Kudos to BSEE’s Gulf of Mexico Region for their timely safety alerts and comprehensive updates on offshore incidents, trends, and compliance issues. Their most recent update is linked below.
For the past 50 years. my main goal for US offshore operations has been a zero fatality year. Sadly, that goal has never been achieved and will not be achieved this year (see slide 15).
Many casualties are associated with activities that are not perceived to be of high risk. The message on slide 22 of Jason’s presentation is thus very important:
Perceived low risk activities can still result in impactful injuries. Continually risk assess the work being undertaken, no matter if it permitted or nonpermitted work.
Know your personal limits and stop before you reach your limit. Pause and ask for help before you are at your limit.
“Our knowledge and expertise in geoscience and petroleum engineering represent advantageous foundation for CCS development, leading us towards our carbon emissions reduction target.”
Those who closely followed Australia’s Montara Inquiry in 2010 may be less convinced about PTTEP’s expertise. The Montara well suspension program was completely irresponsible. Even though the production casing cement was clearly compromised, PTTEP suspended the well without a single barrier in the well bore. The company was extremely lucky to have avoided a major safety, environmental, and economic disaster. Perhaps they are a very different company now; I certainly hope so.
Montara blowout, Timor Sea
The PTTEP announcement adds to our skepticism about the motives of some CCS proponents. Is CCS prudent public policy? That question is by no means settled and there has been very little opportunity for comment and debate. BOE has raised concerns and there are no doubt many more that have yet to be addressed.
[Disclosure: I assisted the legal team that defended Bob Kaluza. That said, I completely disagreed with the charges against him and Don Vidrine before my involvement in the case.]
Bob Kaluza (L) and Don Vidrine
Unsurprisingly, there was a lot of tough guy talk in Washington DC after the blowout:
“Our job is basically to keep the boot on the neck of British Petroleum”
It was therefore predictable that the Department of Justice (DOJ) would choose to prosecute BP employees individually. There were BP managers who would have been good candidates, but instead DOJ chose to criminally prosecute the working stiffs – the two BP well site leaders on the rig. They were the lowest ranking BP employees associated with the incident. This was apparently acceptable to BP, since their plea agreement blamed Kaluza and Vidrine’s for their role in overseeing the negative pressure test (#blametheworker). Never mind that:
BP management was responsible for the well planning and shortcuts that were the root causes of the blowout (see the previous posts in this Macondo series).
the extent to which the negative pressure test was misconducted and misinterpreted was and remains a topic of dispute.
there were no regulations or standards requiring this test or explaining how it should be conducted, and BP’s internal guidance was woefully inadequate.
Bob Kaluza was a temporary replacement for the regular well site leader, had worked primarily onshore, and had never conducted or witnessed a negative pressure test.
Kaluza and Vidrine were themselves victims and were fortunate to have survived the incident.
Despite all of this, DOJ still chose to prosecute the two well site leaders. However, the weaknesses in the DOJ case became more obvious over time, and DOJ dropped all but a misdemeanor water pollution charge. Vidrine, who had health issues that were exacerbated by the case, accepted a plea deal. Kaluza was confident of his innocence and chose to make his case in court. His defense team was very strong, and the trial was essentially a walkover. After less than 2 hours of deliberation, the jury fully acquitted Bob Kaluza (2/25/2016). Sadly, Don Vidrine passed away the following year.
Contrary to national and regional planning documents and the associated response exercises, Energy Secretary Chu, whose department had no jurisdiction over offshore oil and gas operations or the emergency response, assumed the leadership role on the well control aspects of the blowout. Secretary Chu is a Nobel prize winning physicist and had the President’s support to get involved with the response. Although he was not a drilling engineer or geologist, he soon became the dominant figure on well control decisions.
BP’s top kill operation (see diagram above) was intended to overcome and halt the flow of oil by pumping heavy mud into the well bore. Per an excellent paper by Dr. Mayank Tyagi and colleagues at LSU (Analysis of Well Containment and Control Attempts in the Aftermath of the Deepwater Blowout in MC252), the operation was not successful because the pumping rate and mud weight did not generate sufficient pressure.
Consistent with Dr. Tyagi’s analysis, the well would likely have been killed on 5/28/2010, shortening the blowout by 48 days, had Secretary Chu not stopped the top kill operation over the objections of BP engineers. While it was reasonable for the Secretary and his team to be concerned about possible casing leaks and the fracturing of subsurface formations, the subsequent (7/15/2010) closure of the capping stack demonstrated that the well had sufficient integrity to support the top kill operation. Questions about the aborted top kill effort and how that decision was made are therefore important and merit careful review. Did the Macondo well flow unnecessarily into the Gulf for an additional 48 days (5/28-7/15)? Did the National Incident Command facilitate or delay source control?
Keep in mind that the National Incident Command almost made a similar mistake in July. Even after the capping stack successfully shut-in the well on 7/15, Incident Commander Thad Allen (USCG) continued to call the closure of the capping stack a temporary test and threatened to require BP to resume flow from the well. We thus had a bizarre situation where the Federal Incident Commander was threatening to require the resumption of a blowout. Fortunately, informed input from experienced engineers prevailed. The well remained shut-in and the static well-kill operation was successful.
While the previously discussed planning, cementing, and well suspension issues allowed the well to flow, there were many other equipment, operational, and management deficiencies that elevated the incident to a disaster. Below are those that bother me the most:
Blowout Preventers
The Deepwater Horizon BOP stack had a single blind shear ram. Regardless of what the regulations allowed, you don’t drill a complex well like this without redundant shearing capability (and at the time of the blowout most deepwater drillers were using rigs with dual shear rams). All well control emergencies requiring the emergency disconnect sequence, deadman, and autoshear functions are dependent on effective shearing capability. You can have redundancy in every other BOP element, but without dual shear rams, you don’t have a redundant BOP system. Further, for full redundancy both shear rams should be capable of sealing the well bore after shearing. In that regard, the present regulations and the applicable standard (API S 53) require only one shear ram capable of sealing. They are thus deficient and should be updated.
The DWH BOP system did not have full bore shearing capability (available at the time) which may have sheared the deflected drill pipe.
The DWH BOP system was not properly maintained and recertified as required by regulation.
Transocean’s “condition based maintenance” was a euphenism for “fix it when it fails.” Perhaps worse, BP authorized the continuation of operations knowing that an annular preventer was leaking.
The initial flow from the well was directed to the mud-gas separator instead of being routed overboard via the diverter. Routing the flow to the diverter would have provided additional time for the crew to safely evacuate.
Gas detectors
Not all gas detectors were fully operational. As justification, Transocean’s report expressed concerns about alarm fatigue, a weak excuse. Alarm issues can be effectively managed without disabling the devices.
The gas detectors did not automatically shutdown the generators, the source of the initial explosion. This is somewhat understandable on a dynamically positioned rig that is dependent on power to maintain position. However, someone should have shut down the generators as soon as gas was detected.
Engine overspeed devices didn’t work, and apparently weren’t tested regularly. Had they worked, the engine room explosion may have been prevented.
The crew had time to activate the Emergency Disconnect Sequence, but did not.
Industry standards are critical to safety achievement. They represent best practices as determined by leading experts in the many disciplines that support oil and gas exploration and development. Another plus for standards is that, unlike regulations, they can be developed in a timely manner, particularly where there is an immediate need. However, industry mergers and streamlining have reduced the diversity of input, and some companies either do not participate or participate primarily to promote or protect their particular interest. The need for a consensus can also result in “lowest common denominator” outcomes that lack the necessary rigor.
Minerals Management Service (MMS) reviews indicated that cementing issues were the leading contributing factor to well control incidents between 1992 and 1996 (see chart below). On August 16, 2000, MMS challenged a new API cementing work group to improve zonal isolation, reduce the occurrence of sustained casing pressure, and prevent annular flow incidents before, during, and after cementing operations. Unfortunately, the standard was long delayed because of internal disagreements within the work group. Feedback indicated that some participants preferred a watered down, less rigorous version.
It is undisputed that the primary cement at Macondo failed to isolate hydrocarbons in the formation from the wellbore—that is, it did not accomplish zonal isolation. If the cement had set properly in its intended location, the cement would have prevented hydrocarbons from flowing out of the formation and into the well. The cement would have been a stand-alone barrier that would have prevented a blowout even in the absence of any other barriers (such as closed blowout preventer rams, drilling mud, and cement plugs).
API Standard 65-2, Isolating Potential Flow Zones During Well Construction, if completed in a timely manner and complied with would likely have prevented not only the Macondo disaster, but also the 2009 Montara blowout in Australia. (The Montara investigation hearings were covered extensively on this blog in 2010.) This important standard was ultimately finalized in a reactive manner after the Macondo well blew out.
Standard 65-2 focuses on the prevention of flow through or past barriers that are installed during well construction. A few key elements that are pertinent from a Macondo perspective:
Companies are required to perform a risk assessment prior to utilizing foamed cement and make sure that the results of this assessment are incorporated in the cementing plan. In setting the production casing on the Macondo well, foamed cement was used in an oil-based mud environment, destablizing the cement and contributing to the failure to isolate the highly productive oil reservoir.
The framework in Annex D of the standard does a good job of outlining the questions that should be asked in conducting a cementing risk assessment. These issues identified in the Chief Counsel’s report, which includes an outstanding review of the technical and management issues associated with the cementing/zonal isolation of the Macondo reservoirs, should have been addressed by BP and their contractors before initiating the well suspension program:
narrow pore pressure/fracture gradient;
use of nitrogen foamed cement;
use of long string casing design;
short shoe track;
limited number of centralizers;
uncertainty regarding float conversion;
limited pre-cementing mud circulation;
decision not to spot heavy mud in rathole;
low cement volume;
low cement flow rate;
no cement evaluation log before temporary abandonment; and
temporary abandonment procedures that would severely underbalance the well and place greater stress than normal on the cement job.
Unfortunately, such an assessment was not conducted and critical operational decisions were made in a rash manner with the objective of saving time. We know the outcome – 11 lives lost, massive pollution, and enormous social costs
Despite making multiple changes over the last nine days before the blowout, the Macondo team did not formally analyze the risks that its temporary abandonment procedures created. The Macondo team never asked BP experts such as subsea wells team leader Merrick Kelley about the wisdom of setting a surface cement plug 3,000 feet below the mudline to accommodate setting the lockdown sleeve or displacing 8,300 feet of mud with seawater without first installing additional physical barriers. It never provided rig personnel a list of potential risks associated with the plan or instructions for mitigating those risks.
Almost every decision the Chief Counsel’s team identified as having potentially contributed to the blowout occurred during the execution phase.
Prior to April 20, 2010, 25,000 wells had been drilled in US Federal waters over the previous 25 years without a single well control fatality, an offshore safety record that was unprecedented in the U.S. and internationally. Well control was the keystone of every operator and drilling contractor’s safety program and the Minerals Management Service regulatory program, which included a pioneering well control research facility at LSU, standards, prescriptive rules, and comprehensive training requirements.
The future of the offshore program was bright. The Obama administration had included an Atlantic OCS lease sale in the 5-year OCS Oil and Gas Leasing Program for 2010-2015. This would have been the first Atlantic sale since 1983. I participated in a hearing held by a Florida Senate committee that was seriously considering oil and gas leasing in Florida State waters. Even in California, there was some support, led by a group known as Stop Oil Seeps, for new offshore exploration and production .
Everything changed on April 20, 2010, when BP’s Macondo well blew out. Eleven workers lost their lives, the most in a single US offshore incident since 1968, when 11 died in a fire and explosion at West Delta Block 23. In the history of the US offshore program, only a 1964 gas blowout (Eugene Island Block 273) caused more fatalities (22). (There were also tragic helicopter crashes in 1977 and 1984 at South Marsh Island Block 128 and Eugene Island Block 190 that killed 17 and 14 offshore workers respectively.) The Macondo blowout was more than a safety disaster, it was also a pollution spectacular that dominated the news for the next 3 months.
Pre-Macondo BP:
As is often the case with large organizations, the BP story is complex. BP said all the right things about safety and environmental protection, and seemed to mean them and practice them. They had comprehensive safety and risk management programs. They were at the vanguard in promoting personal safety among employees including the now common (and sometimes a bit contrived) practice of opening meetings with safety messages. All of that was no doubt consistent with their “beyond petroleum” rebranding (2002). However, the corporate image was badly tarnished by the 2005 Texas City refinery explosion that killed 15 workers and a 5000 barrel pipeline spill on the North Slope of Alaska in 2006.
BP’s deepwater Gulf of Mexico exploration programs had been very successful. BP produced more oil in the 2 years prior to the blowout than any other US offshore operator – 117 million barrels in 2008 and 188 million barrels in 2009. Their 2009 oil production total is still the highest in history for any US offshore operator (something I hadn’t realized until I checked the figures for this post.)
The compliance record for BP’s production facilities in 2008 and 2009 was “beyond” excellent. While BSEE does not publish the details needed to distinguish INCs by facility and operation, my recollection is that inspection of the thousands of components on their production platforms did not result in even a single incident of non-compliance (INC) in 2008, and there were no production safety or pollution incidents. BP was named a finalist for the MMS SAFE Award to be presented at OTC in May, 2009. However, pointing further to their corporate inconsistencies, BP’s drilling compliance record was not as good, and qualitative feedback from MMS inspection personnel indicated some safety and compliance issues. This input may have been a hint at the drilling program management issues that surfaced after the blowout. In light of these concerns about BP’s drilling operations, Devon Energy was presented the National SAFE Award in the “High Activity Operator” category.
I retired from MMS on 1/2/2010 and was thus not involved in the deliberations for the 2009 SAFE Awards. I understand that BP was the leading candidate to be presented the award in May 2010. However, the way the program worked was that finalists in each category were named in advance, but the winners were not announced until the awards luncheon. The reasons for this approach were to build suspense and avoid a situation where the winning company was involved in a significant incident prior to the presentation. This had never been an issue in the 30 year history of this awards program.
In light of the tragic events of April 20, the 2010 SAFE awards luncheon was cancelled, as it most definitely should have been. That said, I remain a strong believer in recognizing safety achievement. The MMS SAFE Awards were the only offshore safety awards determined by the safety regulator based on incident and compliance data and input from inspectors, the people who are most familiar with each company’s operations and the effectiveness of their safety programs. The awards program drew attention to best practices, information sharing, and safety leadership. The recipients and all staff that contributed to the company’s success were rightfully proud of their achievement. You could not nominate yourself or be nominated for SAFE awards; only the companies with the best safety and compliance records were considered. Past performance is never a guarantee of future success, but MMS SAFE Award winners earned the recognition they received and continued to be top performers.
Tomorrow: Macondo revisited, Part 3: The delayed cementing standard
This week I’ll be posting background information, new details, and personal opinions about the April 20, 2010 Macondo tragedy. As a prelude, I wanted to share this touching tribute to the 11 men who died on the Deepwater Horizon. These American heroes gave their lives exploring for energy to power our economy. The video is introduced by singer Trace Atkins, a former Gulf of Mexico rig worker.
Linked below is an excellent compliance and incident data update by Jason Mathews. COVID-19 statistics are included. Kudos to BSEE’s Gulf of Mexico Region for their timely and comprehensive reviews and safety alerts.The collection, analysis, and timely publication of incident data are critical to safety achievement and continuous improvement.
This useful SafeOCS report summarizes and itemizes well control equipment failures associated with well operations on the Gulf of Mexico OCS in 2020. Of particular note was the absence of any loss of containment (leak of wellbore fluids) events in 2020 or the prior two years.
Unfortunately, there appear to be significant reporting gaps despite the fact that reporting of these data is required by regulation (30 CFR 250.730(c)). The reporting issues are particularly serious for surface systems (surface BOP and associated equipment). Per SafeOCS, surface rig reports were received from less than 50% of active operators and rigs. Reporting for subsea systems (subsea BOP and associated equipment) was much better with 85% of the active rigs represented.
Of further concern with regard to the reporting of surface equipment events, the data indicate only 5.3 events per 1000 hours for surface systems vs. 71.5 for subsea systems. While subsea systems are more complex, the cost of pulling and repairing subsea equipment dictates newer, better maintained equipment. As a result, surface BOPs have historically had higher failure rates than subsea BOPs. The data below are from a presentation to MMS approximately 15 years ago. Both the Sintef and OOC data show higher failure rates for surface BOPs.
The SafeOCS team did a very good job of analyzing the reports and presenting the data. However, the reporting issues need to be investigated and resolved to get maximum value from this very important work.
Bud's Offshore Energy (BOE) 