comparison guided us through the
identification of the existing discrepancies between the two procedures.
In the next section (3.3), we will model and analyze the contributing causes of misinterpreting a
negative pressure test using a conceptual risk analysis framework. This framework, which is the
second approach of our proposed integrated research methodology, was first developed for the
risk analysis of the conducted NPT by the DWH crew. However, it was then generalized to cover
influencing factors of misinterpreting any negative pressure test in general.

68

3.3) Conceptual Risk Analysis Framework
3.3.1) General Model Introduction
As stated in the introduction section, the main objective of the developed risk analysis
framework in this dissertation is to systematically assess the contribution of human and
organizational factors in misinterpreting a negative pressure test in general. The proposed
framework in this section is a conceptual model analyzing different contributing causes of the
negative pressure test misinterpretation. Those contributing causes have originally been
identified by the analysis of the NPT conducted by the DWH crew, through the comparison of
the workflow process developed for that test with the proposed “standard” negative pressure test
procedure. Then, those identified contributing causes and components of the framework have
been generalized to cover the analysis of any negative pressure test.
This conceptual framework is based on the idea of the “hierarchy of root causes of system failure”
or the SAM (System-Action-Management) model, which was originally proposed by Pate-
Cornell (1993 and 2012). This hierarchy includes three main layers (figure 2.16): basic events in
the bottom, decisions/actions in the middle, and organizational factors level on top. Based on this
hierarchy, occurrence of basic events such as explosions or loss of containment is influenced by
decisions or actions made in the middle level. And, those decisions/actions are affected by some
root organizational factors which are displayed on the top level of the hierarchy.
It is needed to state that the proposed conceptual framework in this paper has some differences
comparing to the SAM model presented by Pate-Cornell. First of all, the main focus of the
developed framework in this section is on the negative pressure test diagnosis, which belongs to
the second layer of the explained hierarchy, and not the basic events layer. In addition, there is a
possibility of modeling judgments and biases involved in the process of conducting and
interpreting a negative pressure test in this framework.
There are different reasons for selecting the aforementioned conceptual framework in this study.
First of all, this framework is actually a network, which captures the interactions among different
influencing factors on the NPT misinterpretation. In addition, this network is an organized, three-
layered framework, which makes it easier to be interpreted.
69

Moreover, as stated before, human and organizational factors ought to be the main focus of the
developed risk analysis framework in this research. As a result, the proposed conceptual
framework has to highlight the contribution of HOFs involved in misinterpretation of a negative
pressure test and also has to display the effect of those factors on other parts of the system.
It is noteworthy that although we developed the stated framework for risk assessment of
misinterpreting a negative pressure test, the concept of this three-layer framework can be used
for analysis of any oil and gas drilling as well as any other high-risk operation.
In this section, the general configurations of the stated conceptual framework as the second
approach in this research methodology were described. Section 3.3.2 explains the framework in
the context of the negative pressure test misinterpretation.

3.3.2) Model Description
As explained in section 3.3.1, the developed conceptual framework, as the second approach of
the proposed integrated risk analysis methodology in this research, has been classified in three
important layers. Starting from the top level, we have the organizational factors. Decisions and
actions are displayed in the middle layer. Finally, basic events are illustrated in the bottom level.
In this section, the introduced conceptual risk analysis framework has been described in detail
(Figure 3.4). Along with describing each layer of the proposed framework for a generic negative
pressure test, we state specific instances of the DWH case study as well.

3.3.2.1) Organizational Factors Level
As stated before, the top level of this model includes the organizational factors. There are six
main categories of organizational factors, which have been recognized as the root contributing
causes of negative pressure test misinterpretation. These categories are as follows:
1) Failure to follow Management of Change (MOC) processes
BP developed a systematic, risk based process called MOC as part of its operation integrity
and risk management program in order to document, evaluate, approve, and communicate
changes. This process was part of the BP’s golden rules, which requires that “work arising
from temporary and permanent changes to organization, personnel, systems, process,
70

procedures, equipment, products, materials of substances, and laws and regulations cannot
proceed unless a MOC process is completed” (BOEMRE report, 2011, pages 179 and 192).
Despite the company careful documentation for the MOC process, the DWH team did not
use this process as their change management tool for the day to day changes in the drilling
operations (BOEMRE report, 2011, page 179). Two of the main examples regarding not
considering the MOC process, which are related to the negative pressure test results, are:
last minute changes to the negative pressure test procedure and last minute changes of the
personnel.
Although the referenced instances in failure to follow management of change processes are
related to the conducted negative pressure test in the Deepwater Horizon, this category of
organizational factors can be influential in analysis of any NPT. In addition, management
of change has been introduced as one of the main management system practices for
offshore drilling safety in a comprehensive study based on analysis of several offshore
drilling accidents (de Morais and Pinheiro, 2011). Therefore, failure to follow MOC
processes can be a generalized organizational factor, which contributes into system failure.
2) Economic pressure
This category of organizational factors includes some issues, which caused the DWH team
to be in some economic pressure. The following are some of the main issues related to this
category:
 Production vs. safety; it seems that BP had more emphasis on production rather than
safety. According to the BOEMRE report (2011, page 184), there is evidence
showing that the performance of BP’s personnel was reviewed, at least in part, based
upon their ability to control or reduce cost, and they were compensated based on that.
This issue existed while there was no comparable performance measure for the
occupational safety achievements (BOEMRE report, 2011, page 184 and NAE/NRC
report, 2013)
The concept of process safety, in addition to occupational or personal safety, is
another notion that needs to be added to the big picture of companies’ safety culture
(Grote, 2012). According to the Presidential Commission report (2011, pages 219,
223, and 224), this concept, which refers to procedures for minimizing risk more
generally, was lacking in the BP’s safety culture.
71

 Conflicting priorities in the Transocean personnel’s rewarding system; according to
the BOEMRE report (2011, page 189), Transocean’s policy of rewarding personnel
introduced conflicting priorities when it tried to maintain safe operations. In addition,
it created risk of compromising safety in making operational decisions.
 BP’s cost and time saving without having appropriate contingencies and mitigations

(BOEMRE report, 2011, page 199)
In general, BP’s and Transocean’s poor safety culture was one of the main contributing
causes of the DWH accident (Coast Guard report, 2011, page 111; Christou and
Konstantinidou, 2012; Hopkins, 2012; and Presidential Commission report, 2011, pages
218, 223, and 224) and the economic pressure is one of the main elements of each
company’s safety culture. Economic pressure and the concept of production versus safety
however has not been something specific to the Deepwater Horizon case. This
organizational factor has been introduced as one the main contributing causes of accidents
in offshore platforms including the Piper Alpha catastrophe in the North Sea in 1988 (Pate-
Cornell, 1990 and 1993) and other organizational accidents in general (Goh, Love, Brown,
and Spickett, 2012).
3) Personnel management issues
This category includes the factors related to the personnel management issues, which
affects the experience level of personnel and rig crew. According to the BOEMRE report
(2011, p.112), the Chief Counsel’s report (2011, pp.162, 186, and 236), and the SINTEF
report (2011, p.128), both the BP’s and the Transocean’s training programs lacked
sufficient well controlling issues to address the situations such as the negative pressure test
and the displacement operations. In addition to that, there was no specific requirement from
the MMS (Mineral Management Service), as the regulatory agency at that time, for this
purpose (BOEMRE report, 2011, p.196).
Moreover, having some personnel with insufficient relevant experience level was another
factor in this category of organizational issues (BOEMRE report, 2011, pp.118 and 183).
It is noteworthy that lack of sufficient training regarding implementing and interpreting a
negative pressure test or not having experienced enough crew in this area can be important
instances of personnel management issues, which affect risk of misinterpreting such test in
72

general. In addition, this category of organizational factors has been identified as one of the
main causal components of different well incidents and accidents (Curole, McCafferty, and
McKinney, 1999; de Morais and Pinheiro, 2011; Johnsen, Okstad, Aas, and Skramstad,
2012; Pate-Cornell, 1993; and Shaughnessy, Romo, and Soza, 2003).
In one step further, development and introduction of trainings in non-technical skills has to
be integrated into workplace procedures (Thorogood and Crichton, 2013). In this regard,
according to Ershaghi and Luna (2011), inadequate safety training is one of the major
causes of oilfield accidents.
4) Procedural issues
Basically, this category indicates lack of specified, documented procedures for the negative
pressure test. The following items show the details related to this category:
 Lack of any specified, documented procedure by the MMS as of April 2010 for the
negative pressure test

(BOEMRE report, 2011, page 89; BP report, 2010, page 85;
Chief Counsel’s report, 2011, page 161; Presidential commission report, 2011, page
119; and Transocean report, 2011, page 93)
 Lack of any specified procedure in the BP’s or Transocean’s documents for the
negative pressure test

(BOEMRE report, 2011, page 89; BP report, 2010, page 85;
Chief Counsel’s report, 2011, page 161; Presidential commission report, 2011, p.119;
and Transocean report, 2011, p.93)
 No interpretation of guidance in the industry regulations or in the BP’s documents for
the negative pressure test (BOEMRE report, 2011, page 204; BP report, 2010, page
107; and Chief Counsel’s report, 2011, page 162)
 No requirement to document lessons learned, which leads to having no specified,
documented procedure later on (BP report, 2010, Appendix I, page 3)
According to our extensive literature search, existence of no detailed, documented
procedure in the guidelines of oil companies or related regulatory agencies for conducting
and interpreting a negative pressure test is still the case. Moreover, procedural issues have
been identified as one of the main influencing organizational factors in other oil and gas
drilling accidents as well (de Morais and Pinheiro, 2011 and Pate-Cornell, 1993).
73

Figure 3.4. Three-layer conceptual framework to analyze the contributing causes of a negative pressure test misinterpretation
Failure to follow MOC
processes
- Oversimplified instructions for the
NPT
- Last minute changes to the NPT
procedure
- Last minute changes of personnel
Economic pressure
- Production Vs. Safety
- Conflicting priorities in
personnel’s rewarding sys.
- time pressure (cost saving)
Personnel Mgmt. issues
- Lack of sufficient training
- Insufficient experience
Procedural issues
- No specified, documented procedures
by regulatory agencies or oil companies
- No interpretation of guidance in
industry regulations or in oil companies
documents
-No requirement to document lessons
learned
Issues in communication &
processing of uncertainties
-Oil company failure to communicate
risk of decisions with contractors
- Failure to inform rig crew about
increased risk of well control
-Failure to communicate developed
risk assessment sys. with onboard
leaders
- Failure to communicate the
importance of NPT to personnel
Lack of an integrated,
informed Mgmt.
- No feedback/integrated control
from onshore managers or
executives for the NPT
- Managers’ failure to emphasize
the particular importance of NPT
- Lack of a real-time operation
center to continuously monitor
the well site operations data
Type of spacer
to use
Amount of
spacer to use
Negative Pressure
Test (NPT)
misinterpretation
Make sure the
valve bet. drill
pipe and kill line
is open for
pressure reading
Crew’s ability to
monitor the pit
levels
Calculate
expected bleed-
off volume to
make “P=0”
Simultaneous
operation
Check whether
all mud/spacer
is above the
BOP stack
Further
investigation of
real-time data
by onshore
Mgmt.
Failure to
observe and
respond to
critical
indicators
Presence of
required staff,
e.g. drilling
engineer, on
the rig
Viscous material being present
across the chock & kill lines
Plugged kill line
Pressure difference between
the drill pipe & kill line
Organizational
factors level
Decisions/Actions
level
Physical states of
system/Basic events
level
Open annular
preventer and
circulate back
mud/spacer above
the BOP stack
Leak in the annular
preventer
Part of mud/spacer
below the BOP stack
Flow from the well
Pressure built-up
after fluid bleed-off
“P” cannot be bled
off to zero
# of barrels of bled-off
fluid> expected bbl.
Make sure there
is no leaking in
the annular
preventer
74

5) Issues in communication and processing of uncertainties
It seems that there existed different communicational issues inside BP and also among BP
and its involved contractors in the DWH, and this issue was stated as a major contributing
cause of the Deepwater Horizon blowout (Chief Counsel’s report, 2011, page 225; Hopkins,
2012; and Presidential Commission report, 2011, page 223) The following are some of the
instances of this category:
 BP failure to communicate its decisions and associated, increasing, operational risks
with the Transocean rig crew

(BOEMRE report, 2011, pages 2, 3, and 6)
 Failure to inform the rig crew about the increased risk of well control; there were
different changes to the negative pressure test procedure till the last minute as it was
stated before. However, there was a failure in informing the DWH rig crew about
these changes and the increased risk associated with that (BOEMRE report, 2011,
page 89). In addition, the BOEMRE investigation panel found evidence that there was
communicational failure between the onshore personnel in Houston and the rig crew,
while the communication plan depicted direct lines between the well site leaders and
the onshore personnel (BOEMRE report, 2011, page 183).
 BP failure to communicate its developed risk assessment system with the onboard
leaders; according to the BOEMRE report (2011, pages 175-177) and Bea (2011b),
BP actually had a complex risk assessment system. However, there was no proper
guideline for the BP onboard managers to understand how that risk analysis system
works.
 Failure to communicate the importance of the negative pressure test to the rig
personnel; the Chief Counsel’s report (2011, page 163) stated “Had BP properly
emphasized the importance of the test and the need for special scrutiny of its results,
BP and Transocean personnel on the rig may have reacted more appropriately to the
anomalous pressure readings and flows they observed”. This issue was stated in the
SINTEF executive summary (2011, page8) as a failure in communication as well.
75

 Ineffective communication between the driller and the mudlogger to properly monitor
the well (BP report, 2010, page 91 and Chief Counsel’s report, 2011, pages 172 and
181)
It is noteworthy that ineffective communication can be an important root organizational
factor in analyzing risk of misinterpreting any negative pressure test. In one step further,
issues in communication have been introduced as a major contributing cause of different oil
and gas related accidents as well as accidents in other industries (Curole et al., 1999;
Hopkins, 2001; Johnsen et al., 2012; Lootz et al., 2013; Martins and Maturana, 2010;
RNNP project, 2011; Shaughnessy et al., 2003; and Walker, 2006).
6) Lack of an integrated, informed management
Based on the description of different investigation reports, there was apparently no
integrated feedback or control system from the onshore management or the BP executives
for the negative pressure test (BOEMRE report, 2011, pages 22, 96, and 111). This issue
was the main cause of actions like no further investigation of real-time data by the onshore
management, which will be described in section 3.3.2.2. Any of these issues could have
had a positive effect on recognizing the anomalies of the negative pressure test and
evaluating the results in a more appropriate way.
Another important element in this category is lack of a real-time operation center to
continuously monitor the well site operations data. According to the NAE/NRC report
(2011, page 28), the data from the rig were being recorded onshore, but there was no
continuous monitoring of those stored data. Had BP arranged a continuous monitoring of
the real-time data, the management would have high likely recognized failure in the
negative pressure test and taken appropriate control actions.
Lack of an integrated, informed management can be a critical organizational factor in
causing negative pressure test misinterpretation in general. Risk of misinterpreting a NPT
can be impacted negatively if there is no systematic feedback component from onshore
managers or executives to onboard crew in order to inform them about risk of specific
decisions regarding negative pressure test or to monitor the progress of conducting such
test in a real-time manner. Existence of such integrated management system is crucial to
the safety of any other high-risk operations as well.
76

3.3.2.2) Decisions/Actions Level
The second level of the proposed conceptual framework includes all decisions or actions made
by personnel or management that influence conducting and interpreting a negative pressure test.
The decisions/actions level has actually two layers. The first layer consists of decisions or
actions which are influenced by the top level organizational factors. On the other hand, the
second layer elements, which are called the “diagnostic test results”, are the ones affected by the
first layer decisions/actions or even by some of the components of the third level in the model,
which are the basic events or the physical states of the system. (The reason for calling them the
“diagnostic test results” will be discussed later on in this section.)
First, let us review the first layer of decisions or actions as follows:
 Type of spacer to use
In conducting a negative pressure test, spacer is usually used in the displacement process as
a liquid to separate drilling mud from seawater in order to prevent mud from contamination.
Type and characteristics; e.g. density, of the utilized spacer can play an important role in
results and interpretation of a negative pressure test. For instance, the DWH rig crew
decided to use the lost circulation material as the spacer for their negative pressure test.
According to the BOEMRE report (2011, page 87), BP had never used this type of spacer
before. They also did not have any information about the long term stability of the interface
between the spacer and seawater.
The specific spacer that the DWH rig crew used for their negative pressure test had the
density of 16.0ppg, which was almost two times denser than the seawater. This means the
possibility for presence of viscous material across the choke and kill lines during the
negative pressure test, which could possibly plug the kill line (BOEMRE report, 2011,
pages 2, 3, and 6 and Chief Counsel’s report, 2011, page 150).
There are three organizational factors, from the ones explained in section 3.3.2.1, which
influence this specific decision. Those three factors are: 1) failure to follow MOC processes,
2) economic pressure, and 3) procedural issues.
In the specific case of the DWH, the rig crew did not go through any management of
change processes to analyze risk of using the lost circulation material as the spacer.
77

Moreover, choosing that specific material as the spacer was affected by some time and cost
saving incentives. One of the reasons for selecting that spacer was to avoid disposing that
material onshore (BOEMRE report, 2011, page 87). Finally, there was no detailed
procedure in the guidelines of BP or Transocean to clarify limitations on the type of
utilized spacer for the NPT process.
 Amount of spacer to use
Another important decision during the implementation of a negative pressure test is the
volume of material used as spacer. Similar to the impact of type of used spacer, amount of
that spacer can also affect results of a conducted NPT. For the case of the DWH, the crew
used 454 barrels of spacer before displacing drilling mud with seawater. This amount was
more than twice the normal quantity that is typically used (Chief Counsel’s report,

2011,
page 151 and BOMERE report, 2011, page 88).
Given the substantial density difference between the spacer and sweater, as stated before,
and the amount of time it took to displace 454bbl. of spacer, it is likely that at least some
part of the spacer got mixed with the seawater and remained below the BOP stack (Chief
Counsel’s report, 2011, page 151).
We can see that the decision for choosing the amount of used spacer is influenced by the
same organizational factors that affected the above decision for choosing the type of spacer.
Those three organizational factors are: 1) failure to follow MOC processes, 2) economic
pressure, and 3) procedural issues. It is noteworthy that those three factors were the
influencing elements on the DWH crew’s decision for choosing the volume of spacer in
their displacement process as well.
 Check whether all mud/spacer is above the BOP stack
During the displacement process as part of a negative pressure test, crew needs to make
sure that all the pumped spacer inside the well is circulated back above the BOP stack. In
addition, if there is any leaking in the annular preventer on the BOP, some part of spacer or
mud might move below the stack.
The main reason for preventing spacer or mud being below the BOP stack is due to their
characteristics such as density, which may cause issues like plugging lines that can
78

subsequently lead to misinterpretation of the conducted negative pressure test. Therefore,
crew needs to make sure that there is no remained spacer or mud below the BOP stack. In
the case of the DWH, part of spacer remained below the BOP stack. This issue caused
higher pressure readings than expected. In addition, that might have caused the kill line to
be plugged and not show the pressure built-up indicated by the drill pipe (BOEMRE report,
2011, page 88 and Chief Counsel’s report, 2011, page 299).
There are four different organizational factors affecting this decision/action: 1) economic
pressure, 2) personnel management issues, 3) procedural issues, and 4) issues in
communication and processing of uncertainties. If crew is under economic pressure, they
might skip this action or does not implement it in an accurate way. Moreover, skill sets and
crew’s experience level in this regard can be influential in the quality of implementing this
action.
Procedural issues can play an important role in affecting this action since existence of
detailed and clear set of instructions indicating how to check for presence of spacer or mud
below the BOP stack can be really helpful. Finally, lack of effective communication among
personnel who are responsible for implementing related decisions to this action can cause
failure in successfully fulfilling this.
 Open annular preventer and circulate back mud/spacer above the BOP stack
Based on what we discussed in the previous item, crew needs to make sure all the displaced
or bled-off drilling mud and/or spacer are above the BOP stack. If they realize that for
some reason part of that spacer or mud remained below the BOP, they need to open the
annular preventer and circulate back all the spacer or mud above the stack. In addition, if
there is any spacer or mud below the BOP stack due to leaking in the annular preventer,
crew needs to tighten the seal after circulating the spacer or mud above the stack.
According to the Chief Counsel’s report (2011, page 160) and the BOMERE report

(2011,
page 93), the DWH crew never circulated back the spacer above the BOP stack when they
realized that there is leaking in the annular preventer seal. This might have caused some
part of the spacer to be present under the BOP stack, as a possible contributing cause for
having a plugged kill line.
79

There are three main organizational factors as follows, which can affect this decision/action:
1) economic pressure, 2) personnel management issues, and 3) procedural issues.
 Make sure there is no leaking in the annular preventer
As we explained before, existence of spacer or circulated mud below the BOP stack can
cause issues regarding correct implementation and interpretation of a negative pressure test.
Leaking in the annular preventer is one of the contributors for having part of spacer/mud
below the BOP stack. Therefore, crew needs to make sure that the annular preventer is
completely sealed.
There are four organizational factors affecting this specific decision/action: 1) economic
pressure, 2) personnel management issues, 3) procedural issues, and 4) issues in
communication and processing of uncertainties.
 Make sure the valve between drill pipe and kill line is open for pressure reading
Drill pipe and kill line are two connected lines on the BOP stack. Crew might use the
installed pressure gauge on either or both of these two lines in order to interpret result a
negative pressure test. If for some reason the valve which connects these two lines together
is closed, existing pressure in one of them cannot be transferred to the other one. Therefore,
the installed gauges might show different pressures, and this along with some other factors
can contribute to misinterpreting the conducted negative pressure test.
For the case of the DWH, there is a possibility that the rig crew accidentally closed the
explained valve (Chief Counsel’s report, 2011, pages 159 and 160). This might have been
one of the reasons that the pressure inside the kill line did not change when the rig crew
implemented their final negative pressure test by bleeding off fluid from the kill line and by
checking the pressure on that line (Chief Counsel’s report, 2011, page 156).
In addition, as we explained above, heavy spacer below the BOP stack might have plugged
the stated valve between the drill pipe and kill line. In either of these two hypotheses,
reason for having the pressure difference between the kill line and the drill pipe, during
conducting the NPT by the DWH crew, is clear. In this case, we could infer that the
negative pressure test was failed, and the kill line pressure did not show the pressure
increase just because it was not connected to the drill pipe due to having a closed valve.
80

This specific decision/action can be influenced by economic pressure, some issues
regarding personnel management, or some communicational issues.
 Calculate expected bleed-off volume to reduce pressure to zero
At some point within conducting a negative pressure test, crew needs to bleed off some
amount of fluid from the drill pipe or any other connected line to the BOP in order to
reduce the pressure inside the well to zero. The expected amount of bled-off fluid from the
well should be calculated and checked upon the actual amount of removed fluid. This
comparison can be useful in recognizing the possible influx into the well.
In the DWH case, the rig crew did not calculate the expected bleed-off volume from the
well (Chief Counsel’s report, 2011, page 153 and BP report, 2010, Appendix I, page 3). As
a result, they did not have the ability to evaluate the actual amount of removed fluid every
time that they repeated the negative pressure test.
This specific decision/action can be affected by the following organizational factors:
personnel management issues and procedural issues. If crew does not have required skill
sets to calculate expected bleed-off volume or if there is no specific procedure guiding
them regarding how to calculate that volume, the accuracy of this decision/action will be
negatively impacted.
 Simultaneous operations
Performing some simultaneous operations while conducting a negative pressure test can
cause distractions in implementation and correct interpretation of this test. On April 20,
2010, there were simultaneous operations on the Deepwater Horizon rig floor during the
temporary abandonment of the Macondo well (BP report, 2010, page 91). Some examples
of those operations were cleaning and emptying the trip tank and some of the mud pits and
offloading the mud to the supply vessel M/V Damon Bankston.
According to several investigation reports, the simultaneous operations had a substantial
effect on the ability of the rig crew to monitor the well and the pit levels data

(BOEMRE
report, 2011, page 109; BP report, 2010, page 91; Chief Counsel’s report, 2011, page 177;
Hopkins, 2011; and SINTEF report, 2011, page 128). Consequently, this issue increased
81

the loss of well integrity risk on the DWH rig

(Presidential Commission report, 2011, page
125).
Decision to whether or not perform any simultaneous operation while conducting
temporary abandonment procedure and negative pressure test, as part of that procedure, can
be influenced by three of the described organizational factors in the previous section. These
factors are: 1) failure to follow MOC processes, 2) economic pressure, and 3) procedural
issues.
 Crew’s ability to monitor pit levels
Ability to monitor pit levels while conducting a negative pressure test enables crew to track
inflow and outflow from the well, as an important element in correct interpretation of this
test. It seems that the DWH rig crew was not able to monitor the pit levels while they were
conducting different simultaneous operations during the critical negative pressure test

(BOEMRE report, 2011, pages 109 and 195). One of the simultaneous operations was
displacing the spacer overboard. While the crew was accomplishing this task, the mud pit
Sperry-Sun monitoring system went out of function. Therefore, the crew had to shift to
another instrument on the DWH system with different scaling and read-out specifications.
That scaling system was not set to perceive small changes in the volume or pressure (Bea,
2011c).
Besides conducting simultaneous operations, rig crew’s ability to monitor the pit levels can
be impacted by four of the organizational factors explained in section 3.3.2.1, which are: 1)
personnel management issues, 2) procedural issues, 3) issues in communication and
processing of uncertainties, and 4) lack of an integrated, informed management.
 Further investigation of real-time data by onshore management
This action can be extremely beneficial in better interpretation of negative pressure test. If
onshore managers have access to a real-time monitoring system to track and analyze data
sent from offshore, they will be able to give timely feedback to onboard crew regarding
their method of implementing and interpreting negative pressure test. This way, onboard
rig crew can benefit from the experience of onshore management as well. In addition, the
rig environment with all ongoing transactions and operations can be quite stressful. This is
82

while onshore managers work in a more relaxed environment. Therefore, they can be able
to better analyze data and see some of the related problems more clearly.
In the DWH case, the BP onshore managers had the opportunity to access real-time data
through a system called “Insite Anywhere”. However, there was no further investigating of
the available real-time data using the explained system while that might have helped the
crew to realize that their conducted test was not actually successful (BOEMRE report, 2011,
page 96).
Based on the analysis of this action, it seems two of the described organizational factors in
section 3.3.2.1 had more impact on the stated action: 1) issues in communication and
processing of uncertainties and 2) lack of an integrated, informed management.
 Presence of required staff; e.g. drilling engineer, on the rig
Presence of required staff on the rig is one of the prerequisites to make sure that the needed
skill sets are available for conducting the negative pressure test. One of the main required
staff for implementing and monitoring NPT is drilling engineer. Based on the job
description for this position, company drilling engineer is responsible for providing
technical support to well site leaders

(BOEMRE report, 2011, page 98).
In the DWH case, the BP drilling engineer was not present on the rig floor on the day of
conducting the negative pressure test

(BOEMRE report, 2011, page 93). This is one
example of not having a well-integrated, informed management system. Based on the
explained job description for a drilling engineer, having that person present on the DWH
rig floor might have been a great help for the crew to recognize the anomalies of the
negative pressure test.
A noteworthy element which needs to be considered in all the stated decisions/actions regarding
implementation and interpretation of a negative pressure test is a well-known bias called
confirmation bias. Confirmation bias happens when an individual or a group of people just seek
evidence or interpret it in ways which are partial to existing beliefs, expectations, or in-hand
hypotheses. “Confirmation bias is the best known and most widely accepted notion of inferential
error to come out of the literature on human reasoning” (Nickerson, 1998).
83

Existence of this bias can negatively affect results of a conducted NPT. According to the
Deepwater Horizon Study Group (DHSG) report#3 (2010, Appendix B, page 10), the DWH rig
crew might have had confirmation bias in their interpretation of the negative pressure test results.
The second layer of the decisions/actions level consists of two components, which have been
called “diagnostic test results” in this research. These two elements are:
1) Failure to observe and respond to critical indicators
2) Negative pressure test misinterpretation
The reason for calling these two elements the “diagnostic test results” is because the second
element actually matches with the definition of the “false negative” in the diagnosis theory.
Based on our definition in this research, the false negative situation happens when crew does not
diagnose a failed test, which is equivalent to the second element stated above. We accounted the
first element as a “diagnostic test result” as well since it is the only component affecting the
second element.
The element “failure to observe and respond to critical indicators” has been affected by the upper
level decisions/actions in the proposed conceptual framework as well as some of the components
in the third level. Decisions/actions affecting this element are as follows:
 Calculate expected bleed-off volume to reduce pressure to zero
 Crew’s ability to monitor pit levels
 Further investigation of real-time data by onshore management
 Presence of required staff; e.g. drilling engineer, on the rig
Some of the components of the third level of the proposed framework affect the “failure to
observe and respond to critical indicators” as well. The influence of those components will be
discussed after introducing them in the next section.

3.3.2.3) Physical States of System/Basic Events Level
At this stage, we describe the elements of the bottom level in the introduced conceptual
framework, which are called the physical states of system or basic events. The reason for calling
them that is because those elements are some potential physical states for the studied system.
84

Similar to the second level, this level of the explained framework consists of two layers as well.
The first or the top layer includes some components of the system, which are affected by the
decisions/actions level and also by the second layer of this third level. The second or the bottom
layer consists of some elements, which are the root causes of the physical states displayed in the
aforementioned top layer.
First, let us describe the components of the second or the bottom layer in the physical states of
system or the basic events level since they influence the first/top layer. These components are:
 Part of mud/spacer below the BOP stack
As we explained in section 3.3.2.2, there is a possibility that part of spacer or mud remains
below the BOP stack while conducting a negative pressure test. It is critical to recognize
this state of the system since as we described before, this can cause issues such as plugging
lines, which affect results of the conducted test.
 Leak in the annular preventer
Recognizing this state of the system is crucial as well since leaking in the annular preventer
can cause spacer/mud moves below the BOP stack, as the above described state.
 Flow from the well
Another very critical situation is having flow from the well. Flow from the well includes
different series of scenarios such as issues in cement integrity, leaking in the well casing,
leaking in float equipment, and leaking in the liner-top area. Any of these scenarios can
causes influx of hydrocarbon into the wellbore. And, the main purpose of conducting a
NPT is to diagnose issues in this category.
Next are the first or the top layer elements in the physical states of system or the basic events
level:
 Viscous material being present across the chock and kill lines
As explained before, there is a possibility for presence of viscous material; e.g. spacer,
below the BOP stack, which can be across chock and kill lines as connected lines to the
BOP. As illustrated in figure 3.4, decisions such as type of spacer to use, amount of spacer
85

to use, and check whether all mud/spacer is above the BOP stack can influence this
physical state of the system.
Regarding the DWH case, one of the likely possibilities during the implementation of the
negative pressure test is the presence of viscous spacer across the chock and kill lines

(BOEMRE report, 2011, page 96 and Chief Counsel’s report, 2011, page 151).
As it was described above, decisions of using lost circulation material as the spacer and
using more spacer than normal were two of the contributing causes of having the viscous
material across the chock and kill lines in the DWH. Another influencing action in this
regard was the failure of the DWH crew to make sure that the whole spacer is above the
BOP stack.
 Plugged kill line
This state of the system can cause issues regarding reading and comparing pressures on the
drill pipe and the kill line as two connected lines, which at the end may lead to
misinterpretation of the conducted NPT.
As shown in figure 3.4, having plugged kill line can occur if there is part of mud/spacer
below the BOP stack and as a result of that, any viscous material is present across the
chock and kill lines. According to the BOEMRE report (2011, page 88) and the Chief
Counsel’s report (2011, page 299), the presence of viscous spacer might have plugged the
kill line in the DWH case and not allowed the gauge installed on the kill line to correctly
show the pressure inside the well. As a result, there was a pressure difference between the
drill pipe and the kill line; the following physical state of the system.
 Pressure difference between the drill pipe and the kill line
The above mentioned physical state of the system; plugged kill line, is one of the possible
reasons for pressure differential between the drill pipe and the kill line. Another possibility
for having such difference in pressure can be because of rig crew accidentally closes the
valve between the drill pipe and the kill line, which might have been the case in the DWH
(Chief Counsel’s report, 2011, page 160).

86

 # of barrels of bled-off fluid > expected bbl.
As we explained in section 3.3.2.2, crew needs to calculate the expected bleed-off volume
from the well when they reduce the inside pressure to zero. Comparing the calculated
volume against the actual bled-off fluid can be used as a criterion to interpret success or
failure of negative pressure test results. Bleeding off more fluid from the well comparing to
the expected volume, which has been calculated by crew, indicates an anomaly in
conducted NPT.
All the described physical states of the system in the bottom layer of the third level can be
influential in causing this situation. To be more specific, if part of spacer/mud remains
below the BOP stack, crew needs to bleed off more fluid from the well in order to decrease
the pressure to zero. In addition, leaking in the annular preventer can cause movement of
spacer/mud below the BOP stack. Finally, flow from the well increases the volume of bled-
off fluid in order to reduce the pressure to zero.
 Pressure built-up after fluid bleed-off
This status can also be another observation from the system or the well in which crew
conducts a negative pressure test. Observing any pressure built-up after bleeding off the
pressure to zero can be another anomaly in NPT results, which needs to be analyzed
carefully. In the DWH case, the crew observed 1400 psi pressure built-up in the drill pipe
in different trials of conducting the NPT (Chief Counsel’s report, 2011, page 156).
However, they did not interpret that as a failure in their implemented negative pressure test.
According to figure 3.4, all the three elements of “part of mud/spacer below the BOP
stack”, “ leak in the annular preventer” and “flow from the well” can cause this state of the
system as well.
 “P” cannot be bled off to zero
Not being able to reduce the pressure inside the well to zero by bleeding off fluid from the
well is another anomaly during implementation of a negative pressure test. As indicated in
figure 3.4, this situation can occur if there is part of mud/spacer below the BOP stack, if
there is any leaking in the annular preventer, and/or if there is any flow from the well.
87

After introducing all the physical states of the system; which are relevant to negative pressure
test results, we need to describe the ones that might have affected the first aforementioned
diagnostic test result, “failure to observe and respond to critical indicators”.
First of all, the combination of two of the physical states of the system can affect the stated
element. Those two physical states are: 1) pressure difference between the drill pipe and the kill
line and 2) plugged kill line. In the DWH case, the crew justified the pressure difference between
the drill pipe and the kill line as a phenomenon called the “bladder effect” (Chief Counsel’s
report, 2011, pages 158 and 159). This was a failure in observing critical indicators and
responding to them. The rig crew might have actually been able to recognize the failed test
knowing the possibility of having a plugged kill line.
In addition, three other components in the physical states of the system can contribute to failure
to observe and respond to critical indicators if crew does not take them into account as key
observations. Those three components are: 1) # of barrels of bled-off fluid > expected bbl., 2)
pressure built-up after fluid bleed-off, and 3) “P” cannot be bled off to zero.
As the summary to this section, a three-layer risk assessment framework was proposed to
analyze the contributing causes of a negative pressure test misinterpretation. The three layers of
the proposed framework were physical states of system/basic events in the bottom, the
decisions/actions in the middle, and the organizational factors on top. Next section describes
some of the results of analyzing this framework.

3.3.3) Summary of Results
Along with corroborating findings of previous studies, analysis of the proposed conceptual
framework in this research indicates that organizational factors are root causes of accumulated
errors and questionable decisions made by personnel or management. In this specific research,
those decisions/actions were associated with conducting and interpreting a negative pressure test.
Further analysis of the stated framework indicates the following hypotheses:
 The first three most influential organizational factors on misinterpreting a negative pressure
test are: 1) procedural issues, 2) economic pressure, and 3) personnel management issues.
We came to this conclusion by taking into account the number of out-coming arrows from
88

each of the organizational factors illustrated in figure 3.4, as an indication to the direct
impact of that factor on the second level elements of the framework. Moreover, we
considered the indirect effect of each organizational factor on the third level components.
 The four most important decisions or actions that affect negative pressure test
misinterpretation are: 1) simultaneous operations, 2) crew’s ability to monitor the pit levels,
3) make sure there is no leaking in the annular preventer, and 4) check whether all
mud/spacer is above the BOP stack. For this analysis, we considered the number of arrows
affecting each of these decisions/actions directly or indirectly.
Investigating the previous studies of accidents in offshore drilling and production corroborate
results of our model analysis. Based on this investigation, we realized that most of the captured
organizational factors in our proposed framework in figure 3.4 are common with the ones
identified in those studies. For instance, according to Pate-Cornell (1993), the main three
influencing organizational factors on the Piper Alpha accident were: personnel management,
economic pressure, and procedural issues. These three factors are the ones that we also identified
as the most influential elements in our model analysis. This is while the context of our study is
somehow different from the Piper Alpha.
In another comprehensive study, application of several management system practices is analyzed
in the context of different offshore drilling accidents (de Morais and Pinheiro, 2011). It is
noteworthy that most of the introduced practices are common with the captured organizational
factors in our study. Some of the main management system practices stated in that study are:
management of change; qualification, training, and personnel performance; information and
documentation management; and operational procedures.
Another remarkable point is that organizational factors are critical contributing causes of not
only offshore drilling accidents but also accidents in other offshore related operations. For
instance, organizational factors such as time urgency, training process, supervision, performance
evaluation, and communication have been identified as the main elements in reliability analysis
of oil tankers collision (Martins and Maturana, 2010).
If we analyze contributing causes of accidents in the whole oil and gas industry, and not only in
the offshore operations, we notice the critical contribution of organizational factors in those
accidents as well. One main instance of this statement is the result of a comprehensive study
89

which was supervised by the Norwegian Petroleum Safety Authority (PSA). According to this
study, which was based on 12 well control investigation reports and 21 event reports in the
period of 2003 to 2010, 78% of underlying causes of well control incidents are due to
organizational factors (Lootz et al., 2013 and RNNP project, 2011). This study introduces four
main influencing organizational factors as follows: deficient planning/preparation, deficient risk
assessment/analyses, deficient work practices/operational follow-up of barriers, and deficient
communication/cooperation/interface (Lootz et al., 2013 and RNNP project, 2011).
According to some other investigative studies of different well incidents, issues such as poor
training or poor learning from incidents and also ineffective communication are some of the
main contributing organizational factors to those incidents (Curole et al., 1999; Johnsen et al.,
2012; and Shaughnessy et al., 2003).
Finally, we need to specify that human and organizational factors are critical contributing causes
of accidents in other industries, rather than just oil and gas, as well. Organizational factors such
as personnel management issues, economic pressure, procedural issues, and issues in
communication have been identified as some of the major contributors of accidents in high-risk
industries like nuclear, aviation, and transportation. For instance, inadequate communication was
stated as one of the main contributing causes of the Three Mile Island nuclear meltdown
(Hopkins, 2001 and Walker, 2006). In another study, Ghosh and Apostolakis (2005) state that
HOFs play an important role in causing accidents in nuclear power plants.
Based on all the above analyses, we can conclude that although we have focused on the risk
analysis of the negative pressure test misinterpretation, as a specific context, our developed
framework can be generalized and be potentially useful for risk assessment of future oil and gas
drilling as well as other high-risk operations.
In addition to the described three-layer conceptual framework, we proposed a model to assess the
interoperation and interaction of multiple organizations. This model, which is a bi-product of this
research, has been described in the appendix “A” section. The main reason for stating this model
in the appendix is because it is a separate model from our introduced, integrated risk analysis
framework.
The combination of this model and our introduced conceptual risk analysis framework in this
section can be used as an integrated approach to analyze multi-organizational interactions and
90

interoperations with the focus on ineffective communication. The main reason for proposing
such approach is due to the fact that ineffective communication between companies and their
contractors has been introduced as a major root organizational factor causing large-scale
accidents. It is noteworthy that the stated proposed model is a generic framework, which can be
used for the analysis of multiple organizations interactions in different applications. In addition,
this model has been applied for the analysis of the Deepwater Horizon case study.
The next section will introduce the developed rational decision making model, as the third
building block of the proposed integrated risk analysis methodology in this research.

91

3.4) Rational Decision Making Model
As we explained in section 3.1, we were not able to quantify our developed Bayesian belief
network for risk analysis of negative pressure test misinterpretation. Therefore, we have
proposed a rational decision making model for the purpose of quantitatively analyzing the
implementation and interpretation of a negative pressure test. This model is the last approach
within the chain of our proposed integrated research methodology, as described in the
introduction section.
Section 3.4.1 introduces the proposed rational decision making model in detail. In section 3.4.2,
we explain some of the key concepts of the signal detection theory as the main foundation for
quantification of our developed model. Section 3.4.3 describes the process of quantifying the
introduced model in section 3.4.1. We illustrate some sensitivity analyses in section 3.4.4 and
explain the impact of different existing factors in the model on the risk of negative pressure test
misinterpretation. Additionally, we discuss some of the main decision making biases involved in
the process of interpreting a negative pressure test in that section. Finally, the summary of
observations and findings from the rational decision making model is stated in section 3.4.5.

3.4.1) General Model Description
The proposed framework in this section is a rational decision making model for the purpose of
interpreting the results of a negative pressure test. This model provides the crew and analysts
with a cut-off point value for observed pressure deviation in the system in which NPT is
conducted. This cut-off point indicates a threshold for rejecting the implemented negative
pressure test or equivalently, announcing inconclusiveness of the test for any observed pressure
deviation higher than that threshold. In this section, we first describe the structure and
influencing variables of the model. Then, we explain how this model is applied for decision
analysis of a conducted negative pressure test.
Components of the stated rational decision making model that we proposed in this dissertation
construct a part of our three-layer conceptual risk analysis framework, which was described in
section 3.3. This model is a simple, yet insightful framework for analyzing results of a conducted
NPT.
92

Our proposed rational decision making model consists of four main components, as illustrated in
figure 3.5. One of these components is our target variable, which is the pressure deviation
between the observed pressure in the second main phase of conducting a negative pressure test
and the expected pressure for that specific phase.
Generally, implementing a negative pressure test consists of two main phases. Phase I is the
process of displacing drilling mud with sweater inside drill pipe, closing the annular preventer on
the BOP, and measuring the pressure from the gauge installed in the cement unit on the surface.
And, phase II includes bleeding off more fluid from the well through drill pipe in order to reduce
the pressure to zero and watching for any pressure built-up in the system.
Pressure deviation, as explained above, is one of the main criteria for evaluating the success or
failure of a negative pressure test. In each stage of conducting such test, crew is able to measure
the pressure inside the well on the drill pipe and compare it with their expected pressure value. In
theory, the ideal value for the stated target variable; pressure deviation, is zero. This means that
in an ideal situation, crew expects to see no pressure deviation between the measured pressure
from the well in either phase I or phase II of implementing NPT and what they expected to
observe at that stage.
In our proposed model, we considered the value of pressure deviation in the second phase of
conducting a negative pressure test. However, this does not mean that crew does not record the
value of pressure in the first phase of conducting the test. This will be an additional piece of data
for further analysis of test results.
In the second of phase of performing a negative pressure test, the expected observed pressure is
zero since crew bled off enough fluid from the well to reduce the pressure to zero. Hence,
measured pressure from the well, which will be in the form of pressure built-up, is equivalent to
the pressure deviation as our target variable. It is needed to state that we have used the terms of
pressure deviation and pressure built-up interchangeably in the remaining of this document.
There are two main factors influencing the explained target variable in our proposed model.
These two variables, which affect the value of measured pressure from the gauge, are: 1) AP
(Annular Preventer) Leak; leak in the annular preventer on the BOP stack and 2) Well Leak;
flow from the well. If there is any leaking in the annular preventer, which is installed on the BOP
93

(figure 3.6), this can cause pressure built-up inside the well due to allowing heavier fluid to be
present in the annulus below the BOP stack.
Another source of pressure built-up during a negative pressure test implementation is having
flow from the well, which is equivalent to the existence of well integrity issues. Flow from the
well can be due to different potential issues in well integrity such as cementing issues or leaking
in wellhead seal, liner-top seal, well casing, and float equipment. Any of the aforementioned
issues can cause a well to flow meaning that the hydrocarbon inside the reservoir enters the well
and leads in pressure built-up in both the stated phases of conducting a negative pressure test.
Figure 3.7 shows some of the possible flow paths for hydrocarbon. The left hand side figure
illustrates hydrocarbon traveling up the annulus and through the seal assembly and the figure in
the right hand side demonstrates the entrance of hydrocarbon inside the production casing and its
migration through different possible flow paths.
AP Leak:
Leak in the annular
preventer
Well Leak:
Flow from the well
Target Variable:
Pressure deviation=
Actual Pressure-
Expected Pressure
(AP-EP)
Decision:
Ok/NOT OK?

Figure 3.5. Structure of the proposed rational decision making model
The stated target variable in figure 3.5 and its two influencing factors; AP leak and Well Leak,
are part of the third level of our risk analysis conceptual framework, which was described in
section 3.3. There is another element in the third level of the stated conceptual framework, which
we did not consider as an influencing factor on the target variable. This factor is having part of
spacer or mud, which was planned to be circulated above the BOP stack in the displacement
process, below the blowout preventer. This issue can cause higher observed pressure than
expected in the first phase of conducting NPT since spacer or mud is heavier than seawater.
94

Therefore, this can be a source of pressure deviation in phase I. However, in phase II, this factor
will have no impact on the observed pressure from the gauge since crew already bled off enough
fluid from the well, which caused zero pressure. Nevertheless, as stated before, crew needs to
record pressure deviation in both phases I and II and analyze the results based on all their
recorded data. These sets of data will enable them to better interpret the test results. For instance,
if crew observes some pressure deviation in the first phase of performing NPT while there is no
pressure built-up in the second phase, they can conclude that the main source of the observed
pressure deviation in phase I was having part of spacer or heavier mud below the BOP stack.
Therefore, there is no leaking in the annular preventer or flow from the well. This is because if
either AP Leak or Well Leak was present, then crew would have observed some pressure built-
up in the second phase as well.

Figure 3.6. Leak in the BOP annular preventer (Source of image: Chief Counsel’s report, 2011, page 154)
In addition to pressure recording, another important criterion that can assist the crew in better
interpretation of NPT results is the actual versus expected number of barrels of bled-off fluid
from a well in the second phase of conducting the test. For instance, if crew realizes that the
stated actual number of barrels is higher than what they expected to observe, this can be due to
the presence of either of those three stated influencing factors, which were part of spacer or mud
remained below the BOP stack, leaking in the annular preventer, and flow from the well.
However, if there is no pressure built-up in the second phase of implementing NPT, then crew
95

can conclude that the higher observed number of fled-off fluid was due to having part of spacer
or heavier mud below the BOP stack during the displacement process.

Figure 3.7. Possible flow paths for hydrocarbon (Source of image: Chief Counsel’s report, 2011, page 39)
We selected pressure deviation as the target variable for our proposed model rather than
comparing the actual number of bled-off fluid with the expected amount since there is smaller
measurement error associated with observing pressure from a gauge rather than tracking the
number of barrels of bled-off fluid from a well through the trip-tank system. In addition, pressure
reading and pressure recording is more commonly used as part of negative pressure test
procedures for most of the oil companies.
We contacted four main experts in the area of drilling and well design to make sure that the
structure and the involved variables in our proposed model are logical. All these experts kindly
helped us in validating the structure of our model as well as quantifying the results. One of our
experts, as an experienced drilling manager, preferred to remain anonymous. The other three
experts, who we contacted, are: 1) Mr. Stan A. Christman, retired ExxonMobil executive
engineering advisor, 2) Mr. Fred Dupriest, retired ExxonMobil chief drilling engineer and
lecturer at the Texas A&M University, and 3) Mr. Roger D. Gatte, BP retired wells
superintendent.
96

The fourth and the last element in our proposed model is a decision node to whether accept or
reject the negative pressure test conducted by crew. For making such decision, the other three
components of the model need to be quantified, and based on that quantification, a cut-off point
value for pressure deviation has to be calculated and be used as a threshold, as it was described
in the beginning of this section. This rational decision making model enables the crew to reject
any negative pressure test with an observed pressure deviation higher than the determined cut-off
point. This prevents next step investigations for interpreting the test results in the described
situation, which provides some cost saving. Of course, crew needs to investigate and identify the
contributing causes of an unsuccessful NPT, resolve those identified elements, and re-conduct
the test.
On the other hand, if the observed pressure deviation is less than the determined cut-off point
value but more than zero, crew still needs to conduct more investigations to evaluate whether the
conducted NPT is successful. For this purpose, they have to open the well and watch for flow for
several hours. For a successful negative pressure test, there has to be either no flow from the well
or a decreasing flow rate which stops within the period of watch for flow. It is noteworthy that
we ideally expect to see no flow from the well at this stage. However, there might be some flow
due to phenomena such as thermal effect and compressibility of fluid, which both cause fluid
expansion (Christman, 2014b and Dupriest, 2014a).
In addition, as explained before, taking into account the number of barrels of measured versus
expected bled-off fluid from the well can be useful in better interpretation of the test. For
instance, if the observed pressure deviation is less than the identified cut-off point while the
measured number of barrels of bled-off fluid from the well exceeds the expected amount, this
indicates an abnormal result for a negative pressure test. Therefore, crew needs to perform the
aforementioned watch for flow process for final conclusion about the test results.
As we explained in section 3.2.2, some of the existing procedures for NPT do not allow the
entrance of spacer or seawater inside the annulus. In such case, the two stated influencing
variables in our model are still valid as contributing causes of pressure deviation. However, the
factor of remained spacer or mud below the BOP stack does not exist anymore and that cannot
be a source of pressure deviation in phase I of conducting NPT, as we explained before.
Nevertheless, there is another factor as an additional source of pressure deviation in phase I and
97

that is pumping different amount of seawater inside the well during the displacement process.
This is equivalent to existence of less or more amount of mud inside drill pipe, which causes
pressure deviation from what crew expected to observe. Similar to the factor of having part of
spacer or mud remained below the BOP stack, this factor only contributes to pressure deviation
in the first phase of conducting a negative pressure test and it has no impact on phase II possible
pressure built-up.
We also discussed the possibility of using a packer during NPT implementation in section 3.2.2.
Using packer rather than conducting a negative pressure test through the annular preventer on the
BOP stack does not change our main variables in the model. The only change will be in having
the first variable as leaking in the packer seal and not the annular preventer seal.
At this stage, we further discuss different possible scenarios for the variables in our proposed
rational decision making model and explain the process of calculating the stated cut-off point.
However, exact formulas and numbers for determining the cut-off point value will be described
in the next sections.
As we explained, we have two influencing variables of leaking in the annular preventer (AP
Leak) and flow from the well (Well Leak). Each of these two variables can have two states of
yes (Y) and no (N) showing their presence. To be more specific, “AP Leak=Y” is equivalent to
having leakage in the BOP annular preventer, and “Well Leak=Y” means that the well that NPT
is conducted there is flowing. The combination of yes and no for each of these two variables
constructs four different states or scenarios as follows:
1) NN: There is neither any leaking in the annular preventer nor any flow from the well
2) YN: There is leaking in the annular preventer but there is no flow from the well
3) NY: There is no leaking in the annular preventer but there is flow from the well
4) YY: There is both leaking in the annular preventer and flow from the well
Any of the aforementioned states or scenarios affects the behavior of the target variable; pressure
deviation, differently. For instance, there is a much higher chance of having pressure built-up in
the well if the state “YY” is present comparing to the “NN” situation.
AP Leak and Well Leak as well as the target variable in the model are probabilistic. The first two
variables in this model are discrete binary elements while the target variable is continuous.
98

Therefore, we need to determine two discrete probability values of ) ( Y APLeak P  and
) ( Y WellLeak P  and four different probability distributions for the pressure deviation, as the
target variable, for the four aforementioned states.
Finally, we have the decision node in the model to whether accept or reject the test based on the
observed pressure deviation. In order to make the stated decision, there is need for calculating
the described cut-off point. For this purpose, we need a theory to help us choose a decision;
accepting or rejecting the conducted test, with a higher expected value. We believe that the
concept of decision processes in the signal detection theory is useful for what we require in this
section. In this regard, we first describe some preliminary concepts of decision processes in
signal detection theory in section 3.4.2 and then in section 3.4.3, we explain our extensive
equations and formulas for quantifying our proposed model using that theory.

3.4.2) Decision Processes in Signal Detection Theory
As explained briefly in the literature review chapter, signal detection theory is a computational
framework to discern signal from noise, while taking into account other influencing factors such
as biases within this distinction process. Figure 3.8 illustrates the main components of the theory
of decision processes in detection.

Figure 3.8. Signal detection theory and decision processes (Deplancke and Sparrow, 2014)
Based on this theory, we can have “m” different states of the world; h
1
, h
2
,…, h
m
, and “m”
different judgments or response alternatives associated to each state; H
1
, H
2
,…, H
m
(figure 3.9).
In the illustrated matrix in figure 3.9, each state has a prior probability of P(h
i
); i=0, 1, …, m. In
addition, there exists P(H
i
|h
j
) as the probability of having H
i
as the judgment or decision when
the state of system is h
j
(Green and Swets, 1974).

Physical
World
Sensory
Processes
Inference &
Decision
Processes

Response
Behavior
99

There will a pay-off value associated to the combination of each state and judgment; e.g. V
ij
as
the pay-off value for the judgment H
i
while the state is h
j
. The best judgment for the state h
j
will
be H
j
with zero associated cost; V
jj
=0.

Judgments

H
1
H
2
… H
i
H
j
… H
m

States of the world
h
1
1.0 P(h
1
)

h
2
1.0 P(h
2
)

…
1.0

h
i
1.0 P(h
i
)

h
j
P(H
i
|h
j
) 1.0 P(h
j
)

…
1.0

h
m

1.0
P(h
m
)

Figure 3.9. Matrix representing decision outcomes
Now, if we assume that there exist only two states and two judgments; m=2, the illustrated
matrix in figure 3.9 will only have 4 cells representing possible outcomes (figure 3.10). In this
case, there will be four pay-off values each associated to one of the stated possible outcomes.
These four values are:
1) V
00
: value associated with a correct choice of H
0

2) V
01
: value (cost) associated with an incorrect choice of H
1
(when, in fact, H
0
is the correct
judgment)
3) V
10
: value (cost) associated with an incorrect choice of H
0
(when, in fact, H
1
is the correct
judgment)
4) V
11
: value associated with a correct choice of H
1

Judgments

H
0
H
1

States of the world
h
0
P(H
0
|h
0
) P(H
1
|h
0
) 1.0 P(h
0
)
h
1
P(H
0
|h
1
) P(H
1
|h
1
) 1.0 P(h
1
)
Figure 3.10. Matrix representing possible outcomes for a binary decision
00 . 1 ) | ( 

j
j i
h H
For all j
100

Based upon availability of any new data or observation from the studied system, the value of
prior probability for each state can be updated to what is known as posterior probability. In
addition, decision makers can choose either H
0
or H
1
as their possible judgments.
Based on a specific goal set by decisions makers, choosing either H
0
or H
1
can be more
appropriate. If maximum expected value is the decision goal; which is what we have considered
as the objective for our decision making model, then the decision maker has to say H
0
if and only
if the inequality (3.1) holds.
) | H ( ) | H (
1 0
d EV d EV  (3.1)
Where, ) | H (
i
d EV is the expected value for saying or judging H
i
after observing the value “d”
from the system for our target variable.
Equation (3.1) can be simplified to:
11 1 01 0 10 1 00 0
* ) | ( * ) | ( * ) | ( * ) | ( V d h P V d h P V d h P V d h P    (3.2)
Therefore:
01 00
10 11
1
0
10 11 1 01 00 0
) | (
) | (
] [ * ) | ( ] [ * ) | (
V V
V V
d h P
d h P
V V d h P V V d h P


     (3.3)
Note:
01
V is non-positive since it is the pay-off value associated with misinterpretation of the
state “h
0
”. Therefore, the value of “
01 00
V V  ” is non-negative, and diving both sides of the above
inequality by that value does not change the direction of the inequality.
We know that
) | (
) | (
1
0
1
d h P
d h P
  is the posterior odd and it is equal to:
0
1
0
1
0
1
0
1
*
) (
) (
*
) | (
) | (
) | (
) | (
     
h P
h P
h d f
h d f
d h P
d h P
(3.4)
Where:
) | (
i
h d f is the conditional probability of the target variable being equal to “d” knowing that “h
i
”
is the state of system,
101

) | (
) | (
1
0
h d f
h d f
  is the likelihood ratio, and
) (
) (
1
0
0
h P
h P
  is the prior odd.
If we substitute equation (3.4) in the inequality (3.3), we will have:
0 01 00
10 11
0 01 00
10 11
1
0
01 00
10 11
1
0
1
0
* ) (
) (
* ) (
) (
) | (
) | (
) (
) (
*
) | (
) | (
 

 
 

 



V V
V V
V V
V V
h d f
h d f
V V
V V
h P
h P
h d f
h d f
 (3.5)
Based on the inequality (3.5), we can calculate a cut-off point value for our target variable which
holds in that inequality.
The introduced theory in this section is the foundation for deriving the required equations for our
quantitative decision making model. However, since our proposed model deals with four
different states based on the combination of AP Leak and Well Leak, we need to extend the
described process in this section in order to cover a four-state situation rather than 2 scenarios.
This process has been described in the next section.

3.4.3) Model Quantification
In this section, we derive a generalized formula for our described model based on the stated
theory and equations in section 3.4.2. As we explained before, there are four different scenarios
in our rational decision making model based on the combination of states for AP Leak and Well
Leak. We name these four scenarios as follows:
1) h
0:
NN: There is neither any leaking in the annular preventer nor any flow from the well
2) h
1:
YN: There is leaking in the annular preventer but there is no flow from the well
3) h
2:
NY: There is no leaking in the annular preventer but there is flow from the well
4) h
3:
YY: There is both leaking in the annular preventer and flow from the well
Based on the general theory, there is need for four judgments as well. However, we have
considered only two judgments for our model since interpreting a conducted NPT can be defined
102

as an acceptance or a rejection decision (H
0
: accept or say OK and H
1
: reject or say NOT OK).
Based on this definition, there exist four states and two judgments in this model.
The derived formulas in the previous section describe a two-state, two-judgment situation.
Therefore, we need to generalize those formulas for the scope of our model. As we explained in
section 3.4.2, judgment H
0
is selected if and only if the expected value for that judgment based
on the observed amount; “d”, for the target variable in the studied system is more than this
expected value when H
1
is chosen. In our model, the target variable is the pressure deviation
(Actual Pressure (AP)-Expected Pressure (EP)). Therefore, the value for “d” will be a pressure
deviation observed from the installed gauge in the cement unit on the surface while conducting
negative pressure test. Based on this explanation, there is need to choose H
0
if and only if:
) | H ( ) | H (
1 0
d EV d EV  (3.6)
Since there are four states in our model, as described above, we can extend equation (3.6) as
follows:
31 3 21 2 11 1 01 0
30 3 20 2 10 1 00 0
* ) | ( * ) | ( * ) | ( * ) | (
* ) | ( * ) | ( * ) | ( * ) | (
V d h P V d h P V d h P V d h P
V d h P V d h P V d h P V d h P
  
   
(3.7)
Figure 3.11 shows the decision tree associated with the above decision making process to either
accept or reject a conducted negative pressure test based on the observed pressure deviation “d”.
H
0
H
1
P(h
2
)
P(h
1
)
P(h
3
)
P(h
0
) v
00
V
10
V
20
V
30
P(h
2
)
P(h
1
)
P(h
3
)
P(h
0
) V
01
V
11
V
21
V
31

Figure 3.11. A decision tree for accepting or rejecting a NPT
103

Also, we can define the prior and posterior odds and the likelihood ratio for each state “h
i
”;
i=1,2,3, by comparing that state with the normal state, which is “h
0
” or “NN” (no leaking in the
annular preventer and no flow from the well). Based on this logic, we will have:
) | (
) | (
0
0
'
d h P
d h P
i
i   : Posterior odd for the state “h
i
” comparing to “h
0
” (3.8)
) | (
) | (
0
0
i
i
h d f
h d f
  : Likelihood ratio for the state “h
i
” comparing to “h
0
” (3.9)
) (
) (
0
0
i
i
h P
h P
  : Prior odd for the state “h
i
” comparing to “h
0
” (3.10)
According to the equation (3.4), we can extend the equation (3.8) into:
i i
i i i
i
h P
h P
h d f
h d f
d h P
d h P
0 0
0 0 0
0
'
*
) (
) (
*
) | (
) | (
) | (
) | (
      (3.11)
Therefore, the defined posterior odd for each state is the product of the likelihood ratio and the
prior odd for that state comparing to the state “h
0
”.
Equivalently, equation (3.11) can be written down as follows:
i i
i
d h P
d h P
0 0
0
*
) | (
) | (



(3.12)
If we substitute (3.12) in the inequality (3.7), we will have:
31
03 03
0
21
02 02
0
11
01 01
0
01 0
30
03 03
0
20
02 02
0
10
01 01
0
00 0
*
*
) | (
*
*
) | (
*
*
) | (
* ) | (
*
*
) | (
*
*
) | (
*
*
) | (
* ) | (
V
d h P
V
d h P
V
d h P
V d h P
V
d h P
V
d h P
V
d h P
V d h P













  
  
(3.13)
By simplifying (3.13), we get the following:
) (
*
) (
) (
*
) (
*
) (
*
) (
00 01
3
1 0 0
1 0
00 01
03 03
31 30
02 02
21 20
01 01
11 10
V V
V V
V V
V V V V V V
i i i
i i
 


  










   
(3.14)
Based on the derived inequality (3.14), we can determine a cut-off point value “e” for our target
variable which holds in that inequality. In another word, we can calculate a threshold for the
104

observed pressure deviation in the second phase of conducting a negative pressure test that for
any pressure deviation more than that, crew ought to reject the test (say H
1
).
In this specific case of conducting a negative pressure test, all associated pay-off values to each
combination of states and judgments are costs with negative values. Therefore, we can substitute
V
ij
with C
ij
; as a positive value for cost and change the direction of the inequality (3.14):
) (
*
) (
00 01
3
1 0 0
1 0
C C
C C
i i i
i i
 





(3.15)
For calculating the described cut-off point value using the above equation, there is need for three
main sets of data:
1) ) (
i
h P ; prior probability of the state “h
i
”; i=0,1,2,3
2) ) | (
i
h x f ; conditional probability of the pressure deviation being equal to “d” knowing
that the state of system is “h
i
” (x=pressure deviation or “AP-EP”)
3)
ij
C ; Cost of saying “H
j
”; j=0,1, while the state of system is “h
i
”; i=0,1,2,3
The main source of data gathering in this dissertation is expert judgment elicitation.
Unfortunately, we were not able to access any source of hard data regarding previous conducted
negative pressure tests from the literature or the databases of large corporations.
We were fortunate to receive the kind guidance of four main experts in the area of drilling and
well design for validating and quantifying our proposed rational decision making model. The
name and background of these experts were stated in section 3.4.1 while we were describing the
structure of our model. We contacted these four experts through both phone interview and email.
Due to the dependence of many of the required aforementioned sets of data to different
conditions under which a negative pressure test is implemented, such as depth, type of used
fluids, formation characteristics, and type and age of used annular preventer, we were not able to
get any generic datasets. In addition, those experts were not willing to give exact numbers for
some of the required sets of data, and that seems logical based on the described varying
conditions for each drilled well.
What we will state in the remainder of this section is our understanding and interpretation from
our personal communication with the aforementioned experts. In cases that we have the exact
105

numbers received from the experts, we will report them. Additionally, we will do some
sensitivity analyses on each of the stated datasets in order to assess the impact of each of those
sets on the explained cut-off point value. This way, we are not limited to one final answer for the
cut-off point value using the above, derived formulas.
It is also noteworthy that the main contribution of this section is the generic, parametric model
and equations that we proposed rather than the exact numbers entered into the model or the final
numerical results.
At this stage, we start with reporting data for the prior probability of the possible states in the
model. We talked about four different possible states of “NN”, “YN”, “NY”, and “YY” based on
the combination of “yes” or “no” for each of the two variables “leaking in the BOP annular
preventer” and “flow from the well”. The formula for the prior probability of each of these states
is as follows:
3 , 2 , 1 , 0 ); , ( ) (   i WellLeak APLeak P h P
i
(3.16)
Since AP Leak and Well Leak; leaking in the BOP annular preventer and flow from the well, are
independent variables, we can have the equation (3.16) as follows:
3 , 2 , 1 , 0 ); ( * ) ( ) (   i wellLeak P APLeak P h P
i
(3.17)
Based on this equation, we will have:
) ( * ) ( ) ( ) (
0
N WellLeak P N APLeak P NN P h P     (3.18)
) ( * ) ( ) ( ) (
1
N WellLeak P Y APLeak P YN P h P     (3.19)
) ( * ) ( ) ( ) (
2
Y WellLeak P N APLeak P NY P h P     (3.20)
) ( * ) ( ) ( ) (
3
Y WellLeak P Y APLeak P YY P h P     (3.21)
Based on what we derived above, we need two probabilities of ) ( Y APLeak P  and
) ( Y WellLeak P  . According to Christman (2013), there is a higher possibility for well integrity
issues and flow from the well rather than leaking in the annular preventer. He also stated that the
probability of leaking in the annular preventer; ) ( Y APLeak P  , depends on the specifications of
the annular; e.g. its manufacturer. Gatte (2014) and Dupriest (2014a) also confirmed the
106

described statement by explaining that the specifications of an annular preventer and its
condition; e.g. number of times it has been used in previous operations, influence ) ( Y APLeak P  .
According to Christman (2014a), probability of leaking in the annular preventer can be in the
range of 0.1% to 1%. Regarding the probability of flow from the well, Dupriest (2014a) stated
that leaks of wellhead seals, liner-top packer, or casing are very rare, and the probability of these
events all together can be around 1/3000. He also mentioned that it is, by far, more likely to have
leak path in the shoe, which includes the floats in the float collar, floats in the shoe, cement left
in the float joints, and cement that is outside casing from the shoe up to the pay zone. This
number has been stated to be around 1/300 by Dupriest (2014a). As a result, the combination of
these two probabilities makes ) ( Y WellLeak P  ; or probability of flow from the well, to be around
0.4%.
Based on all the above analyses, we interpreted that ) ( Y APLeak P  can be around 0.01 and
) ( Y WellLeak P  is approximately 0.02.
The second essential dataset for quantifying our proposed model is the conditional probability of
the target variable; pressure deviation, knowing the state of system. We needed to gather data
regarding the behavior of the pressure deviation variable for each of the four explained states in
the system. It is needed to state that all the ranges of pressure deviation for each of the four
scenarios are based on characteristics of a well like the Macondo in the DWH; in the matter of
depth, similarity of the formation type, use of the annular preventer on the BOP to conduct NPT,
etc.
The first state is the “NN” situation, which is the normal state by having no leaking in the
annular preventer or any flow from the well. Based on the unanimous opinion of all the
contacted experts, the most possible value for the pressure deviation in the state “NN” is zero
since both major sources of pressure built-up are absent. However, crew might see some pressure
deviation in this state due to factors such as thermal effect or fluid compressibility, which can
cause fluid expansion. According to our personal communications with the stated experts,
pressure built-up due to fluid expansion varies based on different conditions such as depth of the
well, temperature of fluid, and fluid hydraulic characteristics. Our interpretation based on those
communications was that the pressure deviation for the “NN” state can varies in the range of
107

zero to 400psi. One of the main reasons for such interpretation is based on some elicited data
from one of the experts. According to Christman (2014b), compressibility of fluids under
pressure and temperature (mostly for oil based fluids and not water based ones) are two of the
major sources of change in fluid density. He stated that the actual downhole fluid density can
increase around 0.2-0.4 ppg (pounds per gallon) due to compressibility effect and around 0.1-0.2
ppg due to thermal effect. We interpreted a fluid density change in the range of 0.1-0.4 based on
these two factors. Based on this interpretation, if we consider a well as deep as the Macondo with
the depth of 18300ft, the pressure deviation due to fluid compressibility and thermal effect can
be in the range of 95-380 psi, using the following formula:
) ( * ) ( * 052 . 0 ) ( ft h ppg psi P   (3.22)
Based on all the above analyses, the pressure deviation in the “NN” state can vary from zero to
something around 400psi. Since we know that zero is the most probable observed pressure
deviation for this state, the probability distribution of the target variable should have the highest
value at zero pressure deviation and decrease after that. This characteristic makes the exponential
distribution the best alternative for ) | (
0
h x f . The conditional probability distribution that we
considered for this state is a ) , ( k Weibull  with the shape factor (k) of 1, which is actually
equivalent to an exponential distribution with parameter

1
. We also considered 35   as the
scale parameter for this distribution. The behavior of the pressure deviation in this state based on
the specified  and k values has been illustrated in figure 3.12.

Figure 3.12. Probability distrubution for ) | (
0
h x f
108

The next state is the “YN” situation, which is equivalent to having leaking in the annular
preventer on the BOP but no flow from the well. In this situation, leaking in the BOP annular
preventer can be a source of pressure built-up in phase II after bleeding off the caused u-tube
pressure by the displacement process to zero. This leaking can cause a pressure built-up as much
as the whole bled-off u-tube pressure. For a case like the DWH, since some heavy spacer with
the density of 16 ppg was used, leaking in the annular preventer can cause movement of some
part of the spacer below the BOP stack, which can contribute to fairly high pressure built-up.
Based on my interpretation, this pressure deviation can be as high as 2900 psi. According to
Christman (2014a), in the worst case for the Deepwater Horizon situation, based on the 421 bbls
of spacer used by the crew, the bottom of the spacer can be at 8367 ft and the top at about 3000 ft.
We also know that there exists mud above the spacer inside the annulus and also the whole drill
pipe was full of seawater. Knowing all these components, the pressure difference between the
drill pipe and the annulus can be around 2900 psi, which is our reference for the pressure
deviation upper limit in the “YN” state. The following illustrates the calculation for the 2900 psi
pressure deviation based on the stated numbers:

We know that the density of sweater was around 8.55-8.6ppg, and the depth for the displaced
drilling mud with seawater, as explained in section 3.2.2, was 8367 ft.
Based all the above stated elements, we considered a ) , ( k Weibull  distribution with the scale
factor (  ) of 1400 psi and the shape factor of 4. It is right that the range of pressure deviation for
this state can vary from zero to 2900 psi. However, there is more possibility of observing high
pressure deviations in this state. Therefore, we need a probability distribution which is skewed
towards the right tale, and the stated parameter values ensure this behavior. This probability
distribution has been shown in figure 3.13.
psi difference P
psi annulus P
psi ft h ppg DP P
2900 ~ 2907 3785 6649 ) (
6649 ) 3000 8367 ( * 16 * 052 . 0 3000 * 14 * 052 . 0 ) (
3742 8367 * 7 . 8 * 052 . 0 ) ( * ) ( * 052 . 0 ) (
  
   
   
109

Figure 3.13. Probability distrubution for ) | (
1
h x f
The next state is “NY”, which is equivalent to no leaking in the annular preventer but having
flow from the well. In this situation, issues with well integrity can cause entrance of hydrocarbon
from reservoir inside the annulus, which contribute to pressure increase inside the well. After
bleeding off the pressure inside the well to zero, any pressure built-up due to hydrocarbon influx
into the well will be the difference between the formation pressure in the bottom of the well and
the hydrostatic head pressure. For a case like the DWH, the upper limit of this number was
around 1400-1500 psi knowing the characteristics of the formation and the method of conducting
the negative pressure test. As stated before, we have considered a well with the characteristics of
the Macondo. Therefore, we can consider the range of zero to 1500psi as an interval for the
pressure deviation in the state “NY”. Again, there is more possibility of observing high pressure
deviations within the stated interval. Hence, we need a probability distribution for this situation,
which is skewed towards its right tale. We assumed that ) | (
2
h x f is a ) , ( k Weibull  distribution
with 1000   and k=8, as illustrated in figure 3.14.
110

Figure 3.14. Probability distrubution for ) | (
2
h x f
The last state is “YY”, which is equivalent to both having leaking in the annular preventer and
flow from the well. In this state, pressure deviation can increase as much as the u-tube pressure
that crew bled off the fluid from to zero, and this value was around 2900 psi, as was explained
for the “YN” state. Therefore, we will have the range of zero to 2900 psi for this state as well this.
The only main difference between the “YN” and the “YY” states is that in the latter case,
pressure can rise up much quicker comparing to the first situation and this is due to the presence
of both AP Leak and Well Leak as sources of pressure built-up. Based on this analysis, we have
considered the same probability distribution for ) | (
3
h x f as it was the case for the ) | (
1
h x f .
The last required sets of data are C
ij
’s or the cost of saying “H
j
” to the state “h
i
”. What we have
considered in this regard is some cost ratios, rather than the exact monetary value for each C
ij
.
This way, knowing the exact value of each C
ij
is not necessary, which is something preferable
due to the variable cost of operations based on many factors such as location and daily operation
cost. Therefore, we can actually set some initial values for some of the costs and calculate other
dependent costs using the stated ratios. In later stages, we will also conduct some sensitivity
analyses in order to evaluate the impact of changing these ratios on the cut-off point value.
According to Christman (2013 and 2014c), if crew misinterprets a successful negative pressure
test by rejecting it, it takes several hours, or even one to two days, to investigate and re-conduct
the test. This can cause some costs between $0.5M and $2M. Therefore, C
01
= $0.5M-$2M.
111

On the other hand, if crew misinterprets a failed test and accepts the results, this can cause some
costs in an average range of $1B to $2.5B. This range is the author’s interpretation and it has
been deduced based on the given data that disastrous accidents in a scale similar to the DWH
blowout happen one in ten years (Christman, 2013). We know that the DWH approximately
caused $40B. We also know that there might be many other accidents with smaller cost scale due
to misinterpretation of a negative pressure test, and of course some other series of failure which
may contribute to those accidents. In addition, sometimes misinterpreting NPT can cause some
kicks in the well, but if crew can control the situation, associated cost can be around $2M-$4M
(Christman, 2013). In general, the following is what we considered to calculate the approximate
cost of misinterpreting an abnormal state, as a contributing cause of a failed NPT:
B M B 5 . 2 $ ~ 4 $ * 9 . 0 25 $ * 1 . 0 
In the above calculation, 0.1 is the described one big accident in an average of 10 years with an
approximate cost of $25B and the rest (0.9) are smaller incidents in which crew can attain
control of the well before any big explosion.
If we calculate the ratio between cost of rejecting a normal state and accepting an abnormal
situation based on the aforementioned costs, we can have a range of 1000 to 3000. In this model,
we have considered the value of 2000 as a basic amount for the described ratio. This value is
what we considered for the two ratios of (C
20
/C
01
) and (C
30
/C
01
). This is because C
20
and C
30
are
both associated with misinterpretation of an abnormal state in which there is flow from the well
as a source of not only pressure built-up but also some possible kicks that eventually can cause a
blowout.
It is needed to state that the value of the (C
20
/C
01
) and (C
30
/C
01
) might be less than 2000 if the
estimated probability of 1 big accident in 10 years is overestimated. However, as we discussed
before, we will conduct some sensitivity analyses on different influencing factors, including the
stated cost ratios, on the cut-off point value in the next section. This will assist us to identify how
sensitive the cut-off point value is to the described cost ratios.
The considered value for (C
10
/C
01
) is zero since although C
10
is associated with the situation of
accepting (saying “H
0
”) the test results for the abnormal state “h
1
”, this actually does not cause
any cost at the end. The reason for such case is that even if crew does not recognize leaking in
112

the annular preventer and accept the conducted test, there will be no harm; e.g. kick, in this
situation since there was no involved well integrity issue in this state.
There is need to identify three more costs in order to be able to determine all different
combinations of C
ij
. First is C
00
as the cost associated to correctly accepting NPT while the state
is normal. This cost has been considered to be zero in this document. For the second set of data,
we assumed that all C
i1
’s; i=1, 2,3, as the costs of rejecting NPT (saying “H
1
”) for the abnormal
states of “h
1
”, “h
2
”, and “h
3
” are the same and equal to C
1
=$0.5M. We deduced this value based
on the fact that if crew concludes that a negative pressure test is inconclusive, they have to
investigate the situation, resolve possible issues, and re-conduct the test, and we assumed that
this cost does not vary so much based on the presence of leaking in the annular preventer, flow
from the well, or both. Lastly, we assumed that C
01
, as the cost of rejecting NPT while the state
is normal (“NN”), is equal to C
i1
’s; i=1,2,3. This is due to considering the fact that if crew
misinterprets a normal state, they need to re-evaluate all the conditions and re-implement the test,
which cost them some similar amount as the stated C
i1
’s.
Based on all the stated numbers, we will have:
State “h
0
”: C
00
=0, C
01
=$0.5M
State “h
1
”: C
10
=0, C
11
=$0.5M
State “h
2
”: C
20
=2000*C
01
=$1B, C
21
=$0.5M
State “h
3
”: C
30
=2000*C
01
=$1B, C
31
=$0.5M
The summary of all the considered cost values and cost ratios has been shown in table 3.1.
Table 3.1. Cost matrix for state-judgment combinations

Judgment
H
0
H
1

State
P(h
i
)
h
0
=NN
0.9702 C
00
C
01
=C
1
h
1
=YN
0.0098 C
10
=C
1
C
11
=C
1

h
2
=NY
0.0198 C
20
=2000*C
01 C
21
=C
1

h
3
=YY
0.0002 C
30
=2000*C
01
C
31
=C
1

It is noteworthy that although the combination of each state-judgment can have both monetary
and non-monetary costs associated with it, the considered cost values in this research have been
113

focused on monetary costs. Expansion of the cost estimation system as an input to the proposed
rational decision making model is one of the areas of future research.
Based on all the three main sets of data, we were able to calculate needed values for the equation
(3.15) and determine the described cut-off point value by entering all the data in excel and
solving the stated equation using the “what-if analyses >- goal seek”. The calculated cut-off
point value based on the stated data in this section is 247 psi. Intuitively, the cut-off point is an
intersection of the conditional probabilities; ) | (
i
h x f , for different states in the farthest left hand
side. As it is shown in figure 3.15, ) | (
i
h x f have been intersected around 250 psi. However, there
are more detailed influencing elements, which determine the exact value of the cut-off point.

Figure 3.15. Joint diagram of all ) | (
i
h x f ’s
Determining 247 psi as the cut-off point value means that for any observed pressure built-up
more than this amount in the second phase of conducting NPT, crew needs to reject the test.
However, as it was explained in section 3.4.1, for any value less than this cut-off point, as long
as the observed pressure deviation is more than zero, crew needs to conduct more investigations
0
0.005
0.01
0.015
0.02
0.025
0.03
f(x|h0)
f(x|h2)
f(x|h1 or h3)
Pressure
deviation (psi)

As we
explained b
Probability

114

by taking into account the number of barrels of actual versus expected bled-off fluid from the
well in order to reduce the pressure to zero in phase II and also by watching the well for flow.
As we explained before in this section, our main purpose from this analysis is not to introduce an
exact cut-off point value to the practitioners of the oil and gas industry who deal with
implementation of negative pressure test, but to propose a rational decision making model
consisting of both a structure and also some generic, parametric equations for it in order to be
able to calculate the described cut-off point in that model based on data availability. What we
explained in this section are just some illustrations for quantifying such model using gathered
data from some experts of the field. Of course, all these calculations can be updated based upon
availability of more accurate or more detailed data. In addition, we will conduct some parametric
as well as numeric sensitivity analyses in the next section in order to illustrate the dependence of
the model target variable to different explained influencing factors. Moreover, we can describe
different biases involved in decision making, which can affect the final result and interpretation
of a conducted negative pressure test.

3.4.4) Model Sensitivity Analysis
In this section, we conduct both parametric and numeric sensitivity analyses in order to illustrate
the dependence level of the cut-off point value to the data inputs in the model.
The first sets of required input or data for our proposed model were the prior probabilities of all
four states; “h
i
”; i=0,1,2,3. We explained that the product of the two probabilities ) ( Y APLeak P 
and ) ( Y WellLeak P  constructs those prior probabilities. Therefore, conducting sensitivity
analyses on the states prior probability is equivalent to evaluating the impact of ) ( Y APLeak P 
and/ or ) ( Y WellLeak P  on the cut-off point value.
Based on equations (3.18) to (3.21), increasing the value of either ) ( Y APLeak P  or
) ( Y WellLeak P  , which are respectively the probability of leaking in the annular preventer and
the probability of flow from the well, reduces the prior probability of the normal state “h
0
” and at
the same time, it increases the prior probability of abnormal states; 3 , 2 , 1 ); (  i h P
i
. As a result,
the prior odd for each of the states “h
i
”; i=1,2,3, comparing to the normal state “h
0
” will decrease
115

based on the equation (3.10). Subsequently, this reduction contributes to an increase in the left
hand side value of the inequality (3.15), which causes a decrease in the cut-off point value
calculated from that inequality.
This analysis shows that increasing the value of ) ( Y APLeak P  or ) ( Y WellLeak P  reduces the
cut-off point value, and this reduction is equivalent to less possibility of accepting a negative
pressure test based on an observed pressure. Reversely, if crew underestimates either
) ( Y APLeak P  or ) ( Y WellLeak P  , this contributes to an increase in the cut-off point value and
subsequently, higher possibility of accepting a conducted NPT even for abnormal states, which is
something undesirable. This underestimation is a bias that negatively influences the outcomes of
our proposed rational decision making model.
Analyzing the contributing causes of such underestimation connects this bias to some root
organizational factors, which we described in our three-layer conceptual risk analysis framework
in section 3.3. Some of the main contributing organizational factors in this regard are as follows:
 Economic pressure; if personnel are under the pressure of completing operations faster in
order to save time and cost (most drilling operations have very high daily costs associated
with them, so even saving hours is critical to drilling teams), then there is a high
possibility of underestimating the probability of leaking in the annular preventer or/and
the probability of flow from the well.
 Personnel management issues; if personnel are not well trained or do not have enough
related experience regarding negative pressure testing and its influencing factors, they
might not be able to estimate the stated probabilities correctly.
 Issues in communication and processing of uncertainties and also lack of an integrated,
informed management; if there is no effective communication between personnel
regarding importance and associated risks of conducting and interpreting negative
pressure tests, there is a high possibility for wrong estimation of the stated probabilities.
In addition, existence of no management system to emphasize the importance of NPT or
to provide insight and feedback regarding personnel’s estimations and interpretations of
this test contributes to misestimating ) ( Y APLeak P  or/and ) ( Y WellLeak P  .
116

Our numerical analysis based on the entered data in the model confirms the described
interdependency between the probabilities ) ( Y APLeak P  and ) ( Y WellLeak P  and the cut-off
point value. As figure 3.16 indicates, decreasing the probability of leaking in the BOP annular
preventer increases the cut-off point value. We also highlighted the behavior of the
) ( Y APLeak P  within the interval [0,0.1] using a logarithmic scale for the horizontal axis in
figure 3.17. Based on both these figures, we can see that decreasing ) ( Y APLeak P  can increase
the cut-off point value as high as 252 psi.

Figure 3.16. Sensitivity analaysis of the cut-off point value based on
) ( Y APLeak P 

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1
Cut-off point "e" vs. P(AP Leak=Y)
Cut-off point "e" (psi)
P(AP Leak=Y)
117

Figure 3.17. Sensitivity analaysis of the cut-off point value based on
) ( Y APLeak P 
with the highlighted interval [0,0.1]
Figures 3.18 and 3.19 illustrate the dependence of the cut-off point value to ) ( Y WellLeak P  .
This trend is similar to the interdependence between the cut-off point value and ) ( Y APLeak P  .
However, in this case, if ) ( Y WellLeak P  becomes less than or equal to 0.000001, the cut-off
point will increase to infinity; meaning that any observed pressure deviation, no matter how high
it is, is acceptable. It is needed to state that we represented the infinity value for the cut-off point
with a large amount; e.g. 2000 psi, in both figures 3.18 and 3.19.
Cut-off point "e" vs. P(AP Leak=Y)
Cut-off point "e" (psi)

P(AP Leak=Y)
118

Figure 3.18. Sensitivity analaysis of the cut-off point value based on
) ( Y WellLeak P 

Figure 3.19. Sensitivity analaysis of the cut-off point value based on
) ( Y WellLeak P 
with the highlighted interval [0,0.1]
0
100
200
300
400
500
600
700
800
900
1000
1100
1200
1300
1400
1500
1600
1700
1800
1900
2000
2100
0 0.2 0.4 0.6 0.8 1
Cut-off point "e" vs. P(Well Leak=Y)
Cut-off point "e" (psi)
0
500
1000
1500
2000
2500
Cut-off point "e" vs. P(var2=Y)
Cut-off point "e" (psi)
P(Well Leak=Y)
P(Well Leak=Y)
119

Cost ratios were another set of required data for quantifying our proposed model. Two of the
main cost ratios stated in the previous section were (C
20
/C
01
) and (C
30
/C
01
), which represented
the cost associated with accepting NPT for an abnormal state; e.g. cost of probable kicks,
comparing to the cost of rejecting the test while situation is normal; e.g. cost of repeating the test.
The sensitivity analysis of the interdependence between the cut-off point value and the ratios
(C
20
/C
01
) or (C
30
/C
01
) indicates that decreasing the amount of either of these two ratios
contributes to an increase in the cut-off point value. This behavior is due to the reduction of C
20
and C
30
values by respectively decreasing the ratios (C
20
/C
01
) or (C
30
/C
01
); if we assume that the
value of C
01
is constant. Subsequently, based on the inequality (3.15), this reduction contributes
to the increase of the cut-off point value. This analysis shows that underestimation of the
aforementioned ratios causes an acceptance of a conducted NPT for more cases, including the
abnormal states. This underestimation can be considered as another bias, which is involved in the
decision making process for interpreting NPT results.
Analyzing the contributing causes of such underestimation connects this bias to all the
aforementioned root organizational factors, which were stated in the analysis of underestimating
the prior probabilities. Those organizational factors were: economic pressure, personnel
management issues, issues in communication and processing of uncertainties, and lack of an
integrated, informed management.
Our numerical analysis based on the entered data in the model confirms the described
interdependency between the cut-off point value and the cost ratios (C
20
/C
01
) or (C
30
/C
01
). As
figure 3.20 indicates, decreasing the amount of (C
20
/C
01
) or (C
30
/C
01
) increases the cut-off point
value to a level that this value becomes infinity. The trend of the explained interdependency for
smaller ratios has been highlighted in figure 3.21. As this figure shows, the cut-off point value
increases to infinity when either of the stated ratios decreases to an amount less than or equal to 2.
It is noteworthy that according to figures 3.20 and 3.21, the increase in the cut-off point value is
pretty small when the stated cost ratios decreases all the way to 500. This sensitivity analysis
shows that even if the value of 2000 as the base amount for (C
20
/C
01
) and (C
30
/C
01
) has been
overestimated due to the stated situation in the previous section that the probability of occurrence
of big accidents might be less than 0.1, that overestimation would not affect the value of the
calculated cut-off point that much.
120

In addition, our sensitivity analysis indicates that the initial cost value for C
01
does not affect the
cut-off point value. Based on this analysis, the only influencing cost related factors on the cut-off
point value are the cost ratios.

Figure 3.20. Sensitivity analaysis of the cut-off point value based on (C
20
/C
01
) or (C
30
/C
01
)

Figure 3.21. Sensitivity analaysis of the cut-off point value based on (C
20
/C
01
) or (C
30
/C
01
) with the highlighted interval [1,500]
0
50
100
150
200
250
300
350
400
450
500
550
600
650
700
750
800
850
900
950
1000
1050
Cut-off point "e" vs. ratios (C
20
/C
01
) and (C
30
/C
01
)
Cut-off point "e" (psi)
0
50
100
150
200
250
300
350
400
450
500
550
600
650
700
750
800
850
900
950
1000
1050
Cut-off point "e" vs. ratios (C
20
/C
01
) and (C
30
/C
01
)
Cut-off point "e" (psi)
(C
20
/C
01
) or (C
30
/C
01
)
(C
20
/C
01
) or (C
30
/C
01
)
121

The last set of inputs for the proposed decision making model were the conditional probabilities
of the target variable knowing state of system; ) | (
i
h x f . For conducting sensitivity analysis on
these conditional probabilities, we need to evaluate the dependence of the cut-off point value to
the parameters of each of these conditional probabilities. In the previous section, we considered a
) , ( k Weibull  distribution for each of the stated conditional probabilities.
The main item from these set of conditional probabilities is ) | (
0
h x f due to its impact on the cut-
off point value. In the previous section, ) | (
0
h x f was considered as a Weibull probability
distribution with the scale factor (  ) of 35 and a shape factor (k) of 1. We know that a Weibull
distribution with “k=1” is an exponential distribution. In addition, since the probability of the
pressure deviation being equal to zero is the most probable scenario for the state “h
0
”, ) | (
0
h x f
cannot be anything rather than an exponential distribution. Therefore, we cannot change the
shape factor of this conditional distribution while conducting any sensitivity analysis.
Sensitivity analysis of the cut-off point based on the scale factor (  ) of the probability ) | (
0
h x f
indicates that increasing the value of  causes an increase in the cut-off value (figure 3.22). This
behavior is due to the increase of the mean value of this conditional probability and its tale
extension to the right, which causes a shift to the right to the intersection between the conditional
probability distribution of the target variable for the normal state and this conditional probability
for abnormal scenarios, as it was illustrated in figure 3.15. This analysis shows that if the
maximum accepted amount for pressure deviation in the normal state is overestimated, that can
cause an increase in the cut-off point value, which is undesirable.
It noteworthy that there is a decreasing trend for the cut-off point value for any 500   . This
behavior can be justified by knowing that when  increases more than a threshold, which is 500
psi in this case, the distribution ) | (
0
h x f extends its tale to the right to a position that the
conditional probability of the target variable for the other states determine the cut-off point value
in a prior intersection.

122

Figure 3.22. Sensitivity analaysis of the cut-off point value based on  for f(x|h
0
)
All the above sensitivity analyses indicate that none of the stated biases, unless to their extreme
amount, can causes the cut-off point value to increase to something as high as 1400 psi, as an
accepted pressure built-up in the case of the Deepwater Horizon. Therefore, accepting such high
pressure deviation ought to exist due to the combination or confluence of some biases in decision
making and not as a result of one bias or error. For instance, if the prior probability of flow from
the well; ) ( Y WellLeak P  , is estimated to be 0.00001; comparing to the basic value of 0.02 that
we introduced in the previous section, and the cost ratios of (C
20
/C
01
) and (C
30
/C
01
) are predicted
to be 300; comparing to the basic value of 2000, the cut-off point value increases to 837 psi. We
still see that this threshold is less than 1400 psi. Another scenario can be the value of 0.00001 for
the prior probability of flow from the well and the value of 250 for the cost ratios of (C
20
/C
01
)
and (C
30
/C
01
). In this case, the cut-off point value increases to infinity, meaning that any
observed pressure built-up can be accepted.
Based on all these analyses, it seems that accepting a pressure built-up as high as 1400 psi by the
DWH crew was something irrational. Based on our analysis, it is almost impossible to reach a
cut-off point value as high as 1400psi, for a well with characteristics similar to the Macondo well,
in the scope of our proposed rational decision making model. This also indicates that most
probably, there were some other involved biases and issues in the process of interpreting the
negative pressure test conducted in the DWH. As stated in section3.3, one of the main involved
issues that the Deepwater Horizon Study Group (DHSG) report#3 (2011, Appendix B, Page 10)
highlighted as well is the DWH crew’s confirmation bias in interpreting the NPT results.
0
50
100
150
200
250
300
350
400
450
0 200 400 600 800 1000 1200 1400 1600 1800 2000 2200
Cut-off point "e" vs. λ or scale factor for f(x|h
0
)
Cut-off point "e" (psi)
λ for f(x|h
0
)

123

Justifying the observed 1400 psi pressure built-up on the drill pipe as a phenomenon called
“bladder effect”; which could not exist for the DWH situation, is one example for the existence
of the confirmation bias in the negative pressure test interpretation.
There are some main organizational factors as the root contributing causes of such bias. These
organizational factors are: economic pressure, personnel management issues, and issues in
communication and processing uncertainties.

3.4.5) Summary of Findings
This section summarizes the main findings of our quantitative model, which was described in
section 3.4. These findings have been stated below in bullet points.
 A rational decision making model, using the signal detection theory as a foundation, has
been used for quantitative analysis of negative pressure test interpretation.
 Expected value has been the main goal of the decision making system in this section.
Based on this goal, crew is recommended to choose a decision (acceptance or rejection of
NPT) with a higher expected value or a lower expected cost.
 The structure of the model has been validated by the contacted experts in the area of
drilling and well design. In addition, expert judgment is the source of data for the model
quantification.
 The main considered criterion for evaluating NPT results; the target variable, in this
model was pressure built-up in the second phase of implementing this test, when crew
bleeds off enough fluid from the well to reduce the pressure to zero.
 The two main factors influencing on the stated pressure deviation are: 1) AP Leak or
leaking in the BOP annular preventer and 2) Well Leak or flow from the well.
 This model provides the crew and analysts with a parametric formula to determine a cut-
off point value for observed pressure deviation in the system in which NPT is conducted.
 This cut-off point acts as a threshold for which crew ought to reject any conducted NPT
with an observed pressure deviation higher than that value.
124

 On the other hand, if the observed pressure deviation is less than the determined cut-off
point value but more than zero, crew still needs to conduct more investigations to
evaluate whether the conducted NPT is successful.
 The value of the cut-off point depends on the prior probability of the system states, the
conditional probability of the target variable knowing the state of the system, and the cost
associated with each state-judgment combination.
 The prior probability of all the possible states in this system depends on the probability of
the two influencing factors on the target variable, which are ) ( Y APLeak P  or
) ( Y WellLeak P  as respectively, the probability of leaking in the annular preventer and
the probability of flow from the well.
 The sensitivity analysis of the model against the prior probability of each state shows that
underestimating either ) ( Y APLeak P  or ) ( Y WellLeak P  contributes to an increase in
the cut-off point value and subsequently, higher possibility of accepting a conducted NPT
even for abnormal states, which is something undesirable (Figures 3.16-3.19).
 The sensitivity analysis of model based on the scale factor (  ) of the ) | (
0
h x f ; as the
conditional probability of the target variable for the state “h
0
”, indicates that increasing
the value of  causes an increase in the cut-off value (Figure 3.22). This analysis shows
that if the maximum accepted amount for pressure deviation in the normal state is
overestimated, that can cause an increase in the cut-off point value, which is undesirable.
 The sensitivity analysis of the interdependence between the cut-off point value and the
cost ratios (C
20
/C
01
) or (C
30
/C
01
) indicates that underestimating the amount of either of
these two ratios contributes to an increase in the cut-off point value.
 The aforementioned underestimations or overestimations are some biases that can affect
the results of the developed rational decision making model.
 Organizational factors are the root causes of the involved decision making biases in this
model. The main four root organizational factors in this regard are: economic pressure,
personnel management issues, issues in communication and processing of uncertainties,
and lack of an integrated, informed management.
125

 The main purpose from the numerical analyses in this section has not been to introduce
an exact cut-off point value to the practitioners of the oil and gas industry who deal with
implementation of negative pressure test, but to propose a structured rational decision
making model and some parametric equations for it in order to be able to calculate the
described cut-off point value based on the availability of data and also to analyze
different involved biases in the process of decision making within the implementation of
a negative pressure test.
 The oil and gas industry needs to improve its system of recording and reporting data;
especially, in the area of implementing negative pressure tests. We were not able to
access any sort of hard data with the needed level of detail for the analysis of our
developed model. The contacted organizations for this purpose, which include a wide
range of companies around the world, claimed that such detailed data does not exist in
their databases. Existence of this situation indicates that oil and gas companies need to
develop more appropriate reporting systems for data collection.
In the next chapter, the aforementioned framework for the analysis of interoperations among
multiple organizations will be described. As stated before, the combination of this model and the
introduced conceptual risk analysis framework in section 3.3 can be used as an integrated
approach to analyze multi-organizational interactions with the focus on ineffective
communication, as a root organizational factor contributing to large-scale accidents.

126

4) Summary and Conclusion
This dissertation introduced a risk analysis methodology to systematically assess the critical role
of human and organizational factors in offshore drilling safety. The proposed methodology in
this research focused on a specific procedure known as the negative pressure test and analyzed
the contributing causes of misinterpreting such a critical test. In addition, the case study of the
BP Deepwater Horizon accident and its conducted NPT was discussed.
Considering the existing trade-off between the increasing risk of offshore and deepwater drilling
and the rising dependence on oil and gas, there is a growing need for oil companies to
incorporate suitable risk analysis practices into their operations. Risk assessment frameworks
enable oil companies to analyze the increasing risks of offshore and deepwater drilling and
develop appropriate contingency and mitigation plans for risk reduction.
Another important element in analyzing offshore drilling accidents is the critical role of human
and organizational factors as a main contributor to those accidents. A comprehensive study of
more than 600 well-documented major failures in offshore structures was performed by the
Marine Technology and Management Group, the Center for Risk Mitigation, and the Center for
Catastrophic Risk Management at the University of California Berkeley. The study, which took
into account the data from 1988 to 2005, indicated that approximately 80% of those failures were
due to HOFs (Bea, 2002b and 2006).
It is noteworthy that this research identified a critical gap in the literature regarding the existence
of enough risk assessment approaches analyzing the crucial role of human and organizational
factors in the context of offshore drilling.
As stated above, the scope of this study has been narrowed down to analyze issues with the
negative pressure test, which was identified as the key contributing cause to the DWH accident.
NPTs are currently the only way to test cement integrity at the bottom of a well (Chief Counsel’s
report, 2011, page 143). They are used to indicate whether a cement barrier and other flow
barriers can isolate the well and prevent hydrocarbon influx (NRE/NRC report, 2011, page 18).
As a result, they are important procedural step for temporary abandonment in most offshore
drilling, and any prescriptive model that details the most influential factors for correctly
127

conducting and interpreting NPTs could significantly reduce the risk of future accidents in
offshore platforms.
The risk analysis methodology in this dissertation consisted of three different approaches and
their integration constituted the big picture of my whole methodology. Each approach is a
foundation or a prerequisite step for developing the next one. The first approach was the
comparative analysis of a “standard” NPT with the test conducted by the DWH crew. This
analysis contributed to identifying the involved discrepancies between the two test procedures.
The second approach in the chain of the developed integrated methodology in this research was a
conceptual risk assessment framework to analyze the causal factors of the identified mismatches
in the previous approach, as the main contributors of negative pressure test misinterpretation.
This framework displays different influencing factors of NPT misinterpretation in three layers.
The bottom layer, which is called the physical state of system or basic events, includes the
system related elements that affect implementation and interpretation of NPT. The second layer
indicates decisions or actions made by crew or management, which influence results of a
conducted NPT directly or indirectly. Finally, the top level consists of the root organizational
factors influencing the decisions or actions displayed in the middle layer.
Finally, the third proposed approach in this research was a rational decision making model, using
the signal detection theory as a foundation, to quantify a section of the developed conceptual
framework and analyze the impact of different decision making biases on negative pressure test
results.
From a different angle, a four-layer framework was proposed to assess the interoperation of
multiple organizations in complex systems. The combination of this model and the introduced
conceptual risk analysis framework can be used as an integrated approach to analyze multi-
organizational interactions with the focus on ineffective communication, as a root organizational
factor contributing to large-scale accidents.
Along with the corroborating findings of previous studies, analysis of the proposed conceptual
framework in this research indicated that organizational factors are root causes of accumulated
errors and questionable decisions made by personnel or management. In this specific research,
those decisions/actions were associated with conducting and interpreting a negative pressure test.
Further analysis of this framework identified procedural issues, economic pressure, and
128

personnel management issues as the most influential organizational factors on misinterpreting a
negative pressure test. It is noteworthy that the captured organizational factors in the introduced
conceptual framework are not only specific to the scope of the NPT. The three aforementioned
organizational factors have been identified as common contributing causes of other offshore
drilling accidents as well.
The developed rational decision making model in this dissertation is a framework for the analysis
of a conducted negative pressure test. This framework provided a structure and some parametric
derived formulas to determine a cut-off point value for the observed pressure built-up in the
second phase of conducting a NPT. This cut-off point assists the crew in accepting or rejecting
an implemented negative pressure test.
In this research, expert judgment elicitation was used as the main source of data for quantifying
the aforementioned rational decision making model. The main purpose from the numerical
analyses of this model has not been to introduce an exact cut-off point value to the practitioners
of the oil and gas industry who deal with implementation of negative pressure test, but to
propose a structured rational decision making model and some parametric equations for it in
order to be able to calculate the described cut-off point value based on the availability of data. In
addition, this model enables analysts to assess different decision making biases involved in the
process of interpreting a conducted negative pressure test as well as the root organizational
factors of those biases.
It is noteworthy that the described rational decision making model in this research can be applied
in different situations. It is possible to integrate the interaction between decision makers and
system using such a model. Utilizing such framework contributes to better decision making by
incorporating observations from a system as a feedback to update required data in the model
such as prior and conditional probabilities.
Human and organizational factors are critical contributing causes of accidents in the whole oil
and gas industry. In addition, HOFs have been identified as main contributors to accidents in
other high-risk industries as well. Some examples of those industries are nuclear power plants,
aviation industry, and transportation sector. Based on this analysis, the developed risk
assessment methodology in this research can be generalized and be potentially useful for risk
129

analysis of other well control situations, both offshore and onshore; e.g. fracking. In addition,
this methodology can be applied for the analysis of any high-risk operations, in not only the oil
and gas industry but also in other industries such as nuclear power plants, aviation industry, and
transportation sector.
130

5) Recommendations
The following are some recommendations based on the analysis of results in this research:
 Proactive human-systems integration and safety culture analyses are critical for ensuring
the safety of not only offshore drilling but also other high-risk operations.
 The developed integrated risk assessment methodology in this research can be
generalized for safety and reliability analysis of different high-risk operations.
 The oil and gas industry needs to improve its system of recording and reporting data. In
this research, we were not able to access any hard data on different contributing causes of
offshore drilling accidents with an emphasis on NPT misinterpretation. According to our
personal communications with different regulatory agencies and organizations that record
data in this regard, no such detailed data exists in their available databases. If that is the
case, there is a need for more detail-oriented systems for recording and reporting data
within the oil and gas industry. The databases prepared within these systems are valuable
assets and can be used for prevention of future accidents.
 Accessing companies records and available databases of previously conducted NPTs and
integrating them with experts’ opinion can improve the accuracy of the estimated input
values to the proposed rational decision making model and consequently the outcomes of
the model.
 Existence of a real-time operating center to remotely monitor well sites operations data
can contribute to safety and reliability of oil and gas drilling.
 The oil and gas drilling industry needs to introduce a national independent organization
to oversee all drilling operations which are implemented by different oil and gas
companies.
 Oil and gas companies need to improve their safety culture and the root organizational
factors contributing to it by:
 Improving responses to economic pressure: Establishing a balance between
production and safety; e.g. incorporating equivalent number of performance
131

measures for safety achievements comparing to production and cost saving
accomplishments, defining rewarding systems for safe operations
 Improving personnel management issues: Providing specific training to personnel
who deals with complex operations such as NPTs, auditing trained personnel by
experienced experts in order to make sure that they have achieved the proper level of
expertise in their training, integrating trainings on safety culture and non-technical
skills into workplace procedures (Ershaghi and Luna, 2011)
 Improving procedural issues (i.e., standard operating procedures and test protocols):
Preparing detailed, documented procedures for each complex operation such as a
NPT, requiring the documentation of all lessons learned from previous incidents and
accidents
 Improving communicational issues: Communicating the importance of specific
operations such as NPTs and their associated risks to personnel, defining clear lines
of communication, designing standard and well-understood reporting infrastructures,
incorporating appropriate rewarding systems for reporting incidents, rearrangement
or redesign of monitoring and control rooms (Curole et al., 1999)
132

6) Future Work
There following are some potential areas for future work along this dissertation subject:
 Improving the proposed quantitative model by using more data; in this dissertation,
expert judgment was the only available source of data. As a future research, numerical
analyses of the proposed rational decision making model in this study can be updated
based on the availability of hard data from previously conducted negative pressure tests
in different drilling platforms. This objective is possible if oil companies or related
organizations who posses these types of data grant analysts with the access to their
databases for the purpose of research development.
 Expanding the cost estimation system in the proposed rational decision making model by
including both monetary and non-monetary costs
 Expanding the proposed decision making model by including more factors from the
introduced three-layer conceptual risk analysis framework; there were only some of the
contributing factors of negative pressure test misinterpretation included in the stated
decision making model. In the next step, this model can be expanded by incorporating
more influencing factors of such misinterpretation; especially, from the decisions/actions
and the organizational factors layers. It is noteworthy that including more factors in the
model is equivalent to increasing the number of nodes and connections, which escalates
the number of needed data for quantifying such model.
 Using a Bayesian belief network as another appropriate method to quantify the proposed
conceptual risk analysis framework in this research; as stated before, the main reason for
not pursuing the use of BBN in this dissertation was the lack of access to data.
 Developing a measurement system to evaluate the status of companies against each
captured organizational factor in the three-layer conceptual risk analysis framework;
quantifying those organizational factors enables companies and their analysts to evaluate
their status regarding each of those factors. In one step further, that quantification can be
integrated into a quantitative risk analysis for a studied system or a high-risk operation
within those companies.
133

 Collaborating with SINTEF or major oil companies to determine whether the numerical
results of this research analysis can be confirmed using their data on previously
conducted NPTs
 Developing an analytical model which can be generalized and become the backbone for a
Decision Support System (DSS) and an expert system to reduce the risk of
misinterpreting NPTs or other critical tests such as cement bond log

134

Appendix A: A Proposed Model to Study Interoperability and
Interactions of Multiple Organizations
The proposed approach in this section focuses on so called “high-risk” systems in which large-
scale accidents of low likelihood of occurrence but high level of severity or magnitude of loss
occur. As explained in chapter 2, these systems are typically involved in performing tightly
coupled and interactively complex operations.
Adding to the complexity of high-risk systems are interactions among multiple involved
organizations where lack of coordination and communication between them are important
sources of unsafe behavior and accidents (Leveson, 2011).
The oil and gas industry is an example of a highly interdependent system in which different
organizations interact with each other to conduct symbiotic operations. As a result, accidents in
this industry can occur when key players fail to interact, as part of management failure and
compromise on safety culture (e.g. Hopkins, 2008 and Goh et al., 2012).
As we described in the previous section, the Deepwater Horizon blowout, of April 2010 in the
Gulf of Mexico, is a case study of large-scale accidents in the oil and gas industry caused by the
failure of industry management; in particular by a lack of safety culture and ineffective
communication between BP and its contractors (Chief Counsel’s report, 2011; Christou and
Konstantinidou, 2012; Coast Guard report, 2011; Hopkins, 2012; and Presidential Commission
report, 2011). The issue of ineffective communication was also one of the captured
organizational factors in our three-layer conceptual risk analysis model described in section 3.3,
as a major root contributing cause of negative pressure test misinterpretation.
Based on this analysis, developing a systematic approach to assess interoperation and interaction
of multiple organizations in a high-risk system is beneficial for prevention of large-scale
accidents. As explained in the introduction section, the combination of this model and our
introduced conceptual risk analysis framework in section 3.3 can be used as an integrated
approach to analyze multi-organizational interactions with the focus on ineffective
communication.
135

In summary, section 3.5.1 describes the proposed generic model for analysis of multi-
organizational interactions and section 3.5.2 explains that model in the context of the Deepwater
Horizon application.

A.1) Model Description
As stated above, the main objective of the proposed framework in this section is to model
interactions of multiple key organizations in a high-risk system and evaluate those interactions in
order to identify risks associated with them and propose proactive solutions to prevent such risks
from occurring. It is a four-layer multi-organizational framework based on the proposed model
of Rasmussen in 1994, which was used to analyze the interaction and communication of work
activities and decision makers within an organization. The theoretical foundations of that model
were discussed in the Rasmussen, Pejtersen, and Goodstein (1994). That model was later stated
in the Rasmussen and Svedung (2000) as well.
The Rasmussen’s model relies on the propagation of interactions between work domain "bottom-
up" requirements and "top-down" social practice and management style (Figure 4.1). Bottom-up
propagation relates to functional constraints, which determine the structure and content of
communication between work activities and decision makers. And, top-down stream influences
the form of communication.

Figure 4.1. A multi-layer interaction model for top-down and bottom-up coordination (Rasmussen and Svedung, 2000)
136

In the first layer of the Rasmussen’s model, the form of communication and interaction among
team members of studied organization is defined by a leader or by one or more of the team
affiliates. Components such as values and intentions, management style, and objective and
constraints constitute the form of communication.
The second layer of the stated model analyzes the interaction among different team members
within an organization. And finally, level of work activities, which is the lowest level of work, is
defined in the last layer of the model.
Our proposed framework builds on the Rasmussen’s model to be able to analyze multiple
organizations interactions using four main layers (Figure 4.2). Level I represents meta-system
interactions as an integrated system, i.e. a systems-of-systems, which models and manages the
interaction of all the existing organizations at a social level. Level II illustrates the bi-lateral
interactions of the existing organizations in an identified high-risk system. Interactions in this
layer are organizational.
Level III is work related and captures organizations' bi-lateral interactions at the operations level.
Finally, level IV models the interactions among operators in worksite operations within
organizations.
In the proposed framework in this section, higher levels project onto lower levels. For instance,
the top level projects on the second layer as a decomposition of an integrated control structure
into separate bi-lateral organizational interactions. Similarly, the intersection of two
organizations in the second layer is projected as a separate component onto the third level to
capture the bi-lateral work interactions of those two organizations. Finally, third layer
components project onto the fourth level as interactions among operators within the identified
organizations.
The first step in developing the explained framework is to identify all key players or
organizations existing in the studied high-risk system. We then define the meta-system in which
all key players interact. This meta-system is illustrated in the top layer of the framework.
The second layer presents the bi-lateral organizational interactions among existing key players
and captures those interactions at a high management level. These interactions are broken down
137

into bi-lateral, work related interoperations in the third layer. The last step models interactions
among lowest level operators of work activities within all the identified organizations.
Level of bi-lateral work interactions
Level of bi-lateral organizational interactions
Org. A
Org. B
Org. C
Level of meta-system interactions
System-of-
Systems
A & C work
interactions
B & C work
interactions
A & B work
interactions
I
III
II
Level of worksite operations interactions
Interactions among operators within
organizations
IV

Figure 4.2. Four-layer framework for risk analysis of interactions among multiple organizations

The main objective of our proposed framework is to analyze interactions of multiple
organizations in high-risk systems. One main step in risk analysis of the identified organizations
modeled within our framework is to understand interactions among these organizations. Hartley
and Tolk (2010) proposed the concept of “work-as-planned” target that must be well defined
between such organizations versus the actual "work-as-done". Analytical comparison of “work-
as-done” and “work-as-planned” indicates discrepancies in organizations interactions, which can
be used to identify risks of ineffective communication among those organizations (Figure 4.3).
138

Figure 4.3. “Work-as-done” versus “work-as-planned” (Department of Energy (DOE) Handbook, 2012)
Interactions of multiple organizations can be analyzed in two different situations. The first
assesses interoperation of different key players in regular situations with no specific
emergencies. The second analyzes communication of multiple organizations involved in
emergency response situations. In either scenario, the steps from our proposed model can be used
to capture the desired level of interactions among studied organizations based on the nature of an
existing situation. We will elaborate using instances of ineffective communication in the case of
the DWH accident for both regular and emergency response situations in the next section.

A.2) Case Study of the BP Deepwater Horizon Accident
As it was explained before, management failure and more specifically ineffective communication
between BP and its contractors were major contributing causes of the Deepwater Horizon
accident. The main contractors of BP in the DWH case were Transocean; as the owner of the rig,
and Halliburton; as the main responsible company for cementing related services.
In this section, we intend to model and analyze interactions and communications among the three
stated key players of the Deepwater Horizon case; BP, Transocean, and Halliburton, using the
described framework in section 3.5.1.
139

Before explaining the process of developing the specified risk analysis framework for modeling
interactions among the aforementioned key players, we would like to highlight the critical role
and importance of ineffective communication in causing the Deepwater Horizon accident.
According to the Chief Counsel’s report on the DWH blowout (2011, page 227), “inadequate
communication and excessive compartmentalization of information contributed to the Macondo
blowout”. Some of the main stated examples of communicational issues in this report are as
follows: information compartmentalization both within and between companies, not using
internal technical experts effectively by not appropriately communicating risks of different
operations with them, not calling shore managers to consult with them in unclear situations, and
not properly sharing lessons learned from previous incidents and accidents among companies.
In addition, according to the analysis of the proposed conceptual framework in section 3.3, issues
in communication are one of the main captured organizational factors, which contributed to the
negative pressure test misinterpretation. Moreover, as stated in section 3.3.3, corroborating
observations of other investigation studies on previous oil and gas drilling accidents indicate that
ineffective communication was one of the major contributing causes of those accidents as well.
At this stage, let us explain the process of developing the described framework in section 3.5.1
for the DWH accident case study. The first step in developing this framework is to determine the
components of each of the layers of the model. Based on the framework description in the
previous section, the top layer comprises a meta-system, which consists of two main elements for
the DWH case study: the oil and gas drilling industry and the related regulatory agencies. Among
the oil and gas drilling industry, there are three organizations stated above that played a critical
role in the Deepwater Horizon case (Figure 4.4).
The second layer of the framework presents the bi-lateral interactions of the three
aforementioned key players in an organizational level. This level of interactions is mostly
focused on communication of onshore offices of those three players with each other in order to
make necessary arrangements for offshore operations.
The third layer illustrates the bi-lateral interactions of BP, Transocean, and Halliburton on the
DWH rig. This level of interactions is mostly operational related. At this stage, onboard
managers interact with each other in order to arrange required activities on the rig and make sure
that those activities are done properly.
140

Level of bi-lateral work interactions (on the DWH rig)
Level of bi-lateral organizational interactions (onshore)
BP
Halliburton
Transocean
Level of meta-system interactions
System-of-
Systems
BP & Transocean
Transocean &
Halliburton
BP & Halliburton
I
III
II
Level of worksite operations; interactions of workers/
operators, e.g. drillers and mudloggers
IV
Interactions among operators within
organizations

Figure 4.4. Four-layer framework for risk analysis of interactions in the Deepwater Horizon case study
Finally, the interactions among operators of those three organizations are presented and analyzed
in the bottom layer of the model. This stage of work can be expressed as the worksite operations.
The next step after modeling the interactions among the stated key players in the DWH case
study is the analysis of the modeled interactions. For this purpose, there is need for analyzing
both “work-as-done” and “work-as-planned” cases, which the first one represents the way that
those three key players interacted with each other in the Deepwater Horizon case and the latter
indicates the communication approaches that they should have considered in order to minimize
the risk of miscommunication as one of the introduced causes of the accident.
Based on the above description, we first explain the “work-as-done” situation for the DWH case
by bringing up some of the main miscommunication instances among the three stated key players.
141

Then, we elaborate on some recommendations for the improvement of interactions among those
key players by comparing the “work-as-done” with the “work-as-planned”.
The description of “work-as-done” in this section has been separated by explaining some of the
instances of miscommunication among the studied organizations in each of the stated layers in
the proposed framework. The stated “work-as-done” description in different layers of the
framework has been connected to the organizational structure of the Deepwater Horizon (figure
4.5) in order to provide a better perspective about the interaction of BP, Transocean, and
Halliburton in different instances.
As it is illustrated in figure 4.5, the three main players of the DWH case communicated with
each other both onshore and on the rig, which connects this organizational structure to the second
and the third layer of the introduced framework in this section. To be more specific, the bi-lateral
interactions between BP and Transocean and also the communication between BP and
Halliburton; both onshore, have been illustrated by dotted lines on the left section of figure 4.5.
Accordingly, these interactions have been modeled in the second layer of the proposed
framework in this section.
There were different instances of miscommunication between BP and Transocean in the onshore
level. In one instance, BP did not effectively communicate the details of the risk management
system developed by its top management with the Transocean managers. In another situation, not
all lessons learned from previous similar accidents or incidents on operated rigs by Transocean
were shared with BP (Hopkins, 2012). For instance, apparently, Transocean experienced a
remarkably similar incident in the North Sea four months before the DWH accident while
completing a well for Shell (Chief Counsel’s report, 2011 and Hopkins, 2012). Fortunately, they
were able to shut in the well before any explosion by activating the blowout preventer. Had the
Deepwater Horizon crew known about such similar incident, it was less likely for them to make
decisions that led to the Macondo well blowout (Chief Counsel’s report, 2011 and Hopkins,
2012).
142

Figure 4.5. Deepwater Horizon Organizational Structure (Chief Counsel’s report, 2011)

143

Other important series of miscommunication discussed in the published investigation reports for
the DWH blowout were between BP and Halliburton in the onshore side. For instance, the
format of Halliburton modeling reports is debated to be the source of communication difficulties.
According to the Chief Counsel’s report (2011), Halliburton could have highlighted the
prediction of channeling and gas flow along with the overall assessment of cementing success in
reports sent to BP engineers. This issue might have caused BP engineers to review the prediction
in a cursory fashion.
In addition to onshore interactions, BP and Transocean and also BP and Halliburton collaborated
with each other on the DWH rig. Those collaborations have been illustrated on the right section
of figure 4.5 using dotted lines. Accordingly, the indicated collaborations have been captured in
the third layer of the developed framework illustrated in figure 4.4.
Similar to the description of miscommunication instances in the second layer, the stated
organizations had ineffective interactions in the third layer as well. One of the main discussed
issues related to work operations interactions in the DWH case is insufficient communication
between BP and Transocean prior to and during the final displacement, which “affected risk
awareness and well monitoring” of the crew (Chief Counsel’s report, 2011, page 186). In this
occasion, BP did not adequately inform Transocean about the existing risks of the Macondo well
(BOEMRE report, 2011; Chief Counsel’s report, 2011; Presidential Commission report, 2011;
and Transocean report, 2011). In addition, BP did not emphasize to the rig personnel the
particular importance of the negative pressure test, as the only way to assure cement robustness
in the bottom of the well (Chief Counsel’s report, 2011; Presidential Commission report, 2011;
and Transocean report, 2011). According to the Chief Counsel’s report (2011, page 163), “Had
BP properly emphasized the importance of the test and the need for special scrutiny of its results,
BP’s and Transocean’s personnel on the rig may have reacted more appropriately to the
anomalous pressure readings and flows they observed”.
As explained in the third layer of the discussed framework, BP and Halliburton collaborated with
each other as well. Similarly, there were some instances of miscommunication between those
two organizations. In one instance, Halliburton missed the opportunity of communicating its
concern regarding overall success of the cement job in the report sent to BP (BP report, 2010 and
Chief Counsel’s report, 2011). Halliburton expressed its complete satisfaction about the cement

144

job while later on in its post-blowout skepticism, it stated that cementing in the surface was
successful whereas the success of the down-hole cementing which was uncertain.
Finally, there is a need to describe the “work-as-done” in the bottom layer of the proposed
framework based on the existing interactions among operators of the three stated key players on
the DWH rig. One of the main instances of miscommunication analyzed in this level was
between the drillers and the mudloggers. The DWH drillers were the Transocean’s employees
and the mudloggers were the Sperry-Sun’s, as a Halliburton’s subsidiary, personnel. Both of
these groups of personnel were directly responsible for well monitoring.
Communication between the drill crew and the mudloggers broke down in several occasions. In
one instance, ineffective communication between the drillers and the mudloggers contributed to
the inability of the mudloggers to monitor pit levels properly (BP report, 2010 and Chief
Counsel’s report, 2011). Apparently, there were some simultaneous operations during the
preparation for well suspension on the day of the accident; April 20 (BP Report, 2010). One of
those operations was offloading mud to the supply vessel M/V Damon Bankston. According to
different investigation reports of the DWH accident, the simultaneous operations impaired
mudloggers’ ability to monitor the well reliably (BP report, 2010; Chief Counsel’s report, 2011;
and Hopkins, 2011). In addition, the driller on shift did not notify the mudlogger after the
offloading to the supply vessel stopped. Therefore, the mudlogger did not effectively monitor pit
volumes for the remainder of the day (BP report, 2010).
Moreover, the drill crew did not communicate with the mudlogger on shift about the anomalies
such as pressure built-up or increase in the flow-out (Chief Counsel’s report, 2011). Nor did they
contact any senior person available on the rig; such as the senior toolpusher, Offshore
Installation Manager (OIM), or the well-site leader, in order to seek his advice.
Another critical point, which made the communication level between the drillers and the
mudloggers more difficult, was the location of the mudloggers’ and the drillers’ shacks from
each other. As figure 4.6 illustrates, those two shacks were one flight of stairs away from each
other (Chief Counsel’s Report, 2011). This is while both the drillers and the mudloggers were in
charge of monitoring the well, which required them to be in close contact and interaction with
each other.

145

Figure 4.6. Illustration of the main deck of the DWH (See the drill shack and the mudlogger’s shack) (NAE/NRC report, 2011)
It is noteworthy to indicate that the communication line between Transocean and Sperry-Sun on
the rig has not been illustrated in the organizational structure for the DWH shown in figure 4.5.
This is while these two organizations needed to interact with each other for an effective well
monitoring. Therefore, we suggest that the stated interaction is added, using dotted line, in order
to connect the Transocean’s rig crew with the Sperry-Sun’s personnel on the rig.
As we discussed in the previous section, proper interaction of involved organizations in a high-
risk system is crucial in an emergency response case as well. In the case of the Deepwater
Horizon accident, there were several occasions of ineffective communication among the rig crew
in the emergency response situation, which endangered life of the onboard crew. One of those
instances was unclear line of communication among the well-site leader, the OIM, and the
captain regarding activating the Emergency Disconnect System (EDS) after the explosion (Coast
Guard report, 2011). Because of a “clerical error” by the Republic of the Marshall Islands, the
DWH was allowed to have a dual-command organizational structure in which the OIM was in
charge when the vessel was latched on to the well, and the master was in charge when the
Mobile Offshore Drilling Unit (MODU) was moving between locations or in an emergency
situation (Coast Guard report, 2011, page xii). However, by the start of the explosion, there was
no immediate authority transfer from the OIM to the master. According to the Coast Guard
report (2011, page xii), “this command confusion at a critical point in the emergency may have
impacted the decision to activate the EDS”.

146

Ineffective coordination between the rig crew and SMIT Salvage Americas, a contractor engaged
by Transocean, for firefighting efforts was another occasion of miscommunication among the
involved organizations in the emergency response to the DWH explosion (Coast Guard report,
2011).
All the above instances of interactions, mostly among the three stated key players of the
Deepwater Horizon case study, indicate the critical need to provide a context for effective
communication on health, safety, and environmental issues among those organizations
(NAE/NRC report, 2011). To be more specific, there had to be more precise rules and
regulations in defining the form, structure, and content of interaction among those three
organizations in order to reduce risk of miscommunication. For instance, detailed reporting as an
important tool for effective communication between organizations had to be encouraged. In
addition, designing standard and well-understood reporting infrastructures can potentially
decrease risk of ineffective communication. Incorporating appropriate rewarding systems for
reporting bad news and unsafe situations is another policy to improve communicational issues.
Communicating the importance of critical procedures or decisions is another crucial element in
effective interaction among multiple organizations. This issue results in observing and
identifying risks associated with those procedures/decisions, which can be useful in preventing
contributing causes of accidents.
More importantly, communication among multiple organizations has to maintain a focus on
safety (NAE/NRC report, 2011). Sharing knowledge and expertise across organizational
boundaries is one great way of communicating lessons learned, as organizational assets.
It is noteworthy that effective interaction among organizations is as important or even more
important when involved organizations in a high-risk system deal with emergency situations.
Therefore, training personnel for appropriate coordination during emergency response cases is
strongly recommended (NAE/NRC report, 2011).
In addition to all the stated instances of miscommunication and the suggested improving
recommendations, the proposed four-layer model for analysis of communications among
multiple organizations can be integrated with the three-layer conceptual risk assessment
framework, which was introduced in section 3.3. This integration contributes to derivation of
some preventive measures for analyzing future drilling.

147

According to the analysis of the introduced conceptual risk assessment framework,
communicational issues were one of the root organizational factors contributing to the DWH
accident and the NPT misinterpretation. In addition, this organizational factor is a main
contributor of any negative pressure test misinterpretation. Combining that conceptual
framework with the introduced model in this section enables analysts to identify the key players
of each conducted negative pressure test and different instances of communication among those
key players. Then, those identified instances can be modeled within the four different layers of
the proposed framework in this section. In addition, it is possible to derive some preventive
measures for future negative pressure tests by analyzing the aforementioned frameworks as an
integrated approach. It is noteworthy that the integration of these two frameworks can be used
for analysis of any communicational issues. The only prerequisite step is to develop a
generalized conceptual risk analysis framework for the studied problem.
In this section, we utilized the introduced framework in section 3.5.1 for the risk analysis of
interactions among multiple organizations in the Deepwater Horizon accident case study.
However, this case study was just one example of applying the proposed framework. Almost all
high-risk systems, which include tightly coupled and interactively complex operations, consist of
multiple key organizations that their ineffective communication can be one of the main risks
leading to large-scale accidents in those systems. Another example besides the oil and gas and
offshore operations is the nuclear industry. The Three Mile Island accident, which occurred in
1979 as a result of a partial nuclear meltdown, is one of the major accidents in this industry.
Inadequate communication was stated as one of the main contributing causes of that accident
(Hopkins, 2001 and Walker, 2006). Based on this argument, the proposed four-layer framework
in section 3.5 can be applied for the analysis of multi-organization interactions in any high-risk
system.

148

References
API/SPE websites, American Petroleum Institute (API), http://www.api.org/ and Society of Petroleum
Engineers (SPE), http://www.spe.org/index.php, Access date: February 11, 2014
API RP 96 (2013) Deepwater Well Design and Construction, American Petroleum Institute
Recommended Practice 96, First edition, March
Aven, Terje, Sklet, Snorre, and Vinnem, Jan Erik (2006) Barrier and Operational Risk Analysis of
hydrocarbon releases (BORA-Release); Part I: Method description, Journal of Hazardous Materials, 137
(2): 681–691
Bea, Robert (1998) Real-Time Prevention of Drilling and Workover Blowouts: Managing Rapidly
Developing Crises, Journal of Drilling Engineering, Society of Petroleum engineers
Bea, Robert (1999) A Structured Method and Software to Assess Human and Organizational Errors in the
Life-cycle of Offshore Structures, 18
th
International Conference of Offshore Mechanics and Arctic
Engineering, Safety and Reliability Symposium, American Society of Mechanical Engineers, St. John’s
Newfoundland, Canada, July 11-16
Bea, Robert (2000) Performance Shaping Factors in Reliability Analysis of Design of Offshore Structures,
Journal of Offshore Mechanics and Arctic Engineering, 122 (3): 163-172
Bea, Robert (2002a) Human and Organizational Factors in Reliability Assessment and Management of
Offshore Structures, Risk Analysis, 22 (1): 29-45
Bea, Robert (2002b) Human and Organizational Factors in Design and Operation of Deepwater Structures,
OTC 14293, Offshore Technology Conference, Society of Petroleum Engineers, Houston, Texas, May 6-
9
Bea, Robert (2006) Reliability and Human Factors in Geotechnical Engineering, Journal of Geotechnical
and Geoenvironmental Engineering, 132 (5): 631-643
Bea, Robert (2011a) Risk Assessment and Management: Challenges of the Macondo Well Blowout
Disaster”, Deepwater Horizon Study Group (DHSG), Working Paper

149

Bea, Robert (2011b) Personal Communication, Professor Emeritus, University of California Berkeley,
Member of the National Academy of Engineering, September 28
Bea, Robert (2011c) Personal Communication, Professor Emeritus, University of California Berkeley,
Member of the National Academy of Engineering, December 6
BOEMRE report (2011) Report Regarding the Causes of the April 20, 2010 Macondo Well Blowout, The
Bureau of Ocean Energy Management, Regulation, and Enforcement, U.S. Department of the Interior,
September 14
Bommer, Paul (2011) Personal Communication, Senior Lecturer, University of Texas at Austin, Member
of the NAE/NRC committee on the BP Deepwater Horizon accident, November 17
Bommer, Paul (2012) Personal Communication, Senior Lecturer, University of Texas at Austin, Member
of the NAE/NRC committee on the BP Deepwater Horizon accident, February 7
Bow-tie image, Web search,
https://www.google.com/search?q=Bow-tie+methodology&client=firefox-
a&hs=HuX&rls=org.mozilla:en-
US:official&channel=sb&tbm=isch&imgil=wBJx8ke7XoWp3M%253A%253Bhttps%253A%252F%252
Fencrypted-tbn1.gstatic.com%252Fimages%253Fq%253Dtbn%253AANd9GcQW-
67M0qjeNmmXQ9k4vJs0Nq1SlMn-
jgHDGhvMNpv8wbK63fmS3w%253B740%253B423%253BWZ_gn64sEEIGbM%253Bhttp%25253A%
25252F%25252Fwww.absconsulting.com%25252Fes%25252Fthesis%25252Fthesis-
methodology.cfm&source=iu&usg=__4IIUt89fzyzEv45AgDp7tK6DSYo%3D&sa=X&ei=JZ4fU8mJBoL
foATK3IL4Bw&ved=0CCoQ9QEwAA#facrc=_&imgdii=_&imgrc=NzbO4eLkoVy7bM%253A%3BtO
Kr9oFl1YZK9M%3Bhttp%253A%252F%252Fwww.dnv.co.za%252Fbinaries%252Fsafety%252520barri
er%252520management_500x273pxl_tcm4-
551307.png%3Bhttp%253A%252F%252Fwww.dnv.co.za%252Findustry%252Fmaritime%252Fservices
solutions%252Fconsulting%252Fshipop%252Fsafetybarriermanagement.asp%3B500%3B273, Access
date: March 11, 2014
BP report (2010) Deepwater Horizon accident investigation report, British Petroleum, September
BSEE safety culture policy statement (2013) Final Safety Culture Policy Statement, 13XE1700DX
EEEE600000 EX1SF0000.DSA000, Bureau of Safety and Environmental Enforcement (BSEE), U.S.
Department of the Interior

150

Cai, Baoping, Liu, Yonghong, Liu, Zengkai, Tian, Xiaojie, Dong Xin, and Yu Shilin (2012a) Using
Bayesian Networks in Reliability Evaluation for Subsea Blowout Preventer Control System, Relibility
Engineering and System Safety, 108: 32-41
Cai, Baoping, Liu, Yonghong, Liu, Zengkai, Tian, Xiaojie, Zhang, Yanzhen, and Ji, Renjie (2012b)
Application of Bayesian Networks in Quantitative Risk Assessment of Subsea Blowout Preventer
Operations, Risk Analysis, http://dx.doi.org/10.1111/j.1539-6924.2012.01918.x
Cai, Baoping, Liu, Yonghong, Zhang, Yunwei, Fan, Qian, Liu, Zengkai, and Tian, Xiaojie (2013) A
Dynamic Bayesian Networks Modeling of Human Factors on Offshore Blowouts, Journal of Loss
Prevention in the Process Industries, http://dx.doi.org/10.1016/j.jlp.2013.01.001
Chief Counsel’s report (2011) Macondo, the Gulf Oil Disaster, National Commission on the BP
Deepwater Horizon Oil Spill and Offshore Drilling
Chin, Brian, Hansen, Peter F., and Saetren, Thomas G. (2010) Operational Risk Analysis of LNG
Loading, OTC 20982, Offshore Technology Conference, Houston, Texas, May 3-6
Christman, Stan A. (2013) Personal Communication, Retired ExxonMobil executive engineering advisor,
December 13
Christman, Stan A. (2014a) Personal Communication, Retired ExxonMobil executive engineering advisor,
January 7
Christman, Stan A. (2014b) Personal Communication, Retired ExxonMobil executive engineering advisor,
January 18
Christman, Stan A. (2014c) Personal Communication, Retired ExxonMobil executive engineering advisor,
february4
Christou, Michalis, and Konstantinidou Myrto (2012) Safety of Offshore Oil and Gas Operations:
Lessons from Past Accident Analysis: Ensuring EU Hydrocarbon Supply through Better Control of Major
Hazards, Publication JRC77767, Joint Research Centre, European Commission,
http://publications.jrc.ec.europa.eu/repository/handle/111111111/27463, Access date: February 27, 2014

151

Coast Guard report (2011) Report of Investigation into the Circumstances Surrounding the Explosion,
Fire, Sinking, and Loss of Eleven Crew Members aboard the Mobile Offshore Drilling Unit Deepwater
Horizon in the Gulf of Mexico; April 20-22, 2010, Volume I, United States Coast Guard
Conrady Applied Science website (2012) Introduction to Bayesian Networks,
http://www.conradyscience.com/index.php/bbn, Access date: March 29, 2012
Curole, Michael A., McCafferty, Denise, and McKinney, Anne (1999) Human and Organizational Factors
in Deepwater Applications, OTC 10878, Offshore Technology Conference, Houston, Texas, May 3-6
de Morais, Marques and Pinheiro, Caroline (2011) Application of the 17 Practices of the Management
System for Operational Safety on Marine Installations for Drilling and Production of Oil and Natural Gas
in Brazil, OTC 22685, Offshore Technology Conference, Rio de Janeiro, Brazil, October 4-6
Department of Energy (DOE) Handbook (2012) Accident and Operational Safety Analysis, Volume I:
Accident Analysis Techniques, U.S. Department of Energy
Deplancke, Antoine and Laurent Sparrow, Signal Detection Theory, Presentation file,
http://ureca.recherche.univ-lille3.fr/sparrow/TLDocs/cours1314/PPNSA_UE7_SDT_2012.pdf, Access
date: February 24, 2014
DHSG (Deepwater Horizon Study Group) report#3 (2010) The Mecondo Blowout, December 5
Dupriest, Fred (2014a) Personal Communication, Retired ExxonMobil chief drilling engineer, Lecturer at
Texas A&M University, January 18
Dupriest, Fred (2014b) Personal Communication, Retired ExxonMobil chief drilling engineer, Lecturer at
Texas A&M University, January 26
DWH image, web search, http://www.nbcnews.com/id/37179888/ns/disaster_in_the_gulf/t/bp-rig-
inspections-were-fewer-advertised/, Access date, February 23, 2014
Eleye-Datubo, A.G., Wall, A., Saajedi, A., and Wang, J. (2006) Enabling a Powerful Marine and
Offshore Decision-Support Solution through Bayesian Network Technique, Risk Analysis, 26 (3): 695-
721

152

Eleye-Datubo, A.G., Wall, A., Saajedi, A., and Wang, J. (2008) Marine and Offshore Safety Assessment
by Incorporating Risk Modeling in a Fuzzy-Bayesian Network of an Induced Mass Assignment Paradigm,
Risk Analysis, 28 (1): 95-112
EQE International (1995) JIP on Human Factors in Offshore Operations: UK Literature Review, Houston,
Texas, January 20
Ershaghi, Iraj (2014) Personal Communication, Professor, University of Southern California, Dean of the
Petroleum Engineering Department, Member of the National Academy of Engineering, January 30
Ershaghi, Iraj and Luna, Dennis R. (2011) Validation Process for Human Factor In Complex Upstream
Oil and Gas Operations, SPE 147564, SPE Annual Technical Conference and Exhibition, Denver,
Colorado, October 30-November 2
Event tree image, Web search,
http://www.google.com/imgres?um=1&hl=en&sa=N&biw=1440&bih=711&tbm=isch&tbnid=bojVKoah
RXl5eM:&imgrefurl=http://thereliabilityroadmap.com/html/aricles_pg_3.html&docid=EhG9narnSsJOq
M&imgurl=http://thereliabilityroadmap.com/assets/images/fault_tree1.png&w=996&h=400&ei=2udsT5f
KJYOpiQLviIy-
BQ&zoom=1&iact=rc&dur=91&sig=114831587319281346802&page=3&tbnh=73&tbnw=183&start=40
&ndsp=25&ved=1t:429,r:4,s:40&tx=109&ty=45, Access date: February 23, 2014
Fault tree image, Web search,
http://syque.com/quality_tools/toolbook/FTA/how.htm, Access date: February 23, 2014
Ferrow, Michael (2011) An Operating Management System to Deliver Safe Operations, SPE Offshore
Europe Oil and Gas Conference, Aberdeen, UK, September 6-8
Garcia, Juan A. (2013) Personal Communication, Retired ExxonMobil Worldwide Drilling Manager,
November 25
Gatte, Roger D. (2014) Personal Communication, BP Retired Wells Superintendent, January 20
Gentile, G (2013) Regulations & Environment: A Deep-rooted Cause of Macondo is Raised, Oilgram
New Column, November 4, http://blogs.platts.com/2013/11/04/macondo-why/, Access date: January 28,
2013

153

Ghosh, Tina S. and Apostolakis, George E. (2005) Organizational Contributions to Nuclear Power Plant
Safety, Nuclear Engineering and Technology, 37 (3): 207-220
Goh, Yang Miang, Love, Peter E.D., Brown, Helen, and Spickett, Jeffery (2012) Organizational
Accidents: A Systemic Model of Production versus Protection, Journal of Management Studies, 49 (1):
52-76
Green, David M. and Swets, John A., Signal Detection Theory and Psychophysics, John Wiley & Sons,
Inc., 1974
Groth, Katrina and Mosleh, Ali (2012) A Data-informed PIF Hierarchy for Model-based Human
Reliability Assessment, Reliability Engineering and System Safety, 108: 154-174
Groth, Katrina, Wan, Chengdong, and Mosleh, Ali (2010) Hybrid Causal Methodology and Software
Platform for Probabilistic Risk assessment and Safety Monitoring of Socio-technical Systems, Reliability
Engineering and System Safety, 95 (12): 1276-1285
Guldenmund, F.W. (2000) The Nature of Safety Culture: A Review of Theory and Research, Safety
Science, 34 (1-3): 215 - 257
Hartley, Richart S. and Tolk, Janice N. (2010) High Reliability Operations, Four Hour Professional
Development Seminar, HPRCT Workshop, Baltimore, Maryland, June 21
Hopkins, Andrew (2001) Was Three Mile Island a ‘Normal Accident’?, Journal of Contingencies and
Crisis Management, 9 (2): 65-72
Hopkins, Andrew (2008) Failure to Learn: The BP Texas City Refinery Disaster, CCH Australia Limited
Hopkins, Andrew (2011) Management Walk-arounds: Lessons from the Gulf of Mexico Oil Well
Blowout, Safety Science, 49 (10): 1421-1425
Hopkins, Andrew (2012) Disastrous Decisions: The Human and Organizational Causes of the Gulf of
Mexico Blowout, CCH Australia Limited
IAEA safety report (1986) Summary Report on the Post-accident Review Meeting on the Chernobyl
Accident, International Atomic Energy Agency (IAEA), Safety Series No.75-INSAG-1

154

International Energy Agency (IEA) (2010) 2011: Forecasters See Higher Crude Oil Prices and Lower U.S.
Crude Oil Production. Institute for Energy Research. October 19,
http://www.instituteforenergyresearch.org/2010/10/19/2011-forecasters-see-higher-crude-oil-prices-and-
lower-u-s-crude-oil-production/, Access date: January 23, 2013
Johnsen, Stig Ole, Okstad, Eivind, Aas, Andreas L., and Skramstad T. (2012) Proactive Indicators To
Control Risks in Operations of Oil and Gas Fields, SPE Economics & Management, 4 (2): 90-105
Kazemi, Reza (2011) A hybrid Methodology for Modeling Risk of Adverse Events in Complex
Healthcare Settings, Doctor of Philosophy Dissertation, University of Maryland, Maryland
Kirwan, Barry (1994) A Guide to Practical Human Reliability Assessment, Taylor & Francis
Kirwan, Barry (1996) Evolving Human Factors in Offshore Operations, Summary of Proceedings and
Submittal Papers for the International Workshop on Human Factors in Offshore Operations, New Orleans,
Louisiana, December 16-18
Leveson, Nancy (2004) A New Accident Model for Engineering Safer Systems, Safety Science, 42 (4):
237-270
Leveson, Nancy (2011) Engineering a Safer World: Systems Thinking Applied to Safety, The MIT Press
Liaparinos, P., Kalyvas, N., Kandarakis, I., and Cavouras, D. (2013) Analysis of the imaging performance
in indirect digital mammography detectors by linear systems and signal detection models, Nuclear
Instruments and Methods in Physics Research, Section A: Accelerators, Spectrometers, Detectors and
Associated Equipment, 697: 87-98
Lootz, Elisabeth, Ovesen, Monica, Tinmannsvik, Ranveig Kviseth, Hauge, Stein, Okstad, Eivind H., and
Carlsen, Inge M. (2013) Risk of Major Accidents: Causal Factors and Improvement Measures Related to
Well Control in the Petroleum Industry, SPE 163775, Society of Petroleum Engineers Americas E&P
Health, Safety, Security, and Environmental Conference, Galveston, Texas, March 18-20
Maguire Richard (2005) Validating a Process for Understanding Human Error Probabilities in Complex
Human Computer Interfaces, Proceedings of the Second Workshop on Complexity in Design, Glasgow,
Glasgow University Press

155

Marques de Morais, Caroline P. (2011) Application of the 17 Practices of the Management System for
Operational Safety on Marine Installations for Drilling and Production of Oil and Natural Gas in Brazil,
OTC 22685, Offshore Technology Conference, Rio de Janeiro, Brazil, October 4-6
Martins, Marcelo R. and Maturana, Marcos C. (2009) Application of Bayesian Networks in the Analysis
of Human Contribution in Collision Accidents, 28
th
Conference on Ocean, Offshore, and Arctic
Engineering (OMAE), Honolulu, Hawaii, May 31-June 5
Martins, Marcelo R. and Maturana, Marcos C. (2010) Human Error Contribution in Collision and
Grounding of Oil Tankers, Risk Analysis, 30 (4): 674-698
Millheim, Keith (2011) Personal Communication, Strategic Worldwide LLC, Member of the National
Academy of Engineering, Member of the NAE/NRC committee on the BP Deepwater Horizon accident,
December 2
MMS final report (2008) A Probabilistic Approach to Risk Assessment of Managed Pressure Drilling in
Offshore Applications, Department of the Interior, Mineral Management Service, Technology
Assessment and Research Study 582 Contract 0106CT39728, October 31
Mohaghegh, Zahra, Kazemi, Reza, and Mosleh, Ali (2009) Incorporating Organizational Factors into
Probabilistic Risk Assessment (PRA) of Complex Socio-technical Systems: A Hybrid Technique
Formalization, Reliability Engineering and System Safety, 94 (5): 1000-1018
Mosleh, Ali (2011) Personal Communication, Professor, University of Maryland, Member of the National
Academy of Engineering, August 11
Mosleh, A., Dias, A., Eghbali, G., and Fazen, K. (2004) An integrated Framework for Identification,
Classification, and Assessment of Aviation Systems Hazards, Proceedings of the International Conference
on Probabilistic Safety Assessment and Management (PSAM7) and European Safety and Reliability
Conference, Berlin, Germany, June 14-18
Murphy, Dean M. and Pate-Cornell, Elisabeth (1996) The SAM Framework: Modeling the Effects of
Management Factors on Human Behavior in Risk Analysis, Risk Analysis, 16 (4): 501-515
NAE/NRC report (2011) Macondo Well Deepwater Horizon Blowout: Lessons for Offshore Drilling
Safety, National Academy of Engineering/National Research Council, The National Academies Press

156

NAE/NRC report (2013) Best Available and Safest Technologies for Offshore Oil and Gas Operations:
Options for Implementation, National Academy of Engineering/National Research Council, The National
Academies Press
Negative pressure test animations (2011), http://www.oilspillcommission.gov/chief-counsels-report,
Access date: February 6, 2012
Nelson, Erik B. (1990) Well Cementing, Developments in Petroleum Science 28, Elsevier science
publisher
Nickerson, Raymond S. (1998) Confirmation Bias: A Ubiquitous Phenomenon in Many Guises, Review
of General Psychology, 2 (2): 175-220
Papazoglou, I.A., Bellamy, L.J., Hale, A.R., Aneziris, O.N., Ale, B.J.M., Post, J.G., and Oh, J.I.H. (2003)
I-Risk: Development of an Integrated Technical and Management Risk Methodology for Chemical
Installations, Journal of Loss Prevention in the Process Industries, 16 (6): 575-591
Pate-Cornell, Elisabeth (1990) Organizational Aspects of Engineering System Safety: The Case of
Offshore Platforms, Science 250 (4985): 1210-1217
Pate-Cornell, Elisabeth (1993) Learning form the Piper Alpha Accident: A platform analysis of technical
and organizational factors, Risk Analysis, 13 (2): 215-232
Pate-Cornell, Elisabeth (2012) Personal Communication, Professor, Stanford University, Member of the
National Academy of Engineering, Member of the NAE/NRC committee on the BP Deepwater Horizon
accident, January 26
Pate-Cornell, Elisabeth and Fischbeck, Paul S. (1993) PRA as a Management Tool: Organizational
Factors and Risk-based Priorities for the Maintenance of the Space Shuttle Orbiter, Reliability
Engineering and System Safety, 40 (3): 239-257
Pate-Cornell, Elisabeth and Murphy, Dean M. (1996) Human and Management Factors in Probabilistic
Risk Analysis: The SAM Approach and Observation from Recent Applications, Reliability Engineering
and System Safety, 53 (2): 115-126
Perrow, Charles (1984) Normal Accidents: Living with High-Risk Technologies, Basic Books, New York

157

Pitblado, Robin, Bjerager, Peter, Andreassen, Eirik, and Tørstad, Elisabeth (2011) Key Aspects of an
Effective U.S. Offshore Safety Regime, DNV (Det Norske Veritas), position paper
Pitblado, Robin and Fisher, Mark (2011) Novel Investigation Approach Linking Management System and
Barrier Failure Root Causes, Offshore Technology Conference, Rio de Janeiro, Brazil, October 4-6
Presidential Commission report (2011) Deep Water; the Gulf Oil Disaster and the Future of Offshore
Drilling, National Commission on the BP Deepwater Oil Spill and Offshore Drilling
Psarros, George Ad, Vassalos, Dracos (2010) Risk analysis of Bulk Carriers, Ships and Offshore
Structures, 5 (3): 199-209
Rasmussen, Jens (2997) Risk Management in a Dynamic Society: A modeling Problem, Safety Science,
27 (2-3): 183-213
Rasmussen, Jens, Pejtersen, Annelise M., and Goodstein, L.P. (1994) Cognitive Systems Engineering,
First edition, Wiley-Interscience Publication, John Wiley & Sons Inc.
Rasmussen, Jens and Svedung, Inge, (2000) Proactive Risk Management in a Dynamic Society, First
edition, Raddningsverket, Risk and Environmental Department, Swedish Rescue Services Agency,
Karlstad
Rathnayaka, Samith (2011) System Hazard Identification, Prediction, and Prevention (SHIPP)
methodology; Predictive Accident Modeling Approach, Master of Engineering Thesis, Memorial
University of Newfoundland, Newfoundland, Canada, May
Rausand, Marvin (2005) HAZOP; Hazard and Operability Study, Presentation from the book “System
Reliability Theory: Models, Statistical Methods, and Applications”, 2
nd
edition, Wiley, 2004, October 7,
http://www.ntnu.no/ross/slides/hazop.pdf, Access date: March 22, 2012
Reason, James (1997) Managing the Risks of Organizational Accident, Ashgate Publishing Limited
Reason, James (1998) Achieving a Safe Culture: Theory and Practice, Work and Stress, 12 (3): 292-306
Reason, James (2000) Safety Paradoxes and Safety Culture, Injury Control and Safety Promotion, 7 (1):
3-14

158

Ren, J., Jenkinson, I., Wang, J., Xu, D.L., and Yang, J.B. (2008) A Methodology to Model Causal
Relationships on Offshore Safety Assessment Focusing on Human and Organizational Factors, Journal of
Safety Research, 39 (1): 87-100
Ren, J., Jenkinson, I., Wang, J., Xu, D.L., and Yang, J.B. (2009) An Offshore Risk Analysis Method
Using Fuzzy Bayesian Network, Journal of Offshore Mechanics and Arctic Engineering, 131 (4): 041101-
1:041101-12
Ren, J., Wang, J., Jenkinson, I., Xu, D.L., and Yang, J.B. (2007) A Bayesian Network Approach for
Offshore Risk Analysis through Linguistic Variables, China Ocean Engineering, 21 (3): 371-388
RNNP project (2011) Trends in Risk Level in the Norwegian Petroleum Activity 2011, Main Report, The
Petroleum Safety Authority Norway, http://www.ptil.no/risikonivaa-rnnp/rapporter-fra-risikonivaa-i-
norsk-petroleumsvirksomhet-rnnp-2011-article8458-20.html, Access date: May 29, 2013
Robb, Martin and Miller, Gerald (2012) Human Factors Engineering in Oil and Gas; A Review of
Industry Guidance, Work, 41: 752-762
Roed, Willy, Mosleh, Ali, Vinnem, Jan Erik, and Aven, Terje (2009) On the Use of the Hybrid causal
Logic Method in Offshore Risk Analysis, Reliability Engineering and System Safety, 94 (2): 445-455
Shaughnessy, John M., Romo, Luis A., and Soza, Robert L. (2003) Problems of Ultra-Deep High-
Temperature, High-Pressure Drilling, SPE 84555, SPE Annual Technical Conference and Exhibition,
Denver, Colorado, October 5-8
Sheppard, J.W., and Kaufman, M.A. (2005) A Bayesian Approach to Diagnosis and Prognosis Using
Built-in Test, IEEE Transactions on Instrumentation and Measurement, 54 (3): 1003-1018
SINTEF report (2011) The Deepwater Horizon Accident: Causes, Learning Points and Recommendations
for the Norwegian Continental Shelf, May
SINTEF executive summary (2011) The Deepwater Horizon Accident: Causes, Learning Points and
Recommendations for the Norwegian Continental Shelf, May
Sklet, S., Aven, T., Hauge, S., and Vinnem, J.E. (2005) Incorporating Human and Organizational Factors
in Risk Analysis for Offshore Installations, Proceedings of the European Safety and Reliability
Conference, Tri City, Poland, June 27-30

159

Sklet, Snorre, Vinnem, Jan Erik, and Aven, Terj (2006) Barrier and Operational Risk Analysis of
Hydrocarbon Releases (BORA-Release); Part II: Results from a Case Study, Journal of Hazardous
Materials, 137 (2): 692-708
Skogdalen, Jon Espen and Vinnem, Jan Erik (2011) Quantitative Risk Analysis Offshore-Human and
Organizational Factors, Reliability Engineering and System Safety, 96 (4): 468-479
Skogdalen, Jon Espen and Vinnem, Jan Erik (2012) Quantitative Risk Analysis of Oil and Gas Drilling:
Using Deepwater Horizon as a Case Study, Reliability Engineering and System Safety, 100: 58-66
Slater, D.H. and Cox, R.A. (1985) Methodologies for the Analysis of Safety and Reliability Problems in
the Offshore Oil and Gas Industry, Application of Risk Analysis to Offshore Oil and Gas Operations:
Proceedings of an international workshop, National Bureau of Standards (NBS), Special Publication 695,
May
Smith, John R. (2010a) Review of Operational Data Preceding Explosion on Deepwater Horizon in
MC252, Final report, July 1
Smith, John R. (2010b) 20 well Anomalies of Investigative Interest, United State Coast Guard website,
http://www.uscg.mil/hq/cg5/cg545/dw/exhib/, Access date: February 24, 2014
Smith, John R. (2010c) 23 July Dr. John Smith Displays, United State Coast Guard website,
http://www.uscg.mil/hq/cg5/cg545/dw/exhib/, Access date: February 24, 2014
Stanton, Neville (2004) Systematic Human Error Reduction and Prediction Approach (SHERPA),
Handbook of Human Factors and Ergonomics Methods, Chapter 37, CRC Press
Tanner Jr., Wilson P. and Swets, John A. (1954) A Decision-making Theory of Visual Detection,
Psychological Review, 61 (6): 401-409
Thorogood, John L. and Crichton, Margaret T. (2013) Operational Control and Managing Change: The
Integration of Nontechnical Skills with Workplace Procedures, SPE Drilling and Completion, 28 (2): 203-
211
Transocean report (2011) Macondo Well Incident, Transocean Investigation report, Volume I, June

160

Transportation Research Board report (2012) Evaluating the Effectiveness of Offshore Safety and
Environmental Management Systems, Committee on the Effectiveness of Safety and Environmental
Management Systems for Outer Continental Shelf Oil and Gas Operations, Special report 309,
Transportation Research Board (TRB)
Trucco, P., Cango, E., Ruggeri, F., and Grande, O. (2008) A Bayesian Belief Network Modeling of
Organizational Factors in Risk Analysis: A Case Study in Maritime Transportation, Reliability
Engineering and System Safety, 93 (6): 823-834
U.S. Department of the Interior report (2012) Oil and Gas Utilization, Offshore and Onshore, Updated
Report to the President, U.S. Department of the Interior
Vinnem, Jan Erik (2007) Offshore Risk Assessment; Principles, Modeling, and Applications of QRA
Studies, 2
nd
edition, Springer
Vinnem, Jan Erik, Aven, Terje, Hauge, Stein, Seljelid, Jorunn, and Veire, Gunnar (2004) Integrated
Barrier Analysis in Operational Risk Assessment in Offshore Petroleum Operations, Proceedings of the
International Conference on Probability Safety Assessment and Management (PSAM7) and European and
Safety Conference, Berlin, Germany, June 14-18,
Visser, Robert C. (2011) Offshore Accidents, Regulations, and Industry Standards, SPE 144011, Society
of Petroleum Engineers Western North American Regional Meeting, Anchorage, Alaska, May 7-11
Walker, Samuel J. (2006) Three Mile Island: A Nuclear Crisis in Historical Perspective, University of
California Press
Wang, Haiyuan (2008) Safety Factors and Leading Indicators in Shipping Organizations: Tanker and
Container Operation, Doctor of Philosophy Dissertation, Rensselaer Polytechnic Institute, Troy, New
York, April
Wang, Y-F, Xie, M., Habibullah, M.S., and Ng, K-M (2011) Quantitative Risk Assessment through
Hybrid Causal Logic Approach, Proceedings of the Institution of Mechanical Engineers, Part O: Journal
of Risk and Reliability, 225 (3): 323-332

161

Wang, Y-F, Xie, M., Ng, K-M, and Meng, Y-F (2011) Quantitative Risk Analysis Model of Integrating
Fuzzy Fault Tree with Bayesian Network, IEEE International Conference on Intelligence and Security
Informatics, July 9-12

Abstract (if available)

Abstract According to the final Presidential National Commission report on the BP Deepwater Horizon (DWH) blowout, there is need to “integrate more sophisticated risk assessment and risk management practices” in the oil industry. Reviewing the literature of the offshore drilling industry indicates that most of the developed risk analysis methodologies do not fully and more importantly, systematically address the contribution of Human and Organizational Factors (HOFs) in accident causation. This is while results of a comprehensive study, from 1988 to 2005, of more than 600 well‐documented major failures in offshore structures show that approximately 80% of those failures were due to HOFs. In addition, lack of safety culture, as an issue related to HOFs, have been identified as a common contributing cause of many accidents in this industry. ❧ This dissertation introduces an integrated risk analysis methodology to systematically assess the critical role of human and organizational factors in offshore drilling safety. The proposed methodology in this research focuses on a specific procedure called Negative Pressure Test (NPT), as the primary method to ascertain well integrity during offshore drilling, and analyzes the contributing causes of misinterpreting such a critical test. In addition, the case study of the BP Deepwater Horizon accident and their conducted NPT is discussed. ❧ The risk analysis methodology in this dissertation consists of three different approaches and their integration constitutes the big picture of my whole methodology. The first approach is the comparative analysis of a “standard” NPT, which is proposed by the author, with the test conducted by the DWH crew. This analysis contributes to identifying the involved discrepancies between the two test procedures. The second approach is a conceptual risk assessment framework to analyze the causal factors of the identified mismatches in the previous step, as the main contributors of negative pressure test misinterpretation. Finally, a rational decision making model is introduced to quantify a section of the developed conceptual framework in the previous step and analyze the impact of different decision making biases on negative pressure test results. ❧ Along with the corroborating findings of previous studies, the analysis of the developed conceptual framework in this paper indicates that organizational factors are root causes of accumulated errors and questionable decisions made by personnel or management. Further analysis of this framework identifies procedural issues, economic pressure, and personnel management issues as the organizational factors with the highest influence on misinterpreting a negative pressure test. It is noteworthy that the captured organizational factors in the introduced conceptual framework are not only specific to the scope of the NPT. Most of these organizational factors have been identified as not only the common contributing causes of other offshore drilling accidents but also accidents in other oil and gas related operations as well as high‐risk operations in other industries. ❧ In addition, the proposed rational decision making model in this research introduces a quantitative structure for analysis of the results of a conducted NPT. This model provides a structure and some parametric derived formulas to determine a cut‐off point value, which assists personnel in accepting or rejecting an implemented negative pressure test. Moreover, it enables analysts to assess different decision making biases involved in the process of interpreting a conducted negative pressure test as well as the root organizational factors of those biases. ❧ In general, although the proposed integrated research methodology in this dissertation is developed for the risk assessment of human and organizational factors contributions in negative pressure test misinterpretation, it can be generalized and be potentially useful for other well control situations, both offshore and onshore

Linked assets

University of Southern California Dissertations and Theses

Conceptually similar

PDF

Human and organizational factors of PTC integration in railroad system and developing HRO-centric methodology for aligning technological and organizational change

PDF

Investigation of health system performance: effects of integrated triple element method of high reliability, patient safety, and care coordination

PDF

BRIM: A performance-based Bayesian model to identify use-error risk levels in medical devices

PDF

Defending industrial control systems: an end-to-end approach for managing cyber-physical risk

$Hydraulic fracturing and the environment: risk assessment for groundwater contamination from well casing failure$

PDF

Hydraulic fracturing and the environment: risk assessment for groundwater contamination from well casing failure

PDF

Employee churn in afterschool care: an evaluation study of manager influences on employee retention and turnover

Asset Metadata

Creator Tabibzadeh, Maryam (author)

Core Title A risk analysis methodology to address human and organizational factors in offshore drilling safety: with an emphasis on negative pressure test

School Viterbi School of Engineering

Degree Doctor of Philosophy

Degree Program Industrial and Systems Engineering

Publication Date 04/16/2014

Defense Date 03/24/2014

Publisher University of Southern California (original), University of Southern California. Libraries (digital)

Tag Deepwater Horizon,human and organizational factors,negative pressure test,OAI-PMH Harvest,offshore drilling,risk analysis,safety and reliability

Format application/pdf (imt)

Language English

Contributor Electronically uploaded by the author (provenance)

Advisor Meshkati, Najmedin (committee chair), Ershaghi, Iraj (committee member), John, Richard S. (committee member), Von Winterfeldt, Detlof (committee member)

Creator Email m.tabibzadeh@gmail.com,mtabibza@usc.edu

Permanent Link (DOI) https://doi.org/10.25549/usctheses-c3-379524

Unique identifier UC11296588

Identifier etd-Tabibzadeh-2366.pdf (filename),usctheses-c3-379524 (legacy record id)

Legacy Identifier etd-Tabibzadeh-2366.pdf

Dmrecord 379524

Document Type Dissertation

Format application/pdf (imt)

Rights Tabibzadeh, Maryam

Type texts

Source University of Southern California (contributing entity), University of Southern California Dissertations and Theses (collection)

Access Conditions The author retains rights to his/her dissertation, thesis or other graduate work according to U.S. copyright law. Electronic access is being provided by the USC Libraries in agreement with the a...

Repository Name University of Southern California Digital Library

Repository Location USC Digital Library, University of Southern California, University Park Campus MC 2810, 3434 South Grand Avenue, 2nd Floor, Los Angeles, California 90089-2810, USA