Never one to pull his punches, consultant Ian Fitzsimmons applauds the openness of January's National Commission report to President Obama on the Macondo well disaster, but reprimands the UK Health & Safety Executive over its handling of the 'eerily similar' North Sea incident that occurred in the North Sea four months earlier but took eight months to enter the public domain.
The publication of the National Commission report into the Macondo disaster has taken us one step closer to the final chapter of this sorry tale. It has been well received and the commission are to be congratulated for producing an excellent document, which will stand the test of time.
The report is divided into three parts, the first dealing with 'Path to Tragedy', the second the 'Explosion and Aftermath' and the third with 'Lessons Learned'.
Apart from the causes and consequences of the disaster, the report deals with the environmental and regulatory issues arising from the disaster. And the final chapter of Part III deals with American energy policy and the future of offshore drilling. I recommend that everyone involved in the offshore (and onshore) oil and gas industry reads the report. It is some 368 pages long, and you may want to have a glass of wine to hand.
It has to be said at the outset that this report reveals little about the Deepwater Horizon BOP, now languishing somewhere in an American state. That autopsy report has still to be delivered. It may take a very long time while various agencies in America argue over its custody. It may well require the president to intervene and remind them that the families of 11 dead men are waiting for the truth.
The commission's report, the first independent account of the disaster, is a vast improvement on the previous offering from BP (OE November 2010). Of course, being independent means you do not have to worry about your mortgage and your career, and any legal consequences!
The commission also had the advantage that it received written accounts from all the survivors of the disaster, and all the participating contractors. Most importantly, it was able to interview and receive testimony from both offshore and onshore personnel, thereby providing substantially more background information than the BP accident investigation report.
As it turns out, it was onshore personnel who probably contributed most to the fundamental causes of this disaster.
Preamble
This piece summarises the events, causes and consequences of the disaster, and the lessons to be learned from it. Part II Chapter 4 pp89-127 is the reference document for this review of the Macondo disaster.
I was impressed by the compassionate and measured style of the report. It is neither vengeful nor angry, but it is direct and it is pointed. It names all the key personnel involved in this tragedy, the offshore dead, the survivors, and the onshore personnel who called the shots.
The report does not shy away from recalling and describing earlier BP disasters - namely the Texas City refinery fire and the Alaska pipeline rupture - and the Thunder Horse neardisaster. Had the commission delved deeper and longer, they would also have discovered the BP Sea Gem jackup disaster in the UK Southern North Sea, which occurred on 27 December 1965. Thirteen men were killed. A subsequent public enquiry held BP culpable for systemic management failures. It all sounds depressingly familiar.
The commission report (p124) also references a North Sea incident in which a near-catastrophic blowout was narrowly avoided on 23 December 2009, some four months prior to the Macondo blowout. It is relevant to Macondo and worth recounting here.
The Transocean-operated semi Sedco 711, working on the development of Shell/Bardolino oil field, suffered an 'eerily similar near miss' (in the report's words) when gas entered the riser on the rig while the crew was displacing a well with seawater during a completion operation.
'As at Macondo, the rig crew had already run a negative pressure test on the lone physical barrier between the pay zone and the rig, and had declared the test a success. The tested barrier nevertheless failed during displacement, resulting in an influx of hydrocarbons. Mud spewed onto the rig floor - but fortunately the crew was able to shut in the well before a blowout occurred.'
One of the more curious aspects of this incident is that it took so long - something like eight months - to first enter the public domain. The report about the near miss was in the hands of the UK authorities, but it was held as 'confidential' and never released to the public. Subsequent Transocean advisory notes did not reach the Deepwater Horizon crew.
According to the Presidential Commission report:
'Had the [Deepwater Horizon] rig crew been adequately informed of the prior event and trained on its lessons, events at Macondo may have unfolded very differently.' (p125)
Was BP aware of any of the foregoing? If it was, it made no mention in its initial report. If it did not, what does that say about Transocean?
And questions that must surely attach to the UK Health & Safety Executive's handling of this matter are raised in the companion piece to this article ('Sedco 711 - the regulatory issues', page 39).
The road to disaster
Macondo had been a difficult exploration well to drill. Initially planned to be 20,200ft deep, it was curtailed at 18,360ft due to a lost circulation event, which was eventually stabilised. On 10 April 2010, BP informed its JV partners that 'well integrity and safety issues required the rig to stop drilling further'. As a result:
'Transocean were able to spend the next five days between April 11 and 15 logging the open hole. Based on the logging data, BP concluded that it was economically worthwhile to install a final production casing string that BP would eventually use to recover oil and gas.' Page94
The onshore BP design team had originally planned to use a long string production casing - a single conduit (7in x 9 5/8in) hung from and locked down against the subsea wellhead. The shoe track would be cemented in place, as would the bottom 7in wellbore annulus.
On 14/15 April BP and Halliburton analysed and reviewed the proposed cementing process. They came to the conclusion that the long string could not be cemented reliably. Accordingly, the BP onshore design team switched to a liner approach. The liner configuration would have taken longer to install, but would have been far less risky, incorporating bridging plugs and casing packers in addition to top cement plugs.
However, following an internal review and recommendation by a 'BP in-house cementing expert', the BP design team reverted to the use of the long string method.
Halliburton then pointed out that the BP long string design called for at least 16 centralisers, whereas only six were available from stock. Much discussion and analyses ensued, but eventually the BP onshore view prevailed and only six centralisers were used.
Early on Sunday 18 April, the rig crew began lowering the long string production casing into the well. The leading end of the casing, or shoe track, began with a reamer shoe, which is designed to guide the long string through the wellbore.
The reamer shoe was followed by about 180ft of 7in casing. Above this was a float collar with two spring loaded flapper type check (float) valves, both of which were held open by an open-ended 'auto-fill tube'. The mud in the wellbore flowed through the open ported reamer and the auto-fill tube as the long string was lowered.
The long string installation in the well was completed the afternoon (13.30) of Monday 19 April. It had taken 37 hours to install.
It had been landed in the subsea wellhead, but the 9 5/8in casing hanger lock-down/seal assembly was not activated. The casing hanger seal was in place, held down by gravity and nothing else. This was not an accidental choice - it was premeditated.
In preparation for cementing, the auto-fill tube must be displaced so as to enable the flapper valves to close. They are then converted to their original role, which is to allow the passage of mud and cement from above and to prevent the ingress/backflow of cement and well fluid into the long string production casing.
In order to convert the valves, mud is pumped down and through the tube to displace it into the shoe track. The predicted rate of flow to achieve this was 6bpm with a differential hydraulic pressure of 600psi. In fact it took 3142psi to dislodge the tube.
'Significantly, however, the pump rate of mud into the well and through the shoe track thereafter never exceeded 4bpm, approximately.'
'BP concluded that the float valves had converted, but noted another anomaly. The drilling mud contractor had predicted that it would take a pressure of 570psi to circulate mud after converting the valves. Instead, the rig crew reported that circulation pressure was much lower: only 340psi.'
In spite of these anomalies, BP believed that both valves had converted and re-established mud circulation in the well.
By 19.30 on Monday 19 April, the production casing test was declared successful, and the rig crew were ready to begin the cementing process, which started immediately.
Tuesday 20 April
Transocean and Halliburton finished pumping the primary cement job at 00.36. BP and Halliburton performed a flowback test at the mud pump.
'While it is not clear how long the two men actually watched for potential flow, they eventually concluded the flapper valves were holding.'
Readers will note that the tone of this quotation suggests the commission were not entirely satisfied with either the results or the observations made in respect of this test.
However, with the cement job declared a success, BP and the Deepwater Horizon crew began to plan the final phase of its work - temporary abandonment of the well.
At 10.43, the BP well site leaders received an email from BP onshore personnel listing the temporary abandonment procedures for the well. It was the first time the BP well site leaders on the rig had seen the procedures they would use that day. BP shared the procedures with the rig crew at the 11.00 (same day) pre-tour meeting. According to page 104 of the commission's report, the basic sequence was as follows:
It is obvious that BP onshore had made numerous changes to the original 12 April temporary abandonment procedures in the two weeks leading up to the Tuesday 20 April email. For example, the 12 April plan had set out the following:
According to the commission:
'There is no evidence that these [20 April] changes went through any sort of formal risk assessment or management of change procedures.'
Thus the countdown to disaster had begun with the initiation of an anomalous cement job, followed by the flawed 20 April temporary abandonment procedure, which initiated the negative pressure test.
41 minutes
We know now, and BP and Halliburton knew then, that the cement used for Macondo was neither safe nor qualified for the purpose. In fact BP had been advised by Halliburton on 8 March of the results of a single stability test, which confirmed the point.
'To the trained eye, that test showed that the February foam slurry design was unstable . . . and there is no evidence that BP examined the foam stability data in the report at all.' (p101)
Nevertheless, in accordance with the instructed temporary suspension procedure, the positive pressure test began around noon. The well was pressurised up to 250psi for five minutes, and then pressured up to 2500psi (on the rig) for 30 minutes. The pressure inside the well remained steady throughout. BP and the drilling crew considered the test successful at 12.00, and the rig crew began preparations for the negative pressure test.
The crew ran the drill pipe down to about 8367ft below sea level and then pumped a 'spacer' - a viscous liquid that separates heavy drilling mud from seawater - followed by seawater down the drill pipe to displace 3300ft of mud below the mudline to above the BOP as per the report's Figure 4.6.
To conduct a proper negative test at Macondo, BP also had to isolate the well from the effect of the 5000ft column of drilling mud in the LP drilling riser.
'Those heavy columns of mud exerted much more pressure on the well than the seawater that would replace them after temporary abandonment. Specifically, the pressure at the bottom of the well would be approximately 2350psi lower after temporary abandonment than before.' (p106)
In short, the well would be massively underbalanced and would require intense observation, appropriate to the risk that BP and the rig crew were about to instigate.
Once the crew had displaced the mud top just above the BOP, they closed an annular preventer, thus isolating the well from the heavy mud in the LP drilling riser (the annular preventer had closed around the drill pipe).
The crew could now perform the negative pressure test using the drill pipe. It was 16.54.
The first step was to bleed off pressure at the top of the drill pipe (at the Deepwater Horizon drill floor).
If the well was stable, the pressure at the top of the drill pipe would reduce to zero. But that was not the case. It was 1261psi. Repeated attempts to bleed off the pressure failed. When the isolation valve at the top of the drill pipe was closed, the pressure jumped back to 1262psi.
The time was about 18.00 and the nightmare that was to become Macondo began to unfold.
The crew noticed that the fluid level in the LP drilling riser had fallen. The annular preventer was re-pressurised, and the riser refilled. The crew then repeated the negative pressure test three times. And each time the drill pipe shut-in pressure increased to 1400psi.
A successful negative pressure test would require the shut-in pressure to be zero.
After discussion between BP and the rig crew, BP insisted on running another negative pressure test. This time the drill pipe would be shut-in and the test performed on the BOP kill line. The pressure on the kill line should be identical to pressure on the drill pipe as both flow to the well. Figure 4.7 illustrates the arrangement.
'For the second test, the crew opened the kill line and bled the pressure down to 0psi. A small amount of fluid flowed, and then stopped.' (p108)
In fact, according to the rig crew, the kill line was still flowing, albeit at a 'pencil rate' when it was shut-in at 19.55.
But the pressure at the head of the drillpipe remained at 1400psi throughout the test. This reading could only have been caused by an active leak into the well.
'Nevertheless, at 8.00pm, BP Well Site Leaders . . . made a key error and mistakenly concluded the second negative test procedure had confirmed the well's integrity.' (p109)
This horrendous decision accelerated the end. Having declared the negative test a success, BP moved forward to the next stage of abandonment as prescribed by the flawed temporary abandonment procedure.
At 20.02 the rig crew opened the BOP annular preventer and began displacing mud (above the BOP) from the LP riser.
'The driller repeatedly rerouted the mud returns from one pit to another in order to accommodate the incoming volume . . . it is not clear whether the driller, assistant drillers, or mudlogger could adequately monitor active pit volumes (or flow in versus flow out) during that time given all the activity.'
In short, how could the rig crew tell when all the mud above the BOP had been displaced?
At approximately 21.01, drill pipe pressure began rising. The effect of mud displacement with seawater was initially to reduce the pressure at the head of the drill pipe. Now it crept upward from 1250psi to 1350psi.
'Had someone noticed, he would have to explain to himself how the drill pipe pressure could be increasing while pump rate was not. One possible reason might have been that hydrocarbons were flowing up the well and pushing heavy mud up past the drill pipe.' (p111)
The injection pumps were shut down between 21.08 and 21.14 to perform a sheen test on the returns. During that time the drill pipe pressure should have remained constant. Instead it is recorded that it went up by 250psi - and nobody noticed.
Pumping recommenced.
'Shortly before 9.30pm, the driller noticed an odd and unexpected pressure difference between the drill pipe and the kill line. At roughly 9.30pm the crew shut off the pumps to investigate. The drill pipe pressure decreased after the pumps were turned off, but then increased by 550psi over a 5.5-minute period. Meanwhile the pressure on the kill line remained significantly lower.' (p112)
Despite the mounting evidence of a kick, the driller never attempted to shut in the well.
Sometime between 21.40 and 21.43, drilling mud spewed over the rotary onto the drill floor. The crew took immediate action and routed the flow from the LP riser through the diverter system and overboard, before deciding to send it back through the mud-gas separator. Then they tried to close the annular preventer around the drill pipe to stem the flow.
'Their efforts were futile. By the time the rig crew acted, gas was already above the BOP, rocketing up the riser and expanding rapidly . . . a representative from Transocean likened it to 550 ton freight train hitting the rig floor.' (p114)
The mud-gas separator was quickly overwhelmed, ignition and explosion were inevitable.
Forty-one minutes had elapsed between the time when pressure was observed to be rising in the drill pipe during displacement of mud with seawater in the LP riser, and the time when mud spewed over the rotary onto the drill floor.
No attempt was made to shut-in the well during those minutes. In fact the well should have been shut-in earlier at 20.00 as a result of the anomalous 1400psi shut-in pressure in the drill pipe discovered during the negative pressure test.
This staggering anomaly could only have been explained by the fact that hydrocarbons had already entered the well. They must have entered the well before 16.54 when the first anomalous pressure reading was discovered in the drill pipe at the start of the negative pressure test.
The first explosion occurred around 21.50, followed by another some ten seconds later. In the late evening of 20 April 2010, eleven men lost their lives, and it was all avoidable.
Two days later, at 10.22 on Thursday 22 April, the Deepwater Horizon sank.
Management of risk
The commission searched for the root causes of this disaster. It was not a difficult task. Page 122 of the report states:
'The most significant failure at Macondo - and the clear root cause of the blowout - was a failure of industry management. Most, if not all, of the failures at Macondo can be traced back to underlying failures of management and communication. Better management of decision making processes within BP and other companies, better communication within and between BP and its contractors, and effective training of key engineering and rig personnel would have prevented the Macondo incident.'
Few would disagree with that conclusion.
The commission also highlighted a failure of risk management.
'BP did not have adequate controls in place to ensure that key decisions in the months leading up to the blowout were safe or sound from an engineering perspective. While initial well design decisions undergo a serious peer-review process, and changes to well design are subsequently subject to a management of change process, changes to drilling procedures in the weeks and days before implementation are typically not subject to any such peerreview process.
'At Macondo, such decisions appear to have been made by the BP Macondo team in an ad hoc fashion without any formal risk analysis or internal review. This appears to have been a key causal factor of the blowout.' (p123)
The following examples will illustrate the point. Readers should bear in mind that BP curtailed the Macondo well short of its target depth because 'well integrity and safety issues required the rig to stop drilling further'.
Cement
The selection of nitrogen foam cement for Macondo went unchallenged. BP has little experience with foam technology for cementing production casing in the Gulf of Mexico and there is no evidence that this type of cement was even qualified for Macondo.
The record confirms that a round of tests was performed in mid-April 2010, just before pumping the final cement job. Halliburton began a second test on 18 April. That would normally take 48 hours, which takes us to 20 April, the day of the blowout. Had a risk analysis been correctly performed, it is obvious that this particular type of cement would never have been selected for Macondo. It represented a major technical and schedule risk.
Temporary abandonment procedure
The temporary abandonment procedure was sent to the Deepwater Horizon on 20 April and received at 10.43. There is no evidence that the changes from the original 12 April plan went through any sort of formal risk assessment or management of change process. The biggest risk concerned the addition of the negative pressure test without any risk assessment, and without any risked negative test procedure.
'The most troublesome aspect of BP's temporary abandonment procedure was their decision to displace mud from the riser before setting the surface cement plug or other barrier in the production casing.'
BP could have set the surface plug or a mechanical plug before displacing the riser. BP could have over-balanced the well with heavier mud. It is not apparent why the company chose not to do any of these things. The lack of any formal risk assessment was a colossal mistake.
Furthermore the decision to displace mud 8367ft below the drill floor, rather than the original 6000ft proposed, required explanation and risk assessment having due regard to the previous concerns about well stability. This new procedure was fundamentally flawed and was a root cause of the blowout.
Nevertheless it was implemented at 12.00, just 77 minutes after its arrival offshore, and without any obvious review by BP and the rig crew.
The following risk assessments should also have been executed by BP:
The first few points should have been assessed for risk as part of the original well design process. Point three, long string configuration vs liner, should have been revisited in light of the results found during well execution.
All the remaining points constituted good reason to shut-in the well in favour of risk assessment reviews, until suitable procedures and alternative remedial options (if so required) could be put in place.
It is very obvious that decisions being made on the hoof - both onshore and offshore - and without due consideration led to the disaster we regret today. It could have been avoided with just a little thought and common sense.
Cost considerations
The commission does not say the Macondo disaster was the result of cost cutting, but it has produced a simple analysis, Figure 4.10, to demonstrate where risk could have been increased at Macondo while potentially saving time.
According to the commission, as of 20 April 2010, BP and the Macondo well were almost six weeks behind schedule and more than $58 million over budget. I do not find that fact surprising in the least. I have never heard of a well that came in on schedule and within budget, and I think most operators would agree.
It would be puerile to suggest that cost and schedule are not background considerations. They are always there, but mainly during the desktop project development phase of any project. It is for that reason that risk assessments are required to demonstrate that cost optimisation and potential saving do not incur an unacceptable level of risk to either the asset or project personnel.
In its report, the commission stated that:
'There is nothing inherently wrong with choosing a less costly or less time consuming alternative - as long as it is safe. Whether purposeful or not, many of the decisions that BP, Halliburton and Transocean made, that increased the risk of the Macondo blowout, clearly saved those companies significant time and money.'
The foregoing follows on from the commission's complaint about the lack of risk assessment evident in the planning and execution of the Macondo well.
I have identified one such example, which does not appear in Figure 4.10 - the use of flapper valves in the shoe float collar, and their dependence on an auto-fill-tube to effect their conversion to more usual one way check valves. It occurs to me that this configuration and procedure contains a considerable and unacceptable risk. If the float collar fails to convert, then the only way to recover and rectify the situation is to mill it out. This would have required a long return trip from the Deepwater Horizon lasting many days.
It would have been possible not to use float collar flappers after that - it would have required the installation of a more dependable, wireline-set check valve in the production casing installation. However, this option would also have involved a long return trip from Deepwater Horizon.
Tripping in 5000ft of water is expensive. It is a common frustration among those with experience of deepwater projects. The use of an integral float collar saved BP a considerable expense and rig time. The commission complains that a risk assessment should have been conducted to demonstrate if the float collar was a valid option when compared with the other available solutions.
I suggest that, given the anomalous pressures that were required to effect the conversion, and the subsequent blowout, float collar conversion did not work and neither did the flappers. This failure was then compounded by the BP decision to proceed with the cement job, regardless.
The correct decision would have been to shut-in the well and conduct a risk assessment of the recovery options then available, before proceeding further with execution of the cement job.
Hopefully a risk assessment of the float collar configuration during the planning phase would have precluded their inclusion in the first place, in favour of a more risk free and dependable alternative, albeit at a greater cost.
However, I do not believe cost considerations were a real driver in this disaster. I believe that, for the most part, it was due to carelessness born of frustration and weariness among the rig crew and BP, both offshore and onshore.
Paradigms
I have noticed and identified during the reading of both the initial BP report and the commission report, several well established paradigms which drive to the heart of this disaster. They were discussed in the first of my Macondo pieces with reference to the Titanic, Comet, and NASA space shuttle failures (OE July 2010) and have all been repeated in the Macondo disaster.
Disbelief in humans is a common paradigm. It arises when we refuse to acknowledge the evidence of our eyes and common sense in face of the obvious (but unacceptable) truth staring us in the face.
Pilots are trained at the outset of their careers to rely on their instruments, not their heart. It is a discipline that can itself still cause disasters, but that is a minute risk compared with the alternative.
Nobody believed that a simple O-ring could have caused the Challenger shuttle disaster, and nobody believed that a piece of foam insulation could have caused the Columbia shuttle disaster. So great was the disbelief, qualification tests were instructed to dispel the suggestions as nonsense. The opposite proved to be the case.
There were four events during the execution of the Macondo well that beggar belief:
They chose to ignore the obvious and carried on. Some 41 minutes later, mud spewed through the rotary onto the drill floor. It was now 21.42 and the hydrocarbons had been in the well before 18.00, sending out signals that they refused to believe. Not once had they considered controlling the well.
Bewildered by events, they routed the mud flow through the diverter. Then they re-routed back through the mud-gas separator (MGS), which was quickly overwhelmed by gas. The first explosion occurred at 21.50.
The crew should have retained the diverters to send the mud and gas overboard. The diverter had been their last chance to save themselves and the Deepwater Horizon. At the very least it would have given them some time to escape. But they believed the MGS was the correct way to control hydrocarbons. They had been in a state of disbelief since 18.00.
On page 119 of its report, the commission states:
'. . . the Transocean crew should have been particularly sensitive to anomalous pressure readings and ready to accept that the primary cement job could have failed. It appears instead they started from the assumption that the well could not be flowing, and kept running tests and coming up with various explanations until they had convinced themselves their assumption was correct'.
We can see in this quote that the paradigm of design infallibility can also be heard echoing from the Titanic and Comet disasters.
Blowout preventer
The Deepwater Horizon BOP was recovered in September and taken into custody for an autopsy. The results are still awaited and until we have this missing piece of the jigsaw the Macondo well disaster's final chapter cannot be written.
But we can say that this magnificent bulwark was largely ignored throughout the disaster. The annular preventer seems to have been the workhorse for most of the time.
We do not know why the driller did not immediately activate the BOP blind shear rams at 21.42 (mud overflows the rotary). Perhaps he did and they failed. We have to assume that the drill pipe joints had been correctly spaced out through the BOP stack.
A witness account suggests that a member of the crew activated one of the annular preventers around this time. Pressure readings suggest that the crew activated a variable bore ram around the drill pipe at 21.46. But the blowout flow rates probably prevented their closure.
After the explosion, crew members tried to activate the riser emergency disconnect system (EDS), presumably out of sheer desperation. The EDS should have closed the shear rams and severed the drill pipe, and released the riser from the rig. But nothing happened. We can reasonably assume that all communications with the BOP and LMRP had been lost.
Notwithstanding the foregoing, the BOP does have a fail-safe activation system - 'Deadman' - that should have been automatically activated after communication with the rig had been lost. It failed, but we have to wait for the autopsy for confirmation.
Conclusion
This horrific disaster could and should have been avoided, notwithstanding the fact that this had been a difficult exploration well to drill. The commission report will change the global oil and gas industry forever. It has addressed regulatory and environmental failings, and has reminded us that risk assessment and management are obligatory in the planning and execution of wells of all types.
The commission considers the root causes of the blowout were a systemic failure of industry management and a failure of government to provide effective regulatory oversight of offshore drilling (page 122). Few would argue with that.
The following commission quote comes from the same page:
'Finally, and perhaps most importantly, the rig crew had not been trained adequately how to respond to such an emergency situation. In future, well control training should include simulations and drills for such emergencies - including the momentous decision to engage the blind shear rams or trigger the EDS.'
While I endorse the foregoing without reservation, I close this piece with a simple if not banal reminder that we are all human, and to err is human. But within reason.
The Macondo wounds will heal eventually, as did those of the Piper Alpha and Sea Gem tragedies.
But it is such a pity we always have to learn things the hard way, and with such loss of human life. It is a paradigm the industry should strive to be rid of. OE
About the Author
Ian Fitzsimmons, a regular contributor to OE, is an independent consultant with more than 30 years' offshore industry experience. He has worked for major operators around the world and major subsea hardware/ drilling equipment contractors, and has extensive due diligence and expert witness experience. He was chief engineer for RJ Brown & Associates in London. The views expressed in this article are the author's own and do not necessarily reflect OE's position.
Subscribe
