Following up on my previous post about the Gulf oil spill, Normal Accidents?, here is a guest contribution by Charles Perrow, Professor Emeritus of Sociology at Yale University, and author of the classic book Normal Accidents. This post is adapted from the preface to the forthcoming paperback edition of Perrow’s 2007 book The Next Catastrophe: Reducing Our Vulnerabilities to Natural, Industrial, and Terrorist Disasters, (Princeton, 2011).

by Charles Perrow

oilIn 1984 I published a book, Normal Accidents (revised edition, 1999), that argued that we should abandon systems with catastrophic potential if they were interactively complex and tightly coupled, unless they could be redesigned to minimize these dangerous characteristics.  Complexity and coupling can be reduced through modular, rather than integrated designs, and catastrophic potential reduced through deconcentrating hazardous materials close to population centers or sensitive ecologies.  We might decide that some systems with catastrophic potential are so vital that the risk of a rare, but possible system failure is worth running.  Government officials felt that way about our nuclear defense system for many decades, steadily increasing the risks of a huge catastrophe.  I will argue that deepwater drilling, especially in ecologically sensitive areas, should be abandoned, because it combines complexity and coupling with catastrophic potential.

Interactive complexity is not simply many parts; it means that many of the parts can interact in ways no designer anticipated and no operator can understand.  Since everything is subject to failure, the more complex the system the more opportunities for unexpected interactions of failures.  Tight coupling means that failures can cascade through the system since the system cannot be stopped, fixed and restarted without damage; substitutions are not available, and failed subsystems cannot be isolated.

I do not think that the failure on April 20, 2010 of the rig built by Transocean and run by BP had a system accident (or “normal accident”).  While such rigs are very complex and very tightly coupled, it is more likely that faulty executive decisions resulted in knowingly running unnecessary and dangerous risks.  To be a system failure, in my definition, requires that even if everyone tries as hard as they can to operate safely, it is in the nature of complex, tightly coupled systems to inevitably (though rarely)  have the unforeseeable interaction of failures, usually small ones individually, that can cascade through the system.  This was not the case with the Transocean rig; BP management frequently overrode the objections and warnings of its own operators and engineers, and those of its subcontractor, Transocean, and independent consultants.  Nothing that transpired was unexpected.

BP has had a history of ignoring warnings by its own staff in order to cut costs.  A refinery explosion in 2005 and a massive oil spill in Prudhoe Bay, Alaska in 2006, resulted in (small) criminal penalties for executive malfeasance; the pipeline had a smaller spill last year, and there are currently strident warnings about the dangers of a massive spill on the pipeline in Alaska.  The firm had a close call in 2005 with its deepwater drilling Thunder Horse rig.

With this record, perhaps deepwater drilling is safe if the other firms engaged in it do practice safety.  It is hard to tell.  Exxon-Mobil is reportedly very concerned with safety after the Valdez accident, and said to be the industry leader in safety.  But it is not encouraging that in July of this year Attorney General Eric Holden was asked if BP was doing anything different than others in the industry.  He noted “certain commonality of the way oil companies had been operating” in the Gulf, but since the investigation of drilling is ongoing, he would give no specifics.  BP may be an extreme case of putting profits over the safety of their workers, the environment, and the viability of the firm, but disasters in the chemical industry have been increasing in recent decades, so one should not be reassured that BP is the only bad apple. The Materials Management Service (MMS) reports there are 33 rigs that have permits for exploratory drilling in deepwater in the Gulf; 29 were inspected after the spill and no serious violations were found. One may be skeptical of their finding.  For example, MMS only recommends, but does not require, a backup blowout preventer (the preventer failed in the April 20, 2010 Horizon accident).  MMS does not set specifications for all pipes, allowing BP to use less safe pipes in its rig, and so on.  Furthermore, the unsafe practices in the Horizon rig occurred when the rig ran into trouble; inspection would not catch such bad practices.  We cannot be reassured that BP is an outlier and other firms would operate safely, though a news story about Exxon’s last minute abandonment of a project, the deepest drilling at the time, is encouraging.  Less encouraging is that another drilling firm bought the lease to the abandoned exploratory drilling and has continued to drill, but for two years has recovered no oil from what is expected to be a vast pool.

Perhaps we should be reassured that the Horizon accident has alerted the industry to the dangers of deepwater drilling sufficiently to make accidents extremely rare, and furthermore has led them to have adequate emergency response facilities on hand if there is the rare accident.  After all, the nuclear power industry appears to have made significant safety improvements since the TMI accident; could not the deepwater drilling industry improve as well?  A rebuttal is that nuclear plants in the U.S. continue to have near misses despite improvements, and are not as much endangered by storms and hurricanes. BP, at least, does not appear to have changed its safety provisions in spite of the Thunder Horse near-disaster on July 11, 2005, because of a pump valve installed backwards and cracks in underwater pipes because of shoddy welding, and its Atlantis rig is being investigated because of whistleblower charges of unverified engineering documents.

An argument against a ban on deepwater drilling is that the expensive rigs able to do this would simply move to other locations that have no ban.  It is similar to intensive policing in one area; it simply drives the criminals to other areas, thus we should make no effort to increase policing in the high crime area – an argument for inaction. Were they to move to Norway or Brazil, where drilling takes place, they would have to have stronger safety standards – e.g. a backup blowout preventer – than those required in the Gulf.  But they might move their rigs to other nations where standards are presumably below those of the Gulf, and where there may be ecosystems as vulnerable as those of the Gulf.  The only response to this argument, unfortunately, is that one has to begin somewhere, and the U.S. ban just might encourage other nations to tighten regulations.

A further argument has been put forth by the oil industry and state governments bordering the Gulf: the economic impact upon the area would be severe in terms of jobs lost and business activity associated with pumping, transporting and selling the oil.  But the effect upon oil-related jobs is not likely to be as severe as the effect upon non-oil activities.  Oil is capital intensive, with few workers per unit of capital; non-oil activities such as fishing and tourism are labor intensive.  More jobs are at stake in non-oil operations.

A final argument is that we need the oil; shutting down deep-sea drilling would raise the price of oil in the U.S. and make us more dependent upon foreign sources.  Raising the price of oil is to be encouraged.  A higher price of oil would mean that investments in non-carbon sources of energy, such as solar, wind, and geothermal would increase, as would investments in efficiency and conservation.  The price of oil should be much higher to encourage these investments.  Since a carbon tax is out of the question in the U.S., and a pollution tax on gasoline unlikely because of public opposition, and especially oil industry opposition, curtailing production is the next best step.  Another step, a bit more likely than a carbon tax, would be a steep tax upon imported oil, reducing our dependency by tipping the market away from imports.  The market at present is not a “free” one, since the true costs of burning oil are not reflected in its price – the “externality” of pollution is treated as a free good when it actually imposes a heavy tax upon citizens and their environment.

The interactive complexity and tight coupling of deep-sea drilling rigs is apparent; even if BP had not skimped on safety and not overridden the objections of their own personnel and those of their subcontractors, the system could have the rare but possible unexpected interaction of failures. They are inevitable since nothing is perfect.  Profit motives and lax regulation only make such disasters more likely.