As we should and must, offshore operators, contractors, and regulators suffer over every injury, leak, or potentially hazardous event. This is also true for onshore oil and gas operations and most other industries. Yet for the past 2 years, we have been waiting for a proper investigation into the origins of the Covid virus. The Daily Mail is reporting that the Director-General of the WHO now believes that the virus was released from the Wuhan lab.
How can a company have a proper safety culture in a world where this level of malfeasance and stonewalling are tolerated and rewarded?
Kudos to BSEE’s Gulf of Mexico Region for their timely safety alerts and comprehensive updates on offshore incidents, trends, and compliance issues. Their most recent update is linked below.
For the past 50 years. my main goal for US offshore operations has been a zero fatality year. Sadly, that goal has never been achieved and will not be achieved this year (see slide 15).
Many casualties are associated with activities that are not perceived to be of high risk. The message on slide 22 of Jason’s presentation is thus very important:
Perceived low risk activities can still result in impactful injuries. Continually risk assess the work being undertaken, no matter if it permitted or nonpermitted work.
Know your personal limits and stop before you reach your limit. Pause and ask for help before you are at your limit.
“Our knowledge and expertise in geoscience and petroleum engineering represent advantageous foundation for CCS development, leading us towards our carbon emissions reduction target.”
Those who closely followed Australia’s Montara Inquiry in 2010 may be less convinced about PTTEP’s expertise. The Montara well suspension program was completely irresponsible. Even though the production casing cement was clearly compromised, PTTEP suspended the well without a single barrier in the well bore. The company was extremely lucky to have avoided a major safety, environmental, and economic disaster. Perhaps they are a very different company now; I certainly hope so.
Montara blowout, Timor Sea
The PTTEP announcement adds to our skepticism about the motives of some CCS proponents. Is CCS prudent public policy? That question is by no means settled and there has been very little opportunity for comment and debate. BOE has raised concerns and there are no doubt many more that have yet to be addressed.
I never liked the label “slips, trips, and falls” because it trivializes serious safety incidents. Falls don’t get headlines, but they kill workers. In the 10 years prior to Macondo, falls were the leading cause of Gulf of Mexico fatalities. 17 workers died from fall incidents during that period. Related incidents associated with falling or moving equipment (15) and lifting operations (5) accounted for another 20 fatalities. There was only one fire related fatality.
Unfortunately, BSEE’s posted incident data are incomplete, so more detailed, company specific analysis is difficult. No incident summaries whatsoever are posted for 2001-2012 and 2021, and 2020 fatalities are only described as “occupational” or “non-occupational.”
BSEE does do a very good job with their safety alert program, and has repeatedly expressed concerns about chronic grating and fall issues. 2022 Safety Alerts 438and 427, and 8 other BSEE alerts issued within the last 3 years (nos. 353, 365, 378, 389, 399, 409, 416, 423) addressed grating and falls. BSEE has also conducted blitz inspections to identify problem facilities, and the Coast Guard has repeatedly raised concerns about grating and fall protection.
Per BSEE Safety Alert 365, grating, open hole, and fall prevention safety measures were seriously deficient at many of the facilities visited during their blitz inspections in 2019. The prevention of fall incidents requires the full commitment of management. Some companies are clearly not making that commitment.
[Disclosure: I assisted the legal team that defended Bob Kaluza. That said, I completely disagreed with the charges against him and Don Vidrine before my involvement in the case.]
Bob Kaluza (L) and Don Vidrine
Unsurprisingly, there was a lot of tough guy talk in Washington DC after the blowout:
“Our job is basically to keep the boot on the neck of British Petroleum”
It was therefore predictable that the Department of Justice (DOJ) would choose to prosecute BP employees individually. There were BP managers who would have been good candidates, but instead DOJ chose to criminally prosecute the working stiffs – the two BP well site leaders on the rig. They were the lowest ranking BP employees associated with the incident. This was apparently acceptable to BP, since their plea agreement blamed Kaluza and Vidrine’s for their role in overseeing the negative pressure test (#blametheworker). Never mind that:
BP management was responsible for the well planning and shortcuts that were the root causes of the blowout (see the previous posts in this Macondo series).
the extent to which the negative pressure test was misconducted and misinterpreted was and remains a topic of dispute.
there were no regulations or standards requiring this test or explaining how it should be conducted, and BP’s internal guidance was woefully inadequate.
Bob Kaluza was a temporary replacement for the regular well site leader, had worked primarily onshore, and had never conducted or witnessed a negative pressure test.
Kaluza and Vidrine were themselves victims and were fortunate to have survived the incident.
Despite all of this, DOJ still chose to prosecute the two well site leaders. However, the weaknesses in the DOJ case became more obvious over time, and DOJ dropped all but a misdemeanor water pollution charge. Vidrine, who had health issues that were exacerbated by the case, accepted a plea deal. Kaluza was confident of his innocence and chose to make his case in court. His defense team was very strong, and the trial was essentially a walkover. After less than 2 hours of deliberation, the jury fully acquitted Bob Kaluza (2/25/2016). Sadly, Don Vidrine passed away the following year.
Contrary to national and regional planning documents and the associated response exercises, Energy Secretary Chu, whose department had no jurisdiction over offshore oil and gas operations or the emergency response, assumed the leadership role on the well control aspects of the blowout. Secretary Chu is a Nobel prize winning physicist and had the President’s support to get involved with the response. Although he was not a drilling engineer or geologist, he soon became the dominant figure on well control decisions.
BP’s top kill operation (see diagram above) was intended to overcome and halt the flow of oil by pumping heavy mud into the well bore. Per an excellent paper by Dr. Mayank Tyagi and colleagues at LSU (Analysis of Well Containment and Control Attempts in the Aftermath of the Deepwater Blowout in MC252), the operation was not successful because the pumping rate and mud weight did not generate sufficient pressure.
Consistent with Dr. Tyagi’s analysis, the well would likely have been killed on 5/28/2010, shortening the blowout by 48 days, had Secretary Chu not stopped the top kill operation over the objections of BP engineers. While it was reasonable for the Secretary and his team to be concerned about possible casing leaks and the fracturing of subsurface formations, the subsequent (7/15/2010) closure of the capping stack demonstrated that the well had sufficient integrity to support the top kill operation. Questions about the aborted top kill effort and how that decision was made are therefore important and merit careful review. Did the Macondo well flow unnecessarily into the Gulf for an additional 48 days (5/28-7/15)? Did the National Incident Command facilitate or delay source control?
Keep in mind that the National Incident Command almost made a similar mistake in July. Even after the capping stack successfully shut-in the well on 7/15, Incident Commander Thad Allen (USCG) continued to call the closure of the capping stack a temporary test and threatened to require BP to resume flow from the well. We thus had a bizarre situation where the Federal Incident Commander was threatening to require the resumption of a blowout. Fortunately, informed input from experienced engineers prevailed. The well remained shut-in and the static well-kill operation was successful.
While the previously discussed planning, cementing, and well suspension issues allowed the well to flow, there were many other equipment, operational, and management deficiencies that elevated the incident to a disaster. Below are those that bother me the most:
Blowout Preventers
The Deepwater Horizon BOP stack had a single blind shear ram. Regardless of what the regulations allowed, you don’t drill a complex well like this without redundant shearing capability (and at the time of the blowout most deepwater drillers were using rigs with dual shear rams). All well control emergencies requiring the emergency disconnect sequence, deadman, and autoshear functions are dependent on effective shearing capability. You can have redundancy in every other BOP element, but without dual shear rams, you don’t have a redundant BOP system. Further, for full redundancy both shear rams should be capable of sealing the well bore after shearing. In that regard, the present regulations and the applicable standard (API S 53) require only one shear ram capable of sealing. They are thus deficient and should be updated.
The DWH BOP system did not have full bore shearing capability (available at the time) which may have sheared the deflected drill pipe.
The DWH BOP system was not properly maintained and recertified as required by regulation.
Transocean’s “condition based maintenance” was a euphenism for “fix it when it fails.” Perhaps worse, BP authorized the continuation of operations knowing that an annular preventer was leaking.
The initial flow from the well was directed to the mud-gas separator instead of being routed overboard via the diverter. Routing the flow to the diverter would have provided additional time for the crew to safely evacuate.
Gas detectors
Not all gas detectors were fully operational. As justification, Transocean’s report expressed concerns about alarm fatigue, a weak excuse. Alarm issues can be effectively managed without disabling the devices.
The gas detectors did not automatically shutdown the generators, the source of the initial explosion. This is somewhat understandable on a dynamically positioned rig that is dependent on power to maintain position. However, someone should have shut down the generators as soon as gas was detected.
Engine overspeed devices didn’t work, and apparently weren’t tested regularly. Had they worked, the engine room explosion may have been prevented.
The crew had time to activate the Emergency Disconnect Sequence, but did not.
Industry standards are critical to safety achievement. They represent best practices as determined by leading experts in the many disciplines that support oil and gas exploration and development. Another plus for standards is that, unlike regulations, they can be developed in a timely manner, particularly where there is an immediate need. However, industry mergers and streamlining have reduced the diversity of input, and some companies either do not participate or participate primarily to promote or protect their particular interest. The need for a consensus can also result in “lowest common denominator” outcomes that lack the necessary rigor.
Minerals Management Service (MMS) reviews indicated that cementing issues were the leading contributing factor to well control incidents between 1992 and 1996 (see chart below). On August 16, 2000, MMS challenged a new API cementing work group to improve zonal isolation, reduce the occurrence of sustained casing pressure, and prevent annular flow incidents before, during, and after cementing operations. Unfortunately, the standard was long delayed because of internal disagreements within the work group. Feedback indicated that some participants preferred a watered down, less rigorous version.
It is undisputed that the primary cement at Macondo failed to isolate hydrocarbons in the formation from the wellbore—that is, it did not accomplish zonal isolation. If the cement had set properly in its intended location, the cement would have prevented hydrocarbons from flowing out of the formation and into the well. The cement would have been a stand-alone barrier that would have prevented a blowout even in the absence of any other barriers (such as closed blowout preventer rams, drilling mud, and cement plugs).
API Standard 65-2, Isolating Potential Flow Zones During Well Construction, if completed in a timely manner and complied with would likely have prevented not only the Macondo disaster, but also the 2009 Montara blowout in Australia. (The Montara investigation hearings were covered extensively on this blog in 2010.) This important standard was ultimately finalized in a reactive manner after the Macondo well blew out.
Standard 65-2 focuses on the prevention of flow through or past barriers that are installed during well construction. A few key elements that are pertinent from a Macondo perspective:
Companies are required to perform a risk assessment prior to utilizing foamed cement and make sure that the results of this assessment are incorporated in the cementing plan. In setting the production casing on the Macondo well, foamed cement was used in an oil-based mud environment, destablizing the cement and contributing to the failure to isolate the highly productive oil reservoir.
The framework in Annex D of the standard does a good job of outlining the questions that should be asked in conducting a cementing risk assessment. These issues identified in the Chief Counsel’s report, which includes an outstanding review of the technical and management issues associated with the cementing/zonal isolation of the Macondo reservoirs, should have been addressed by BP and their contractors before initiating the well suspension program:
narrow pore pressure/fracture gradient;
use of nitrogen foamed cement;
use of long string casing design;
short shoe track;
limited number of centralizers;
uncertainty regarding float conversion;
limited pre-cementing mud circulation;
decision not to spot heavy mud in rathole;
low cement volume;
low cement flow rate;
no cement evaluation log before temporary abandonment; and
temporary abandonment procedures that would severely underbalance the well and place greater stress than normal on the cement job.
Unfortunately, such an assessment was not conducted and critical operational decisions were made in a rash manner with the objective of saving time. We know the outcome – 11 lives lost, massive pollution, and enormous social costs
Despite making multiple changes over the last nine days before the blowout, the Macondo team did not formally analyze the risks that its temporary abandonment procedures created. The Macondo team never asked BP experts such as subsea wells team leader Merrick Kelley about the wisdom of setting a surface cement plug 3,000 feet below the mudline to accommodate setting the lockdown sleeve or displacing 8,300 feet of mud with seawater without first installing additional physical barriers. It never provided rig personnel a list of potential risks associated with the plan or instructions for mitigating those risks.
Almost every decision the Chief Counsel’s team identified as having potentially contributed to the blowout occurred during the execution phase.
Bud's Offshore Energy (BOE) 