“The companies involved in the Gulf of Mexico oil spill made decisions to cut costs and save time that contributed to the disaster”

National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling

Introduction

The Deepwater Horizon was a 9-year-old semi-submersible mobile offshore drilling unit, a massive floating, dynamically positioned drilling rig that could operate in waters up to 8,000 feet (2,400 m) deep and drill down to 30,000 feet (9,100 m). The rig was built by South Korean company Hyundai Heavy Industries. It was owned by Transocean, operated under the Marshallese flag of convenience, and was under lease to BP from March 2008 to September 2013. At the time of the explosion, it was drilling an exploratory well at a water depth of approximately 5,000 feet (1,500 m) in the Macondo Prospect, located in the Mississippi Canyon Block 252 of the Gulf of Mexico in the United States exclusive economic zone about 41 miles (66 km) off the Louisiana coast.
The production casing was being installed and cemented by Halliburton Energy Services. Once the cementing was complete, the well would have been tested for integrity and a cement plug set, after which no further activities would take place until the well was later activated as a subsea producer. At this point, Halliburton modelling systems were used to design the cement slurry mix and ascertain what other supports were needed in the well bore. BP is the operator and principal developer of the Macondo Prospect with a 65% share, while 25% is owned by Anadarko Petroleum Corporation, and 10% by MOEX Offshore 2007, a unit of Mitsui.

The Accident

At approximately 9:45 p.m. CDT on April 20, 2010, methane gas from the well, under high pressure, shot all the way up and out of the drill column, expanded onto the platform, and then ignited and exploded. Fire then engulfed the platform. Most of the workers escaped the rig by lifeboat and were subsequently evacuated by boat or airlifted by helicopter for medical treatment; however, eleven workers were never found despite a three-day Coast Guard search operation, and are presumed to have died in the explosion. Efforts by multiple ships to douse the flames were unsuccessful. After burning for approximately 36 hours, the Deepwater Horizon sank on the morning of April 22, 2010.

Volume and extent of oil spill

An oil leak was discovered on the afternoon of April 22 when a large oil slick began to spread at the former rig site. According to the Flow Rate Technical Group the leak amounted to about 4.9 million barrels (205.8 million gallons) of oil exceeding the 1989 Exxon Valdez oil spill as the largest ever to originate in U.S.-controlled waters. In their permit to drill the well, BP estimated the worst case flow at 162,000 barrels per day.. Immediately after the explosion BP and the United States Coast Guard did not estimate any oil leaking from the sunken rig or from the well. On April 24, Coast Guard Rear Admiral Mary Landry announced that a damaged wellhead was indeed leaking. She stated that “the leak was a new discovery but could have begun when the offshore platform sank …” two days after the initial explosion. Initial estimates by Coast Guard and BP officials, based on remotely operated vehicles as well as the oil slick size, indicated the leak was as much as 1,000 barrels per day. Outside scientists quickly produced higher estimates, which presaged later increases in official numbers. Official estimates increased from 1,000 to 5,000 barrels per day on April 29, to 12,000 to 19,000 barrels per day on May to 25,000 to 30,000 barrels per day on June 10, and to between 35,000 and 60,000 barrels per day, on June 15. Internal BP documents, released by Congress, estimated the flow could be as much as 100,000 barrels per day, if the blowout preventer and wellhead were removed from the modelling.

Investigations into the Root Cause

In August 2010 BP reported on an internal investigation of the accident and identified eight key findings. The eight key findings related to the causes of the accident emerged. These findings are briefly described below. Refer to Figure 2 for details of the well.

1. The annulus cement barrier did not isolate the hydrocarbons. The day before the accident, cement had been pumped down the production casing and up into the wellbore annulus to prevent hydrocarbons from entering the wellbore from the reservoir. The annulus cement that was placed across the main hydrocarbon zone was a light nitrified foam cement slurry. This annulus cement probably experienced nitrogen breakout and migration, allowing hydrocarbons to enter the wellbore annulus. The investigation team concluded that there were weaknesses in cement design and testing, quality assurance and risk assessment.
2. The shoe track barriers did not isolate the hydrocarbons. Having entered the wellbore annulus, hydrocarbons passed down the wellbore and entered the 9 7/8 in. x 7 in. production casing through the shoe track, installed in the bottom of the casing. Flow entered into the casing rather than the casing annulus. For this to happen, both barriers in the shoe track must have failed to prevent hydrocarbon entry into the production casing. The first barrier was the cement in the shoe track, and the second was the float collar, a device at the top of the shoe track designed to prevent fluid ingress into the casing. The investigation team concluded that hydrocarbon ingress was through the shoe track, rather than through a failure in the production casing itself or up the wellbore annulus and through the casing hanger seal assembly. The investigation team has identified potential failure modes that could explain how the shoe track cement and the float collar allowed hydrocarbon ingress into the production casing.
3. The negative-pressure test was accepted although well integrity had not been established. Prior to temporarily abandoning the well, a negative-pressure test was conducted to verify the integrity of the mechanical barriers (the shoe track, production casing and casing hanger seal assembly). The test involved replacing heavy drilling mud with lighter seawater to place the well in a controlled underbalanced condition. In retrospect, pressure readings and volume bled at the time of the negative-pressure test were indications of flow-path communication with the reservoir, signifying that the integrity of these barriers had not been achieved. The Transocean rig crew and BP well site leaders reached the incorrect view that the test was successful and that well integrity had been established.
4. Influx was not recognized until hydrocarbons were in the riser. With the negative-pressure test having been accepted, the well was returned to an overbalanced condition, preventing further influx into the wellbore. Later, as part of normal operations to temporarily abandon the well, heavy drilling mud was again replaced with seawater, underbalancing the well. Over time, this allowed hydrocarbons to flow up through the production casing and passed the BOP. Indications of influx with an increase in drill pipe pressure are discernable in real-time data from approximately 40 minutes before the rig crew took action to control the well. The rig crew’s first apparent well control actions occurred after hydrocarbons were rapidly flowing to the surface. The rig crew did not recognize the influx and did not act to control the well until hydrocarbons had passed through the BOP and into the riser.
5. Well control response actions failed to regain control of the well. The first well control actions were to close the BOP and diverter, routing the fluids exiting the riser to the Deepwater Horizon mud gas separator (MGS) system rather than to the overboard diverter line. If fluids had been diverted overboard, rather than to the MGS, there may have been more time to respond, and the consequences of the accident may have been reduced
6. Diversion to the mud gas separator resulted in gas venting onto the rig. Once diverted to the MGS, hydrocarbons were vented directly onto the rig through the 12 in. goosenecked vent exiting the MGS, and other flow-lines also directed gas onto the rig. This increased the potential for the gas to reach an ignition source. The design of the MGS system allowed diversion of the riser contents to the MGS vessel although the well was in a high flow condition. This overwhelmed the MGS system.
7. The fire and gas system did not prevent hydrocarbon ignition. Hydrocarbons migrated beyond areas on Deepwater Horizon that were electrically classified to areas where the potential for ignition was higher. The heating, ventilation and air conditioning system probably transferred a gas-rich mixture into the engine rooms, causing at least one engine to overspeed, creating a potential source of ignition.
8. The BOP emergency mode did not seal the well. Three methods for operating the BOP in the emergency mode were unsuccessful in sealing the well. The explosions and fire very likely disabled the emergency disconnect sequence, the primary emergency method available to the rig personnel, which was designed to seal the wellbore and disconnect the marine riser from the well. The condition of critical components in the yellow and blue control pods on the BOP very likely prevented activation of another emergency method of well control, the automatic mode function (AMF), which was designed to seal the well without rig personnel intervention upon loss of hydraulic pressure, electric power and communications from the rig to the BOP control pods. An examination of the BOP control pods following the accident revealed that there was a fault in a critical solenoid valve in the yellow control pod and that the blue control pod AMF batteries had insufficient charge; these faults likely existed at the time of the accident.

The team did not identify any single action or inaction that caused this accident. Rather, a complex and interlinked series of mechanical failures, human judgments, engineering design, operational implementation and team interfaces came together to allow the initiation and escalation of the accident. Multiple companies, work teams and circumstances were involved over time.

Other perspectives on the Accident

 

On November 8, the inquiry by the Oil Spill Commission revealed its findings that BP had not sacrificed safety in attempts to make money, but that some decisions had increased risks on the rig. However, the panel said a day later that there had been “a rush to completion” on the well, criticizing poor management decisions. “There was not a culture of safety on that rig,” co-chair Bill Reilly said. One of the decisions met with tough questions was that BP refuted the findings of advanced modelling software that had ascertained over three times as many centralizers were needed on the rig. It also decided not to rerun the software when it stuck with only six centralizers, and ignored or misread warnings from other key tests, the panel revealed.[30]

On November 16, an independent 15-member committee released a report stating BP and others, including federal regulators, ignored “near misses”. University of Michigan engineering practice professor and committee chairman Donald Winter that sealing the well continued “despite several indications of potential hazard”. For example, tests showed the cement was not strong enough to prevent oil and gas from escaping. Also, BP lost drilling materials in the hole. According to Donald Winter, the panel of investigators could not pin the explosion aboard the rig on a single decision made by BP, or anyone else, they found that the companies’ focus on speed over safety, given that the well was behind schedule costing BP $1.5 million a day-helped lead to the accident. As Donald Winter told the New York Times, “A large number of decisions were made that were highly questionable and potentially contributed to the blowout of the Macondo well… Virtually all were made in favour of approaches which were shorter in time and lower in cost. That gives us concern that there was not proper consideration of the tradeoffs between cost and schedule and risk and safety.” A document obtained by Greenwire, shows BP PLC, Halliburton Co. and Transocean Ltd. made a series of 11 unnecessary decisions that may have increased the chances of disaster. The document outlines 11 specific decisions that BP and its contractors made ahead of the disaster that may have increased risk on the rig. At least nine of the decisions saved time, the document shows, and the majority of the decisions were made by BP personnel on shore. These decisions were most likely made to try to save money since the well was significantly underperforming.

On December 8th Joe Keith, a senior Halliburton manager, admitted to the U.S. Coast Guard-Interior Department panel in Houston that he left his post aboard Transocean’s rig to smoke a cigarette on the night of the April disaster in the Gulf. While he was away from his monitors, charts entered into evidence showed that pressure data indicated the well was filling up with explosive natural gas and crude

Questions

 
Was the accident on the Deep Horizon Rig just bad luck or poor management?
To what extent were the risks associated with the project identified and managed?
What if any systematic root causes exist for the accident?
Could this happen in your organisation?