While the previously discussed planning, cementing, and well suspension issues allowed the well to flow, there were many other equipment, operational, and management deficiencies that elevated the incident to a disaster. Below are those that bother me the most:
Blowout Preventers
The Deepwater Horizon BOP stack had a single blind shear ram. Regardless of what the regulations allowed, you don’t drill a complex well like this without redundant shearing capability (and at the time of the blowout most deepwater drillers were using rigs with dual shear rams). All well control emergencies requiring the emergency disconnect sequence, deadman, and autoshear functions are dependent on effective shearing capability. You can have redundancy in every other BOP element, but without dual shear rams, you don’t have a redundant BOP system. Further, for full redundancy both shear rams should be capable of sealing the well bore after shearing. In that regard, the present regulations and the applicable standard (API S 53) require only one shear ram capable of sealing. They are thus deficient and should be updated.
The DWH BOP system did not have full bore shearing capability (available at the time) which may have sheared the deflected drill pipe.
The DWH BOP system was not properly maintained and recertified as required by regulation.
Transocean’s “condition based maintenance” was a euphenism for “fix it when it fails.” Perhaps worse, BP authorized the continuation of operations knowing that an annular preventer was leaking.
The initial flow from the well was directed to the mud-gas separator instead of being routed overboard via the diverter. Routing the flow to the diverter would have provided additional time for the crew to safely evacuate.
Gas detectors
Not all gas detectors were fully operational. As justification, Transocean’s report expressed concerns about alarm fatigue, a weak excuse. Alarm issues can be effectively managed without disabling the devices.
The gas detectors did not automatically shutdown the generators, the source of the initial explosion. This is somewhat understandable on a dynamically positioned rig that is dependent on power to maintain position. However, someone should have shut down the generators as soon as gas was detected.
Engine overspeed devices didn’t work, and apparently weren’t tested regularly. Had they worked, the engine room explosion may have been prevented.
The crew had time to activate the Emergency Disconnect Sequence, but did not.
Industry standards are critical to safety achievement. They represent best practices as determined by leading experts in the many disciplines that support oil and gas exploration and development. Another plus for standards is that, unlike regulations, they can be developed in a timely manner, particularly where there is an immediate need. However, industry mergers and streamlining have reduced the diversity of input, and some companies either do not participate or participate primarily to promote or protect their particular interest. The need for a consensus can also result in “lowest common denominator” outcomes that lack the necessary rigor.
Minerals Management Service (MMS) reviews indicated that cementing issues were the leading contributing factor to well control incidents between 1992 and 1996 (see chart below). On August 16, 2000, MMS challenged a new API cementing work group to improve zonal isolation, reduce the occurrence of sustained casing pressure, and prevent annular flow incidents before, during, and after cementing operations. Unfortunately, the standard was long delayed because of internal disagreements within the work group. Feedback indicated that some participants preferred a watered down, less rigorous version.
It is undisputed that the primary cement at Macondo failed to isolate hydrocarbons in the formation from the wellbore—that is, it did not accomplish zonal isolation. If the cement had set properly in its intended location, the cement would have prevented hydrocarbons from flowing out of the formation and into the well. The cement would have been a stand-alone barrier that would have prevented a blowout even in the absence of any other barriers (such as closed blowout preventer rams, drilling mud, and cement plugs).
API Standard 65-2, Isolating Potential Flow Zones During Well Construction, if completed in a timely manner and complied with would likely have prevented not only the Macondo disaster, but also the 2009 Montara blowout in Australia. (The Montara investigation hearings were covered extensively on this blog in 2010.) This important standard was ultimately finalized in a reactive manner after the Macondo well blew out.
Standard 65-2 focuses on the prevention of flow through or past barriers that are installed during well construction. A few key elements that are pertinent from a Macondo perspective:
Companies are required to perform a risk assessment prior to utilizing foamed cement and make sure that the results of this assessment are incorporated in the cementing plan. In setting the production casing on the Macondo well, foamed cement was used in an oil-based mud environment, destablizing the cement and contributing to the failure to isolate the highly productive oil reservoir.
The framework in Annex D of the standard does a good job of outlining the questions that should be asked in conducting a cementing risk assessment. These issues identified in the Chief Counsel’s report, which includes an outstanding review of the technical and management issues associated with the cementing/zonal isolation of the Macondo reservoirs, should have been addressed by BP and their contractors before initiating the well suspension program:
narrow pore pressure/fracture gradient;
use of nitrogen foamed cement;
use of long string casing design;
short shoe track;
limited number of centralizers;
uncertainty regarding float conversion;
limited pre-cementing mud circulation;
decision not to spot heavy mud in rathole;
low cement volume;
low cement flow rate;
no cement evaluation log before temporary abandonment; and
temporary abandonment procedures that would severely underbalance the well and place greater stress than normal on the cement job.
Unfortunately, such an assessment was not conducted and critical operational decisions were made in a rash manner with the objective of saving time. We know the outcome – 11 lives lost, massive pollution, and enormous social costs
Despite making multiple changes over the last nine days before the blowout, the Macondo team did not formally analyze the risks that its temporary abandonment procedures created. The Macondo team never asked BP experts such as subsea wells team leader Merrick Kelley about the wisdom of setting a surface cement plug 3,000 feet below the mudline to accommodate setting the lockdown sleeve or displacing 8,300 feet of mud with seawater without first installing additional physical barriers. It never provided rig personnel a list of potential risks associated with the plan or instructions for mitigating those risks.
Almost every decision the Chief Counsel’s team identified as having potentially contributed to the blowout occurred during the execution phase.
Prior to April 20, 2010, 25,000 wells had been drilled in US Federal waters over the previous 25 years without a single well control fatality, an offshore safety record that was unprecedented in the U.S. and internationally. Well control was the keystone of every operator and drilling contractor’s safety program and the Minerals Management Service regulatory program, which included a pioneering well control research facility at LSU, standards, prescriptive rules, and comprehensive training requirements.
The future of the offshore program was bright. The Obama administration had included an Atlantic OCS lease sale in the 5-year OCS Oil and Gas Leasing Program for 2010-2015. This would have been the first Atlantic sale since 1983. I participated in a hearing held by a Florida Senate committee that was seriously considering oil and gas leasing in Florida State waters. Even in California, there was some support, led by a group known as Stop Oil Seeps, for new offshore exploration and production .
Everything changed on April 20, 2010, when BP’s Macondo well blew out. Eleven workers lost their lives, the most in a single US offshore incident since 1968, when 11 died in a fire and explosion at West Delta Block 23. In the history of the US offshore program, only a 1964 gas blowout (Eugene Island Block 273) caused more fatalities (22). (There were also tragic helicopter crashes in 1977 and 1984 at South Marsh Island Block 128 and Eugene Island Block 190 that killed 17 and 14 offshore workers respectively.) The Macondo blowout was more than a safety disaster, it was also a pollution spectacular that dominated the news for the next 3 months.
Pre-Macondo BP:
As is often the case with large organizations, the BP story is complex. BP said all the right things about safety and environmental protection, and seemed to mean them and practice them. They had comprehensive safety and risk management programs. They were at the vanguard in promoting personal safety among employees including the now common (and sometimes a bit contrived) practice of opening meetings with safety messages. All of that was no doubt consistent with their “beyond petroleum” rebranding (2002). However, the corporate image was badly tarnished by the 2005 Texas City refinery explosion that killed 15 workers and a 5000 barrel pipeline spill on the North Slope of Alaska in 2006.
BP’s deepwater Gulf of Mexico exploration programs had been very successful. BP produced more oil in the 2 years prior to the blowout than any other US offshore operator – 117 million barrels in 2008 and 188 million barrels in 2009. Their 2009 oil production total is still the highest in history for any US offshore operator (something I hadn’t realized until I checked the figures for this post.)
The compliance record for BP’s production facilities in 2008 and 2009 was “beyond” excellent. While BSEE does not publish the details needed to distinguish INCs by facility and operation, my recollection is that inspection of the thousands of components on their production platforms did not result in even a single incident of non-compliance (INC) in 2008, and there were no production safety or pollution incidents. BP was named a finalist for the MMS SAFE Award to be presented at OTC in May, 2009. However, pointing further to their corporate inconsistencies, BP’s drilling compliance record was not as good, and qualitative feedback from MMS inspection personnel indicated some safety and compliance issues. This input may have been a hint at the drilling program management issues that surfaced after the blowout. In light of these concerns about BP’s drilling operations, Devon Energy was presented the National SAFE Award in the “High Activity Operator” category.
I retired from MMS on 1/2/2010 and was thus not involved in the deliberations for the 2009 SAFE Awards. I understand that BP was the leading candidate to be presented the award in May 2010. However, the way the program worked was that finalists in each category were named in advance, but the winners were not announced until the awards luncheon. The reasons for this approach were to build suspense and avoid a situation where the winning company was involved in a significant incident prior to the presentation. This had never been an issue in the 30 year history of this awards program.
In light of the tragic events of April 20, the 2010 SAFE awards luncheon was cancelled, as it most definitely should have been. That said, I remain a strong believer in recognizing safety achievement. The MMS SAFE Awards were the only offshore safety awards determined by the safety regulator based on incident and compliance data and input from inspectors, the people who are most familiar with each company’s operations and the effectiveness of their safety programs. The awards program drew attention to best practices, information sharing, and safety leadership. The recipients and all staff that contributed to the company’s success were rightfully proud of their achievement. You could not nominate yourself or be nominated for SAFE awards; only the companies with the best safety and compliance records were considered. Past performance is never a guarantee of future success, but MMS SAFE Award winners earned the recognition they received and continued to be top performers.
Tomorrow: Macondo revisited, Part 3: The delayed cementing standard
This week I’ll be posting background information, new details, and personal opinions about the April 20, 2010 Macondo tragedy. As a prelude, I wanted to share this touching tribute to the 11 men who died on the Deepwater Horizon. These American heroes gave their lives exploring for energy to power our economy. The video is introduced by singer Trace Atkins, a former Gulf of Mexico rig worker.
Linked below is an excellent compliance and incident data update by Jason Mathews. COVID-19 statistics are included. Kudos to BSEE’s Gulf of Mexico Region for their timely and comprehensive reviews and safety alerts.The collection, analysis, and timely publication of incident data are critical to safety achievement and continuous improvement.
This useful SafeOCS report summarizes and itemizes well control equipment failures associated with well operations on the Gulf of Mexico OCS in 2020. Of particular note was the absence of any loss of containment (leak of wellbore fluids) events in 2020 or the prior two years.
Unfortunately, there appear to be significant reporting gaps despite the fact that reporting of these data is required by regulation (30 CFR 250.730(c)). The reporting issues are particularly serious for surface systems (surface BOP and associated equipment). Per SafeOCS, surface rig reports were received from less than 50% of active operators and rigs. Reporting for subsea systems (subsea BOP and associated equipment) was much better with 85% of the active rigs represented.
Of further concern with regard to the reporting of surface equipment events, the data indicate only 5.3 events per 1000 hours for surface systems vs. 71.5 for subsea systems. While subsea systems are more complex, the cost of pulling and repairing subsea equipment dictates newer, better maintained equipment. As a result, surface BOPs have historically had higher failure rates than subsea BOPs. The data below are from a presentation to MMS approximately 15 years ago. Both the Sintef and OOC data show higher failure rates for surface BOPs.
The SafeOCS team did a very good job of analyzing the reports and presenting the data. However, the reporting issues need to be investigated and resolved to get maximum value from this very important work.
On January 28, 1969, well A-21, the 5th well to be drilled from Union Oil Company’s “A” platform began flowing uncontrollably through fractures into the Santa Barbara Channel.
The absence of any well casing to protect the permeable, fractured cap rock meant that the operator couldn’t safely shut-in a sudden influx of hydrocarbons into the well bore (i.e. a “kick”). Shutting-in the well at the surface would create well bore fractures through which oil and gas could migrate to shallow strata and the sea floor. The probability of an oil blowout was thus essentially the same as the probability of a kick (>10-2). Compare this with the historical US offshore oil blowout probability (<10-4) and the probability of <10-5 for wells with optimal barrier management.
Here, in brief, is the well A-21 story:
Well drilled to total depth of 3203′ below the ocean floor (BOF).
13 3/8″ casing had been set at 238′ BOF. The well was unprotected from the base of this casing string to total depth.
Evidence of natural seeps near the site suggested the presence of fracture channels
The well was drilled through permeable cap rock and a small high pressured gas reservoir before penetrating the target oil sands.
When the well reached total depth, the crew started pulling drill pipe out of hole to in preparation for well logging.
The first 5 stands of drill pipe pulled tight; the next 3 pulled free suggesting the swabbing of fluids into the well bore..
The well started flowing through the drill pipe. The crew attempted to stab an inside preventer into the drill pipe, but the well was blowing too hard. The crew then attempted unsuccessfully to stab the kelly into the drill pipe and halt the flow.
The crew dropped the drill pipe into the well bore and closed the blind ram to shut-in the well.
Boils of gas began to appear on the water surface. Oil flowed to the surface through numerous fracture channels. The sketch below by a former colleague depicts the fracturing, which greatly complicated mitigation of the flow.
We need to continue studying these historically important incidents, not just the technical details but also the human and organizational factors that allowed such safety and environmental disasters to occur. The idea is not to shame, but to remember and better understand.
While the official BOEMRE-USCG and National Commission/Chief Counsel investigation reports were quite good and there are countless court documents and ad hoc reviews of the blowout, some important Macondo issues have not been fully addressed. BOE will touch on these issues periodically starting with the decision to terminate the top kill operation on 5/28/2010.
The top kill operation (see diagram above) was intended to overcome and halt the flow of oil by pumping heavy mud into the well bore. The operation was not successful because the pumping rate and mud weight did not generate sufficient pressure. Per an excellent paper by Dr. Mayank Tyagi and colleagues at LSU (Analysis of Well Containment and Control Attempts in the Aftermath of the Deepwater Blowout in MC252):
It is very likely that if the top kill had been designed to deliver more than 109 bpm of 16.4 ppg drilling fluid below the BOP stack for a sustained period, the Macondo blowout could have been stopped between May 26-28, 2010. Given that the well was successfully shut-in with the capping stack in July, and that the subsequent bullhead (static) kill was successful, certainly a higher rate top kill would have been successful at that time.
The American Thinker, citing the New York Times, reports that Energy Secretary Chu stopped the top kill operation over the objections of some BP engineers. While it was reasonable to be concerned about possible casing leaks and the fracturing of subsurface formations, the subsequent (7/15/2010) closure of the capping stack demonstrated that the well had sufficient integrity to support the top kill operation. Questions regarding why a higher rate top kill effort was not attempted and how that decision was made are therefore important and merit discussion. Did the Macondo well flow unnecessarily into the Gulf for an additional 48 days (5/28-7/15)? Did the National Incident Command facilitate or delay source control?
Keep in mind that the NIC almost made a similar mistake in July. Even after the capping stack successfully shut-in the well on 7/15, Incident Commander Thad Allen (USCG) continued to call the closure of the capping stack a temporary test and threatened to require BP to resume flow from the well. Fortunately, informed input from experienced engineers prevailed. The well remained shut-in and the static well-kill operation was successful.
Continuous improvement has to be the primary objective of offshore safety leaders, and this independent blog is committed to recognizing initiatives that further reduce safety and environmental risks. Australia’s collaborative mental survey project is an interesting such initiative in its early stages. Two other important initiatives are noted below.
BSEE’s Dropped Object Risk-Based Inspection initiative: As has been the case for 50 years, most offshore fatalities and serious injuries are associated with falls or falling and moving objects/equipment. BSEE’s Dropped Objects initiative, as described in a presentation by Jason Mathews during a recent Center for Offshore Safety (COS) webinar is intended to draw further attention to and better manage these risks. In addition to BSEE’s focused inspections, the “Good Practices” being followed by some operators and contractors, as described on pages 40-50 of the presentation, are encouraging. These types of initiatives are necessary if we are to achieve the elusive “zero fatality” year on the US OCS.
IOGP process safety guidance, Report 456 v.2 : Contrary to some post-Macondo narratives, process safety and well control were always the primary focus of the US OCS regulatory program. In 1974, my boss Richard Krahl (known as “Mr. OCS” for his commitment to offshore safety) dropped a copy of the first edition of API RP 14C (Analysis, Design, Installation, and Testing of Safety Systems for Offshore Production Facilities) on my desk and told me it was an excellent document that I should read. RP 14 C and other process safety standards were incorporated into the USGS OCS Orders (regulations) in the 1970’s. For decades, the USGS and MMS were leaders in well control and production safety research and training. That said, better indicators and improved approaches to offshore facility process safety were needed, and the International Association of Oil and Gas Producers report has provided an excellent framework. Report 456 is comprehensive and technically sound, and provides excellent guidance and examples. Very well done!
Bud's Offshore Energy (BOE) 