11:00 pm, March 14, 2001, Roncador field 130 kilometers off the Brazilian coast: Another day ends on the Petrobras Platform 36 (P-36), the world’s largest floating oil production platform. Built as a semi-submersible drilling rig in 1995, the $485 million P-36 produces more than 84,000 barrels of crude per day (not the rig’s full capacity) and roughly six percent of Brazil’s oil (Wikipedia, 2007). Petrobras, the dominant force in the oil and natural gas sector in Brazil and pioneer oil refining, exploration, and production, owns and operates P-36 (‘Petrobras stuill acts like a monopoly’, 2001).
12:20 am, March 15: An explosion occurs in a column that supports the platform. While oil and water gush into the cylindrical column, the rig begins to tilt. After five minutes, it has tilted by two degrees (Chile, 2004).
12:24 am, March 15: A second explosion occurs and personnel begin to evacuate the rig. Workers witnessing the explosion say it was as if it were ‘coming from inside the structure of the platform itself’ (Gibb, 2001b).
12:39 am, March 15: Eleven rig firefighters, prompted by a fire alarm, respond to what they believe is a serious fire. Once they arrive at the ‘source’, they are greeted by oil, water, and petroleum vapor, which then is triggered by an unknown ignition source and results in a massive explosion, killing two of them instantly (Chile, 2004). Eight other firefighters are trapped in a flooding compartment (AcuSafe, 2001). Their bodies are never found. The eleventh man incurs burns on 98 percent of his body and dies in the hospital days later (United States Environmental Protection Agency, 2001).
Petrobras requests the assistance of hundreds of experts from around the world to try and save P-36 and its contents. Crews work around the clock for days. The platform continues to tilt to as much as 16 degrees (Wikipedia, 2007).
11:40 am, March 20: P-36 finally succumbs to the ocean waves and its own weight to sink to the floor of the Atlantic Ocean. A detailed incident and recovery summary is included in the Appendix.
The sinking of P-36 signaled significant failures in quality, risk management, and health and safety. These failures in turn led to the failure of Petrobras’s organizational reputation. The failures have been analyzed individually and concurrently to provide further insight into the incident. Significant alternative actions that others should adopt are offered to avoid repetition of the problems described herein.
The P-36 incident was caused first and foremost by a failure in quality, including quality control and assurance. For the P-36, quality refers to the type and standard of materials used in the construction of the platform, intricacy of systems and equipment used aboard the platform, and level of training of the platform’s operating personnel. Dixon broadly defines quality control as ‘the set of processes for planning and monitoring to ensure quality is being achieved’ and quality assurance as ‘the set of processes and procedures required to demonstrate that the work has been performed according to the quality plan’ (2000, p. 22). Petrobras’s quality plan consisted primarily of cost cutting. Prior to the P-36 incident, a Petrobras official praised the company’s frugality that would result in increased profits for shareholders by stating,
‘Petrobras has established new global benchmarks for the generation of exceptional shareholder wealth through an aggressive and innovative program of cost cutting on its P-36 production facility. Conventional constraints have been successfully challenged and replaced with new paradigms appropriate to the globalized corporate market place…the project successfully rejected the established constricting and negative influences of prescriptive engineering, onerous quality requirements, and outdated concepts of inspection and client control. Elimination of these unnecessary straitjackets has empowered the project’s suppliers and contractors to propose highly economical solutions, with the win-win bonus of enhanced profitability margins for themselves. The P-36 platform shows the shape of things to come in unregulated global market economy of the 21st Century.’ (Wikipedia, 2007)
Essentially, Petrobras eliminated many of the existing engineering controls, quality requirements, and training procedures prescribed by the industry and touted this ‘accomplishment’ by making it the new long-term corporate policy. According to industry unions, Petrobras rejected quality construction practices (using durable materials, hiring licensed subcontractors, etc.) and increased ‘unsafe’ subcontracting to cut construction costs (‘Petrobras still acts like a monopoly’, 2001). For the most part, Petrobras was able to get away with compromising the quality of its equipment, design, construction, operation, and training because of its 30-year monopoly on Brazil’s oil and gas sector. According to industry sources, ‘virtually no oil or natural gas has been produced by another company since the monopoly was established’ (‘Petrobras still acts like a monopoly’, 2001).
These quality cost cutting strategies were direct contributors to the technical failure of the P-36. The chain reaction of the incident began initially with faulty pumps and valves. Low quality pumps and valves malfunctioned and caused water being flushed out of a drainage tank (a standard daily operation) to enter an emergency drainage tank that was also malfunctioning (Chile, 2004). Excessive pressure was able to build up in the emergency drainage tank because a racket was missing in the entry valve. Hydrocarbons also entered the emergency drainage tank because the other emergency drainage tank had been aligned to the wrong system. Under trained workers delayed draining the tanks and other equipment failed to prevent leakages to other areas of the platform. A timeline analysis of events is included in the Appendix. Not only were the equipment and systems on P-36 of poor quality, but the platform personnel had also been poorly trained to deal with emergency situations. According to an inquiry commission into the P-36 incident, the responsibilities of the personnel relating to operation, maintenance, and supervision had been inadequately defined (Petrobras, 2001a). The skills of platform personnel had not been upgraded to correspond with their current responsibilities or the new technologies being used on P-36. Maintenance engineering had been eliminated as a priority. Outsourced teams did not have the necessary qualifications regarding the mechanics and instruments of the P-36.
Another significant failure, as evidenced by the sinking of P-36, was in risk management. Risks management includes ‘the process of identification, assessment, allocation, and management’ of all risks associated with a project or process (Dixon, 2000, p. 21). Risk is the result of uncertainty and exists in every endeavor (project, process, decision, etc.). During the engineering and construction of the P-36, risk management would have included anticipating equipment or instrument failures and creating fail-safe systems. During operation, risk management would have included activating or reconsidering these fail-safes when equipment was non-operational or in repair and considering the effect of these equipment failures on other systems.
Risk management failures abounded during the P-36 incident. One emergency drainage tank was being repaired prior to the first explosion, so its relief vent was closed. Operators had not considered what would happen if pressure could not be relived from this vent (Chile, 2004). Coincidentally, a valve was open on another section of the platform and forced oil and water into the same tank with the closed relief vent. Because the possibility of this occurrence had not been identified or assessed, the tank blew out and an explosion occurred. Two seawater pumps were non-operational and waiting for repair and could not pump water out of flooded compartments. No contingency had been established. Adequate contingencies also had not been established for other faulty equipment awaiting replacement (AcuSafe, 2001). The risks associated with locating tanks and receptacles (susceptible to explosions) inside platform supporting columns had never been established. The inquiry commission found that, for the most part, very little risk analysis had been done specifically for the P-36 (Petrobras, 2001a). Petrobras essentially took the methods it was using to construct and operate other oil platforms, cut costs, and then expanded them to fit the 32,000-ton, 40-story behemoth (Chile, 2004). Operating and management teams had also not even been trained to identify, evaluate, or control risk situations (Petrobras, 2001a).
Similarly, the P-36 incident showed failures in health, safety, and environment (HSE) procedures. Health, safety, and environment involves establishing and implementing standards that reduce the likelihood of an accident. These methods and standards should be ‘to a level considered acceptable by the public, the system, users and operators, and others’ and consider ‘accident or damage to people, equipment, property, and the environment’ (Dixon, 2001, p. 23). Petrobras cut costs in HSE procedures, systems, and training according to their cost-cutting strategy and not the desires of other stakeholders (Gibb, 2001b).
During the P-36 incident, the disregard for HSE standards and methods could be seen over and over. Daily drilling reports that documented ‘pressurization in the platform vent system; likely cause is blockage of flame damper’ had not been considered an emergency or HSE risk and thus the platform was not shutdown to address the issue (AcuSafe, 2001). The second explosion abroad the P-36 that killed two firefighters was caused by an unknown ignition source (Chile, 2004). Intuitively, appropriate HSE standards for an oil platform prohibit open rogue sources that may ignite oil, petroleum vapors, or any flammable substances prevalent on the platform. While trying to control the flooding of platform compartments, personnel risked their safety and augmented the flooding by opening and inspecting tanks and void spaces (Petrobras, 2001a). They had not been offered adequate procedures or training to deal with emergency situations regarding platform stability. Petrobras only provided general HSE training to platform personnel, not training specific to the risks associated with their operations or locations on the rig.
The inquiry commission for the P-36 incident found glaring gaps in Petrobras HSE policy and philosophies. There was no established system for the identification of potential HSE risks, including major accidents or ‘total loss’ scenarios (Petrobras, 2001a). According to experts and Petrobras’s corporate management, the platform thought of as unsinkable (Gibb, 2001b). There were almost no prescribed safety procedures for dealing with damaged equipment, stabilizing operating systems, or altering operation protocol in the event of an accident. According to the commission, Petrobras’s most grievous HSE offense was building emergency drainage tanks in support columns (Petrobras, 2001a). By connecting emergency equipment to equipment crucial to the platform’s operation and stability, Petrobras had assured that almost any emergency situation would hinder the operation of the P-36.
The P-36 incident was the final blow leading to the failure of Petrobras’s organizational reputation. An organization’s reputation is the sum of public perceptions, industry reputation, respect from personnel within the organization, and the opinions of users, shareholders, the government, and other stakeholders. In the 1990s, Petrobras was considered ‘one of the world’s leading experts’ (‘Giant oil rig sinks off Brazilian coast’, 2001). However, a series of environmental and management mishaps slowly degraded Petrobras’s reputation. In January 2000, more than 500 tons of oil leaked from underwater pipes at a Petrobras refinery. Causing an oil slick of 40 square kilometers in the scenic Guanabara Bay near Rio de Janeiro, the spill was one of the ‘city’s worst environmental disasters in 25 years’ (‘Brazil oil giant attacked over leak’, 2000). It was the second worst in terms of environmental impact (‘Brazil oil giant attacked over leak’, 2000). In July 2000, Petrobras spilled methyl tertiary butyl ether (MTBE), known to cause cancer in animals and toxic to humans, near Rio de Janeiro (‘Giant oil rig sinks off Brazilian coast’, 2001). In August of that same year, another refinery leak sent four million liters of crude oil into the Iguacu River to become ‘Brazil’s biggest spill in 25 years’ (‘Brazil hit by new toxic spill’, 2000). Environmentalists claimed it would take ten years for the environment to recover from the accident. Another spill near a natural reserve created a 12-kilometer oil slick along the Bay of Parana (Gibb, 2001a). The incident was the sixth environmental accident for Petrobras in 2000 and focused international attention on the corporation (Rocha, 2001).
After the successive incidents, incompetence in clean up, and severe fines levied by the Brazilian authorities, the public began to view Petrobras as a ‘villian’ (Rocha, 2001). A chronology of Petrobras incidents from September 1991 to March 2001 is included in the Appendix. The company’s poor environmental record prompted inquiries into its safety record. According to unions, 35 Petrobras workers have died since 1998 (‘Giant oil rig sinks off Brazilian coast’, 2001). The P-36 incident in March 2001 added to the death toll and established the company as an enemy of the environment and safety. The P-36 incident was referred to by those within the organization as ‘one of the worst in Petrobras’s history’ (Petrobras, 2001b). Following the incident, the price of Petrobras stock shares dropped drastically (‘Petrobras still acts like a monopoly’, 2001). Petrobras tried to redeem itself by organizing an independent inquiry commission into the incident. Regrettably, the commission revealed Petrobras’s gross negligence regarding quality, risk management, and HSE procedures.
According to the analysis provided, the P-36 incident could have been avoided. The following alternative actions are offered for others to adopt to avoid repetition of the problems described and analyzed in this report:
Build ‘firsts’ to the highest quality standards feasible. A construction or engineering project that is the ‘first of its kind’, ‘largest ever’, etc. should be designed, constructed, operated, and managed to high standards. For example, the P-36 was designed and constructed to be the largest oil platform in the world. It was the first oil platform to be built that big. Using quality materials and subcontractors could have minimized equipment failure. Intricately designed operations and safety systems (quality engineering) could have minimized operator error, provided a more accurate assessment of incident issues, and provided backups that could have prevented the chain of events that led to the P-36 incident. Cost-cutting measures for future oil platforms could have been enacted after the P-36 had been successfully operated and analyzed.
Devise a comprehensive quality plan that considers stakeholders, quality control, quality assurance, risk management, HSE, productivity, and organizational reputation. Quality should not be defined solely by the company; the desires of stakeholders should also be incorporated. For example, Petrobras should have consulted industry standards (and not just those within the Petrobras oil and gas sector monopoly), regulatory guidelines, public preferences, and business interests in the determining an acceptable quality for P-36. Similarly, quality control and assurance need to be a part of an on-going evaluation of equipment purchase, operating, and maintenance decisions. Risk management, HSE, productivity, and organizational reputation also must be intertwined with quality and accounted for in the quality plan. How does quality affect risks and the ability to manage risks? Do quality compromises lead to HSE concerns? How do quality standards affect productivity and organizational reputation? Petrobras should have identified through its quality plan that cutting costs on equipment and safety quality would increase risks and HSE concerns.
Analyze equipment, operations, and personnel from a ‘system context’ to manage risks. Equipment, instruments, and personnel aboard P-36 operated within ‘bigger systems’ (Morris & Pinto, 2004). Risks should have been analyzed on an individual level (i.e., functions that would not be performed if certain equipment malfunctions) and system level (i.e., other equipment and systems that would be affected if certain equipment malfunctions).
Establish HSE procedures that are:
- General to the construction or engineering project;
- Specific to process locations; and
- Specific to personnel responsibilities.
General HSE procedures should apply to all personnel and include worst-case scenario. Many P-36 workers were unprepared for the sinking of the platform because it had never been clarified that the platform could sink. Procedures for specific locations would notify personnel in certain sites of the adjacent HSE risks, regardless the worker’s function. In the P-36 example, management and administrative personnel working in offices near emergency tanks or in the proximity of petroleum vapors should be made aware of the associated HSE risks and emergency procedures. Specific HSE procedures according to personnel responsibility are essential so that guidelines are tailored to risks for each job. These HSE standards and procedures should be satisfactory to all stakeholders including the public, the legal system, regulatory authorities, and operating personnel. Review should be on-going to ensure the procedures’ continued validity.
Provide on-going training to all platform personnel in the areas of:
- Personnel responsibilities (operating procedures, preventative maintenance, new technologies, etc.);
- Risk identification;
- HSE.
The inquiry commission of the P-36 incident cited specific improvements that could be made in each of these areas: ‘Improve the definition of responsibilities as they relate to the operation, maintenance, and supervision…’ ‘Review supervisors’ functions to reduce their bureaucratic activities and to concentrate their focus on operating activities…’ ‘Review the size and upgrade the skills of the company platform crew…’ ‘Train the teams in the techniques of identification, evaluation, and control of risk situations.’ (Petrobras, 2001a)
On-going training is important for several reasons. First, employees would constantly be reminded that workplace practices, risks, HSE procedures and be kept abreast of the latest regulations (or revisions to corporate protocol based on on-going risk assessments). In addition, on-going training ensures that new employees are taught proper procedures and provided information similar to that of employees with longer tenure. Moreover, providing extensive and ongoing information to employees about can improve the practices they employ during daily tasks.
Dissociate HSE emergency systems from other general operating systems or important functional systems. The P-36 incident inquiry committee recommended, for example, ‘do not build emergency drainage tanks into support columns’ (Chile, 2004). Emergency systems should be operated separately from other systems so that the malfunctions of other systems can be isolated for the emergency system to take its place. Conversely, if the emergency system fails to curtail the accident or is itself part of the problem, it should be able to be taken out of the system loop and repaired or disabled. By locating the emergency drainage tanks in the support columns of P-36, Petrobras assured that if the emergency drainage tanks failed, they would affect the most basic safety feature of the entire platform: the ability to remain stable.