Learn about diversity at ASEE
ASEE would like to acknowledge the generous support of our premier corporate partners.



Normalizing Deviance

The Gulf oil spill, like the space shuttle accidents, exposed a fault-tolerant culture.

Photo: HENRY PETROSKI - Phobias tend to defy logic; techno-phobia is no exception. Last spring and summer, while oil gushed into the Gulf of Mexico, much of the media coverage following the fatal explosion on the drilling rig Deepwater Horizon focused on the blowout preventer located a mile below the surface. As its name denotes, the device’s function was to prevent exactly the kind of blowout that occurred.

Over a 25-year period, a pre-accident survey had found, blowout preventers on about 15,000 other wells had to be activated in an emergency only 11 times. Unfortunately, in five of those cases, the preventer failed, as it did in the Gulf. This 45 percent historical failure rate did not jibe with the 0.07 failure rate claimed during the government-mandated testing of blowout preventers.

Even as lax oversight and testing procedures were being called into question, the oil industry was using this low failure rate to argue for less frequent testing of the complex systems of valves and rams that were the last line of defense against a blowout. It was estimated that reducing testing requirements could save oil companies almost $200 million per year.

A blowout preventer was also an expensive piece of equipment to maintain, with an estimated cost of $700 per minute incurred during the time that drilling had to be stopped, the device hauled to the surface, repaired, lowered back down, and reattached to the wellhead. The economics of the situation clearly argued against a conservative maintenance regimen and promoted a culture of risk taking.

In the case of the oil company BP, whose Gulf operations were directed out of Houston, the culture that developed around deepwater drilling operations was not unlike that of another Houston-based technology. At the outset of the space-shuttle program, the total-failure rate of shuttles was estimated by engineers to be 1 percent and by managers to be 0.001 percent. The Challenger accident proved the actual failure rate to be 4 percent, and after the Columbia accident it stood at close to 2 percent. Repeated negative experiences with eroding O-rings and shedding insulation were not heeded but taken as signs of the robustness of the space vehicle and promoted a fault-tolerant culture that allowed for what has been called a “normalization of deviance.”

Normalized deviance also plagued the oil-drilling industry, where at least some companies let the financial bottom line dominate decision making. The two dozen successful shuttle flights before Challenger and an additional 87 successful missions before Columbia emboldened NASA. So, too, did the low incidence of needing to call upon the blowout preventer in an emergency promote a sense of bravado in the operation of offshore oil rigs.

It is easy in retrospect to say that the Deepwater Horizon accident did not have to happen. There evidently were warnings that the well being drilled was a difficult one to control, and there were reported irregularities in the condition and status of safety devices and warning systems on the rig, which was owned by the drilling contractor Transocean. However, instead of these precursors of failure being heeded, they were ignored or accepted as business as usual.

The presence of the blowout preventer provided a sense of backup security, in that it could be called upon to control the well should anything go drastically wrong on the rig. This proved to place unwarranted confidence in an unreliable piece of machinery. As of this writing, exactly what went wrong with the blowout preventer remains to be determined. What appears to be clear, however, is that the root cause of the Deepwater Horizon oil spill was at least as much a human problem as a mechanical one.

Henry Petroski is the Aleksandar S. Vesic Professor of Civil Engineering and a professor of history at Duke University. His latest book is The Essential Engineer: Why Science Alone Will Not Solve Our Global Problems.




© Copyright 2010
American Society for Engineering Education
1818 N Street, N.W., Suite 600
Washington, DC 20036-2479
Telephone: (202) 331-3500