INDUSTRIAL ACCIDENTS

DESCRIPTION OF FACILITY

Deepwater Horizon was a fifth generation, dynamically-positioned semi-submersible drilling unit built in 2001. The unit employed an automated drilling system and a 15,000 psi-rated BOP system and had operated in water depths (WD) greater than 9,000 ft. The rig had drilled wells up to 35,055 ft in the nine years it had been owned and operated by Transocean under contract to BP in the deepwater Gulf of Mexico.

The Macondo well was an exploration well in Mississippi Canyon Block: 252 in 4,992 ft WO. The well had been drilled to 18,360 ft from its last casing Point at 17,168 ft. The well penetrated a hydrocarbon-bearing Miocene reservoir and was deemed a commercial discovery. The decision was made to temporarily abandon the Macondo well and complete it as a production well in the future.

At the time of the accident, the final string of casing had been run into the well, and the cement barrier had been put in place to isolate the hydrocarbon zones. Integrity tests had been conducted, and the top 8,367 ft of mud was being circulated out using seawater in preparation for temporary abandonment of the well. The remaining steps were to set a cement plug in the casing and to install a lockdown sleeve on the casing hanger seal assembly prior to disconnecting the BOP and suspending the well.

ACCIDENT DESCRIPTION

On the evening of the 20^th of April 2010, a well control event allowed hydrocarbons to escape from the Macondo well onto Transocean's Deepwater Horizon, resulting in explosions and fire on the rig. Eleven people lost their lives and 17 others were injured. The fire, which was fed by hydrocarbons from the well, continued for 36 hours until the rig sank. Hydrocarbons continued to flow from the reservoir through the wellbore and the blowout preventer (BOP) for 87 days, causing a spill of national significance.

The internal investigation carried out by BP concluded that the accident involved a well integrity failure, followed by a loss of hydrostatic control of the well. This was followed by a failure to control the flow from the well with the BOP equipment, which allowed the release and subsequent ignition of hydrocarbons Ultimately, the BOP emergency functions failed to seal the well after the initial explosions. Eight key findings regarding the cause of the accident emerged from the investigation and these are as follows:

• The annulus cement barrier did not isolate the hydrocarbons
  The day before the accident, cement had been pumped down the production casing and up into the wellbore annulus to prevent hydrocarbons from entering the well bore from the reservoir. The annulus cement that was placed across the main hydrocarbon zone was a light, nitrified foam cement slurry. This annulus cement probably experienced nitrogen breakout and migration, allowing hydrocarbons to enter the wellbore annulus. The investigation team concluded that there were weaknesses in cement design and testing, quality assurance and risk assessment.
• The shoe track barriers did not isolate the hydrocarbons
  Having entered the wellbore annulus, hydrocarbons passed down the wellbore and entered the 9 7/8 in x 7 in production casing through the shoe track, installed in the bottom of the casing. Flow entered into the casing rather than the casing annulus. For this to happen, both barriers in the shoe track must have failed to prevent hydrocarbon entry into the production casing. The first barrier was the cement in the shoe track, and the second was the float collar, a device at the top of the shoe track designed to prevent fluid ingress into the casing. The investigation team concluded that hydrocarbon ingress was through the shoe track, rather than through a failure in the production casing itself or up the wellbore annulus and through the casing hanger seal assembly The investigation team has identified potential failure modes that could explain how the shoe track cement and the float collar allowed hydrocarbon ingress into the production casing.
• The negative-pressure test was accepted although well integrity had not been established
  Prior to temporarily abandoning the well, a negative-pressure test was conducted to verify the integrity of the mechanical barriers (the shoe track, production casing and casing hanger seal assembly). The test involved replacing heavy drilling mud with lighter seawater to place the well in a controlled underbalanced condition. In retrospect, pressure readings and volume bled at the time of the negative-pressure test were indications of flow-path communication with the reservoir, signifying that the integrity of these barriers had not been achieved. The Transocean rig crew and BP well site leaders reached the incorrect view that the test was successful and that well integrity had been established.
• Influx was not recognized until hydrocarbons were in the riser
  With the negative-pressure test having been accepted, the well was returned to an overbalanced condition, preventing further influx into the wellbore. Later, as part of normal operations to temporarily abandon the well, heavy drilling mud was again replaced with seawater, under-balancing the well. Over time, this allowed hydrocarbons to flow up through the production casing and passed the BOP. Indications of influx with an increase in drill pipe pressure are discernable in real-time data from approximately 40 minutes before the rig crew took action to control the well. The rig crew's first apparent well control actions occurred after hydrocarbons were rapidly flowing to the surface. The rig crew did not recognize the influx and did not act to control the well until hydrocarbons had passed through the BOP and into the riser.
• Well control response actions failed to regain control of the well
  The first well control actions were to close the BOP and diverter, routing the fluids exiting the riser to the Deepwater Horizon mud gas separator (MGS) system rather than to the overboard diverter line. If fluids had been diverted overboard, rather than to the MGS, there may have been more time to respond, and the consequences of the accident may have been reduced.
• Diversion to the mud gas separator resulted in gas venting onto the rig
  Once diverted to the MGS, hydrocarbons were vented directly onto the rig through the 12 in goosenecked vent exiting the MGS, and other flow-lines also directed gas onto the rig. This increased the potential for the gas to reach an ignition source. The design of the MGS system allowed diversion of the riser contents to the MGS vessel although the well was in a high flow condition. This overwhelmed the MGS system.
• The fire and gas system did not prevent hydrocarbon ignition
  Hydrocarbons migrated beyond areas on Deepwater Horizon that were electrically classified to areas where the potential for ignition was higher. The heating, ventilation and air conditioning system probably transferred a gas-rich mixture into the engine rooms, causing at least one engine to over-speed, creating a potential source of ignition.
• The BOP emergency mode did not seal the well
  Three methods for operating the BOP in the emergency mode were unsuccessful in sealing the well.
  • The explosions and fire very likely disabled the emergency disconnect sequence, the primary emergency method available to the rig personnel, which was designed to seal the wellbore and disconnect the marine riser from the well.
  • The condition of critical components in the control pods on the BOP very likely prevented activation of another emergency method of well control, the automatic mode function (AMF), which was designed to seal the well without rig personnel intervention upon loss of hydraulic pressure, electric power and communications from the rig to the BOP control pods. An examination of the BOP control pods following the accident revealed that there was a fault in a critical solenoid valve in a control pod and that AMF batteries in the other control pod had insufficient charge; these faults likely existed at the time of the accident.
  • Remotely operated vehicle intervention to initiate the autoshear function, another emergency method of operating the BOP likely resulted in closing the BOP's blind shear ram (BSR) 33 hours after the explosions, but the BSR failed to seal the well.

LESSONS

The BP internal investigation team did not identify any single action or inaction that caused this accident; it was rather a complex and interlinked series of mechanical failures, human judgments, engineering design, operational implementation and team interfaces that came together to allow the initiation and escalation of the accident. Multiple companies, work teams and circumstances were involved over time. A series of recommendations were developed by the internal investigation team to address each of the key findings and to enable the prevention of similar accidents in the future. These recommendations are summarised as follows:

Implementation of Drilling and Well Operations Practice and Operating Management System

• Procedures and Engineering Technical Practices
• Review current practices to ensure that a clear and comprehensive set of cementing guidelines and associated Engineering Technical Practices (ETPs) are available as controlled standards.
• Review ETP covering well control to clarify requirements for subsea blowout preventer (BOP) configuration
• Update technical practices to consider load conditions for negative-pressure tests in the casing design assessment for subsea wells and to standardize the installation of the locking mechanism of the casing hanger seal assembly to the high-pressure housing for subsea wellheads.
• Review ETP covering work with pressure to include negative pressure testing.
• Clarify standards for well control and well integrity incident reporting and investigation. Ensure that all incidents are rigorously investigated and that close-outs of corrective actions are completed effectively.
• Propose to the American Petroleum Institute the development of a recommended practice for the design and testing of foam cement slurries in high-pressure, high-temperature applications.
• Review the consistency, rigor and effectiveness of the current risk management and management of change (MOC) processes practiced by Drilling and Completions (D&C)
• Capability and Competency
• Reassess the Technical Authority’s (TA) role in the areas of cementing and zonal isolation. Ensure adequate TA coverage to support all the D&C global operations.
• Enhance D&C competency programs to deepen the capabilities of personnel in key operational and leadership positions and augment existing knowledge and proficiency in managing deepwater drilling and wells operations.
• Develop an advanced deepwater well control training program that supplements current industry and regulatory training. Training outcomes would be the development of greater response capability and a deeper understanding of the unique well control conditions that exist in deepwater drilling.
• Establish BP's in-house expertise in the areas of subsea BOPs and BOP control systems through the creation of a central expert team, including a defined segment engineering technical authority (SETA) role to provide independent assurance of the integrity of drilling contractors' BOPs and BOP control systems. A formalized set of authorities and accountabilities for the SETA role should be defined.
• Request that the International Association of Drilling Contractors review and consider the need to develop a program for formal subsea engineering certification of personnel who are responsible for the maintenance and modification of deepwater BOPs and control systems
• Audit and Verification
• Strengthen BP's rig audit process to improve the closure and verification of audit findings and actions across BP-owned and BP-contracted drilling rigs.
• Process Safety Performance Management
• Establish D&C leading and lagging indicators for well integrity, well control and rig safety critical equipment.
• Require drilling con tractors to implement an auditable integrity monitoring system to continuously assess and improve the integrity performance of well control equipment against a set of established leading and lagging indicators.

Contractor and Service Provider Oversight and Assurance

• Cementing Services Assurance
• Conduct an immediate review of the quality of the services provided by all cementing service providers. Confirm that adequate oversight and controls are in place within the service provider's organization and BP.
• Well Control Practices
• Assess and confirm that essential well control and well monitoring practices, such as well monitoring and shut-in procedures, are clearly defined and rigorously applied on all BP-owned and BP-contracted offshore rigs (consider extending to selected onshore rigs such as those for high-pressure, high-temperature, extended reach drilling IERDJ and sour service applications).
• Rig Process Safety
• Require hazard and operability (HAZOP) reviews of the surface gas and drilling fluid systems for all BP-owned and BP-contracted drilling rigs. Include a HAZOP review as an explicit check for rig acceptance and rig audit. Phase 1 should address offshore rigs. Phase 2 should address selected onshore rigs such as those for high-pressure, high-temperature, ERD and sour services applications.
• Include in the HAZOP reviews a study of all surface system hydrocarbon vents, reviewing suitability of location and design.
• BOP Design and Assurance
• Establish minimum levels of redundancy and reliability for BP's BOP systems. Require drilling contractors to implement an auditable risk management process to ensure that their BOP systems are operated above these minimum levels.
• Strengthen BP's minimum requirements for drilling contractors' BOP testing, including emergency systems.
• Strengthen BP's minimum requirements for drilling contractors' BOP maintenance management systems.
• Define BP's minimum requirements for drilling contractors' MOCs for subsea BOPs.
• Develop a clear plan for ROV intervention (independent of the rig-based ROV) as part of the emergency BOP operations in each of BP's operating regions, including all emergency options for shearing pipe and sealing the wellbore.
• Require drilling contractors to implement a qualification process to verify that shearing performance capability of BSRs is compatible with the inherent variations in wall thickness, material strength and toughness of the rig drill pipe inventory.
• Include testing and verification of conformance with above Recommendations in the rig audit process.