The Macondo Incident
Findings and Conclusions Prior to Published Inspection of the Subsea BOP Worldwide Drilling 12 October, 2010 Northern Business Unit, Conventional Gas Exploitation
CONFIDENTIAL FOR MARATHON OIL COMPANY USE ONLY The material contained in this presentation is for internal training purposes and is not to be further distributed
2
Tracking Info Here
The Event On the evening of April 20, 2010, control of the BP operated Macondo Well, located in approximately 5,000’ of water in Mississippi Canyon Block 252, was lost.
This loss of well control resulted in explosions and fire on board Transocean’s rig Deepwater Horizon.
Eleven people lost their lives and 17 others were injured. The blowout fed the fire for another 36 hours until the rig sank. Hydrocarbons continued to flow uncontrolled from the wellbore for 87 days, resulting in a spill of national significance. A response effort of unprecedented size, technical complexity, political pressure, media coverage and cost continues today. 3
Tracking Info Here
The First 36 Hours At the time of the incident we had two rigs operating in the GOM, the Noble Paul Romano at Innsbruck (MC 993) and the Diamond Ocean Monarch at Flying Dutchman (GC 511). Our supply vessels were directed to the scene for SAR operations and fire fighting. The Ocean Monarch was contacted for use of their BOP ROV intervention stab, but the Ocean Endeavor had the same model and was closer. 4
Tracking Info Here
An Unprecedented Response Effort As an Industry we watched as hours turned into days, days became weeks, and weeks grew into months. In contrast to the failures which led to the blowout, the response effort was nothing short of phenomenal.
5
Tracking Info Here
6
Tracking Info Here
7
Tracking Info Here
8
Tracking Info Here
9
Tracking Info Here
The Flow Path
10
Tracking Info Here
The Flow Path In the early days of the incident we, along with most of the industry, identified the three potential flow paths for the blowout: Annular flow thru a failed or off-seated casing hanger pack-off, annular flow thru parted or leaking production casing, or flow thru the float equipment. The majority of the industry, including us in the early days, became convinced that the flow path was thru the casing hanger pack-off. We reached this conclusion for two major reasons: 1.
Reports confirmed that the lock-down sleeve had not been installed before the blow-out occurred. Quick calculations indicated that if hydrocarbons had been allowed to migrate during and after the cement job, forces due to probable differential pressures could have offseated the hanger and pack-off.
2.
More importantly, the feeling was that whatever happened occurred so fast that the rig crew had no time to react appropriately. The thought of an influx coming all the way from TD to surface without being detected and secured was considered next to impossible and dismissed.
As days turned into weeks, several of us began to question why the exposed formations had not failed, collapsed and bridged over the flow path. There are several hundred feet of open formation between the productive interval and the 9-7/8” liner shoe. Despite the implications (well unloaded from the bottom, up the production casing, undetected), some of us reached the conclusion that flow through the float equipment was the only path that could explain the sustained flow without bridging. Unfortunately BP’s investigation team, which had access to much more information than the majority of the industry, reached the same conclusion based on multiple pieces of evidence. They go so far as to state that well control efforts were not initiated until 49 minutes had elapsed and approximately 1,000 bbls of influx had occurred. 11
Tracking Info Here
Evidence of Flow Path from BP’s Accident Investigation
12
Tracking Info Here
Well Design Information The discussion regarding the flow path is important because BP was heavily criticized for running the final production casing as a long string. The assumption was that annular flow thru poor cement and a damaged or off-seated casing hanger pack-off was the failure mode. The investigation team included a diagram that suggested the original Macondo well plan called for a long string of production casing (9-7/8”). According to mutual partners, this design is not uncommon for BP. While it eliminates at least one annular barrier (liner-top packer), it also eliminates leak paths associated with liner hangers and tie-back seals. In some cases this design provides mitigation for annular pressure build-up, and this appears to play heavily in BP’s decision to install long strings. Although we have not utilized a long string in our deepwater completions for a variety of reasons, it is not appropriate to say the use of a long string across a productive interval is negligent. Multiple risks and hazards must be addressed on a case-by-case basis, and there may be times that a long string provides the best solution. It is the design, installation and proper verification of barriers that is critical
13
Tracking Info Here
Original Well Design and Actual
14
Tracking Info Here
Findings From BP’s Investigation Team
15
Tracking Info Here
Investigation Team’s Representation of the Physical or Operational Barriers Breached
Disasters of this nature and magnitude are almost always the result of multiple failures. These failures often involve decisions made, actions taken (or not taken), and barriers. The Macondo Incident is no exception. 16
Tracking Info Here
Well Integrity Was Not Established or Failed The cement did not isolate the hydrocarbons from within the annular space behind the production casing The shoe track (cement and float equipment) failed to provide an effective barrier
17
Tracking Info Here
Cementing Operation The Investigation Team determined the annular cement failed to isolate the hydrocarbon bearing zones for one or more of the following reasons:
Foamed slurry was likely unstable and allowed nitrogen to break out
No fluid loss additives were included in the slurry
Complete lab testing of the slurry was not performed
Contamination of the slurry due to the small volume pumped
Channeling due to insufficient mud removal was briefly discussed, with a base oil spacer and only 6 centralizers mentioned. The main focus, however, was on foam instability and possible contamination This complex slurry and spacer program was apparently designed to minimize ECD and maximize the chance of having returns. Having returns at surface during a cement job on a long string at this depth should very seldom be a primary objective, and actions taken to achieve this performance indicator can jeopardize the critical requirements for complete mud removal and minimal contamination of the slurry. 18
Tracking Info Here
Cementing Operation The Investigation Report fails to state the slurry volume, the pump rate used to place it, and the results of the lab testing that was completed. They do state that full returns were achieved during the placement of the slurry.
In a draft report from May, BP states that a 60 bbl slurry was pumped. Based on the wellbore details provided in the final report, the volume required to reach their planned TOC would have been slightly more than 50 bbls assuming a gauge hole
The slurry and spacer densities were very close to the mud density. There would have been very little to no benefit from density differences when displacing the mud.
Although not stated (or at least not found by me), the pump rate while placing the slurry was probably on the low end if fracture margins were tight yet full returns were acheived. Rate (annular velocity) plays a very critical role in effective mud removal, minimizing contamination and eliminating channels.
Time to develop compressive strength was not stated in the report. A Transocean investigation stated “Test on 4/12 of 7”casing slurry : 0 psi compressive strength after 24 hours” . Attempts to perform a negative test commenced approximately 16-1/2 hours after bumping the plug. 19
Tracking Info Here
Cementing Operation Based on the information presented, the cement slurry design and implementation had a very low probability of ever providing an effective barrier. Apparently in an effort to maintain an exposed shoe (9-7/8” liner, for future annular pressure buildup mitigation), the overall slurry volume was maintained very close to a calculated gauge hole capacity. Therefore, a 16.74 ppg cap, followed by a nitrified 14.5 ppg lead, chased with a 16.74 ppg tail was crammed into an overall volume of 60 bbls, preceded by a 6.7 ppg base oil and 14.3 ppg spacer to displace 14.2 ppg mud, all pumped at a rate slow enough to allow full returns in an environment with little fracture gradient margin through a tapered string of casing at over 18,000’ deep. While there are many factors that must be considered in the planning of a cement job, often times rate and volume can overcome many deficiencies. Rate can help reduce the effects of poor centralization, inability to move the pipe, and reduced density differentials to name a few. Increased volumes compensate for enlarged hole conditions and contamination that occurs during the placement and mud removal process. If cement is going to be relied upon as a barrier, then achieving this becomes the primary objective in the design and execution. Had a significantly larger volume of non-nitrified cement with proper fluid loss additives and LCM material been pumped at a rate that ensured mud displacement and diversion (if losses were experienced below the highest HC bearing zone), it is quite possible this disaster would have been avoided. At these depths and objectives, our practice has and continues to be non-nitrified slurries with tightly controlled fluid loss with LCM additives (if warranted), well centralized casing whenever possible, and rates that ensure proper mud displacement (despite no returns at surface the majority of the time). Ironically, had BP followed our general practice, their concern about maintaining an exposed shoe at the 9-7/8” liner would have been addressed automatically … no returns equals no cement above the next shoe. 20
Tracking Info Here
The Shoe Track Cement and Float Equipment Failed to Provide an Effective Barrier The investigation team identified the following possible failure modes that may have contributed to the shoe track cement’s inability to prevent hydrocarbon ingress: 1.
Contamination of the shoe track cement by nitrogen breakout from the nitrified foam cement. Contamination of the shoe track cement by the mud in the wellbore. Inadequate design of the shoe track cement (reference to the set time of the cement in relation to the attempted negative test?) Swapping of the shoe track cement with the mud in the rat hole (bottom of the hole). A combination of these factors.
2. 3.
4. 5.
Three possible failure modes for the float collar were identified: 1.
Damage caused by the high load conditions required to establish circulation Failure of the float collar to convert due to insufficient flow rate (reference to a low cement placement rate?) Failure of the check valves to seal.
2. 3. 21
Tracking Info Here
The Shoe Track Cement and Float Equipment Failed to Provide an Effective Barrier We have experienced more than one failure of this type of float equipment. While it is run as a “double valved” installation, an effective seal cannot be taken for granted. Typically, there is enough displacement pressure (differential pressure due to a heavier column of cement in the annulus) following a cement job to immediately determine if the float valves (check valves in the adjacent schematic) are holding. Due to the spacers, nitrified slurry, and very probable channeling and contamination, the differential pressure following the cement job on the 9-7/8” by 7” production casing would have been very little to none. Like we have witnessed more than once in our operations, the check valves may never have been holding. The difference here is there was probably insufficient differential pressure to make this determination. The investigation team pointed out multiple potential failure modes for the cement inside the shoe track. Exposing the cement to a negative differential before it was capable of providing a seal is a possibility as well. A more conventional, higher volume cement job may have provided the differential necessary to determine the integrity of the check valves. 22
Tracking Info Here
Hydrocarbons Entered the Well Undetected and Well Control was Lost Negative pressure test was accepted despite obvious signs that well integrity did not exist Influx was not recognized until hydrocarbons were above the subsea BOP Well control response actions failed to regain control of the well
23
Tracking Info Here
Positive Test
24
The Positive Test (2,700 psi) of the production casing was successful.
Although from the opposite direction as the pressure differential experienced after displacing the riser to seawater, the casing and casing hanger seal assembly tested.
Since the wiper plug had landed during the cement job, the positive test pressure was unlikely to be transmitted to the shoe track.
The positive test commenced approximately 10-1/2 hours after the plug was bumped.
At this point a sigh of relief was probably breathed. A very difficult, significantly over-budget well had just been cased, cemented and “tested”.
It was also at this point that a False Sense of Security probably set in.
Tracking Info Here
Incorrectly Interpreted Negative Test
25
Tracking Info Here
Attempts were being made to accomplish more than one objective with the negative testing operation.
The “spacer” referenced in the Deepwater Horizon Investigation was more accurately described as unused Form-a-Set and Form-aSqueeze LCM pills in the Deepwater Horizon Interim Incident Investigation dated May 24th 2010 (can’t be discharged directly from rig, but if it goes into the well, then the returns can be discharged, so this was pumped ahead of the seawater with the intention of dumping after it returned to surface)
Introducing this additional operation into a very safetycritical test may have added to the difficulty personnel experienced interpreting the results.
Incorrectly Interpreted Negative Test
26
Tracking Info Here
When conducted in this manner, the subsea BOP element utilized (ram or annular preventer) must hold a pressure differential from the top, opposite from what it is designed to accomplish.
Ironically, the only ram in the stack designed to hold a differential from above was the test ram, the one heavily criticized as a “useless ram” in early media reports.
The amount of fluid that reportedly leaked by the annular preventer during the attempted negative test did not help the interpretation of the results (16.0 ppg LCM pill likely entered into and gained height in the kill line).
Incorrectly Interpreted Negative Test
27
Tracking Info Here
At some point it was decided to switch from the drill pipe to the kill line for monitoring.
The kill line reportedly stayed at 0 psi for 30 minutes, while the drill pipe reportedly built to 1,400 psi over a period of time.
The drill pipe pressure was explained as a “bladder effect” and the kill line observations were considered accurate. The negative test was considered successful and displacement of the mud and 16.0 ppg spacer with seawater continued.
If two lines are connected directly to the same compartment, similar pressure responses (variances may exist due to fluid density differences) should be observed. If one reads 0 psi and one builds to 1,400 psi, you STOP and determine why such a discrepancy exists. You don’t blame it on some mythical “bladder effect”.
Incorrectly Interpreted Negative Test
28
Tracking Info Here
Influx was not recognized until hydrocarbons were above the subsea BOP
29
Tracking Info Here
Influx was not recognized until hydrocarbons were above the subsea BOP Unrecognized Flow Indications In this case the drill pipe had already been completely displaced with seawater. The expectation should be that at a given flow rate, the drill pipe pressure should decline as mud is displaced from the annulus, then remain constant once seawater reaches the surface. During this displacement, influx near the bottom of the well displaced mud above the bottom of the drill pipe, causing a pressure increase. This unexpected response, even with the pumps off, apparently was not recognized. 1. Drill pipe pressure increased by 100 psi when it should have been decreasing (~ 39 bbl gain from 20:58 to 21:08 2. Drill pipe pressure increased by 246 psi with the pumps off, and flow does not immediately drop off when shutting down the pumps 3. Drill pipe pressure increased by 556 psi with the pumps off, ~ 300 bbl gain by now. 30
Tracking Info Here
Influx was not recognized until hydrocarbons were above the subsea BOP Influx continues to displace mud above the end of the drill pipe, causing the drill pipe pressure to increase with the pumps off. As hydrocarbons pass the end of the drill pipe and the displaced mud and mud-seawater mixture enters the riser (less height for a given volume), the drill pipe pressure starts to decline, rapidly. It wasn’t until the last pressure increase with the pumps off that someone decided something was not right, but the action taken was to apparently bleed off the drill pipe pressure. At this point the well must have been flowing at a very substantial rate for over 10 minutes with the pumps off 31
Tracking Info Here
Influx was not recognized until hydrocarbons were above the subsea BOP
32
Tracking Info Here
Influx was not recognized until hydrocarbons were above the subsea BOP
33
Tracking Info Here
Influx was not recognized until hydrocarbons were above the subsea BOP There have been several discussions regarding the factors that may have contributed to the failure to recognize the influx until it was well above the subsea BOP. The most significant of these, in my opinion, are listed below. I list these, and discount the others on the next slide, because of the following belief: As long as the BOPs and Marine Riser are attached to the wellhead, a conduit directly to the rig exists. As long as a direct conduit to the to rig exists, constant monitoring to ensure well control is maintained is required. The Driller is ultimately responsible, regardless of the other operations going on, for ensuring well control is maintained at all times. 1.
False sense of security prevailed since the wellbore had been tested positively, and the negative test had been mistakenly accepted as successful.
2.
When preparing to perform an operation, often times the responses can be predicted and should be expected. If the expected responses are not observed, then the operation should be stopped and the reason for the discrepancy should be determined and remedied. The pressure responses shown on the previous slides certainly deviated from what should have been expected. The Driller either did not observe these responses, did not comprehend that these responses should not be expected, or both. Since action was not taken until the last significant pressure increase (with the pumps off , 556 psi), one might conclude that he did not observe. The action, however, (bleed off the drill pipe pressure) indicates he had no comprehension of what should be expected and what was actually happening.
3.
It was not uncommon for us to displace the riser with no accurate pit monitoring, but when those cases existed, noflows were obtained at scheduled intervals and someone was assigned to monitor the flow and confirm no-flow when the pumps were shut down. This was obviously not done on the Macondo well. Flow was not recognized for at least 49 minutes and after 1,000 bbls of influx. New regulations will likely prohibit displacements like this in the future. From now on, displacements will be done with a closed BOP in multiple steps.
34
Almost 20 years ago I stood on the rig floor of a semisubmersible with the Senior Offshore Supervisor I was working nights for. He had worked his way up through the contractor ranks on semisubmersibles, and then hired on with Marathon. He retired not long ago. Pointing at the Driller on the brake, he said “Incase you don’t know, that is the most important person on this rig. He can sink this thing faster than anyone else onboard” Tracking Info Here
Influx was not recognized until hydrocarbons were above the subsea BOP Several other contributing factors have been stated or discussed. Some of these are listed below, but while these often receive significant discussion, they are not critical and should have had no impact on ensuring well control was maintained.
VIPs were on board to congratulate the crews for an achieved safety performance milestone. It doesn’t matter who is onboard, ensuring constant monitoring occurs and well control is maintained should not be negatively impacted by visitors.
Multiple operations were going on simultaneously, so attention to critical tasks was divided. There are always simultaneous operations taking place on a facility of this magnitude. Well control, however, must always be someone’s top priority; and that someone better understand this very clearly.
Transfers of mud to a supply vessel were taking place prior to the displacement, making it difficult to monitor volumes. It was stated in the investigation report that the mudloggers were not notified when transfers ceased and apparently did not monitor the pit volumes. While often used for this task, mudloggers are not the ones ultimately responsible for continuously monitoring the well during all operations.
The mudlogger’s flow meter was bypassed and pit monitoring was not possible once returns were routed overboard. Same as above, and other means of verifying the well is stable should have been employed (frequent no-flow checks, having someone dedicated to monitoring the returns and verifying no-flow each time the pumps are shut down)
35
Tracking Info Here
Well Control Response Actions Failed to Regain Control of the Well
Well control response actions were not taken until water and mud started overflowing onto the rig floor. At this point over 1,000 bbls had entered the well undetected and hydrocarbons were above the subsea BOP.
36
¾
Mud was expelled through the rotary table up through the derrick towards the crown block before the diverter was closed
¾
Pressure responses indicate an annular preventer was closed, but did not seal immediately. Transocean’s protocol was to close the annular, then close a VBR. Eventually the pressure responses indicated a seal was obtained. The annular was only rated to 5,000 psi, and modeling indicated an 8,000 psi differential could be expected at that point. The investigation team concluded that it was very likely that a VBR produced the seal.
Tracking Info Here
Well Control Response Actions Failed to Regain Control of the Well
Flow from the diverter was routed to the mud gas separator (MGS), not directly overboard. This action, regardless of whether someone intentionally lined it up this way or if it was lined up to the MGS as SOP, ultimately eliminated any further human intervention to secure the well and perform emergency disconnect actions.
37
¾
This routing of a major gas event to the MGS resulted in component failures and the rapid dispersion of gas across large areas of the rig. Failure of the fire and gas systems to prevent ignition was listed as another failed barrier, but this is a weak statement. An event of this magnitude would quickly go beyond electrically classified areas, and multiple sources of ignition, including sparks generated by failed components, would have existed.
¾
The subsequent explosion likely took out both MUX cables in the moon pool, thereby eliminating any further actions by the crew to shear the pipe or initiate an emergency disconnect sequence.
Tracking Info Here
Well Control Response Actions Failed to Regain Control of the Well Instantaneous gas rates reached an estimated 165 mmscfd with pressures in excess of 100 psi Gas would have likely vented from: Slip joint packer, 12” MGS vent, 6” MGS vacuum degasser vent, 6” overboard relief line (burst disk), 10” mud line under the main deck
38
Tracking Info Here
Well Control Response Actions Failed to Regain Control of the Well
39
Tracking Info Here
Well Control Response Actions Failed to Regain Control of the Well
40
Tracking Info Here
Well Control Response Actions Failed to Regain Control of the Well
It is likely the explosion took out both MUX cables, preventing communication to the subsea BOPs Manual activation of either the HighPressure Blind Shear Rams or the EDS would have been prevented. Testimony indicated that the EDS was pushed and the panel reacted like it should, but “it never left the panel” At this point, only the AMF (Automatic Mode Function) and ROV intervention remained 41
Tracking Info Here
Well Control Response Actions Failed to Regain Control of the Well Although the pressure responses indicated the subsea BOP sealed eventually, flow continued after the initial explosion based on the intensity of the fire. This flow may have come from several sources, including:
Rig drifting or traveling equipment movement moved pipe enough to damage the VBR and allow flow again
Damage to the drill pipe allowed flow into riser or onto rig floor area
Surface equipment failures (swivel packing, kelly hose)
Pressure relief valves on mud pumps allowed flow into pit area
42
Tracking Info Here
Well Control Response Actions Failed to Regain Control of the Well Had the 14” overboard line been utilized, as it should have been for any significant gas event, the outcome may have been different. The slip joint packer may still have been at risk, but a significant portion of the gas would have been vented safely away, reducing the chance for ignition. Manual activation of the high-pressure BSR or the EDS would have been much more likely
43
Tracking Info Here
Emergency BOP Functions Failed to Secure the Well
44
Tracking Info Here
Emergency BOP Functions Failed to Secure the Well Manual emergency functions had been rendered inoperable by the explosion and fire The AMF (Automatic Mode Function, more commonly called the Deadman System) then became the second to last line of defense. At a minimum this function would have activated the high pressure BSR. The Deadman System requires a loss of communication, electrical power and hydraulics (all three) at both pods to activate. Communication and electrical power would have been lost with the MUX cable damage Although more protected, the hydraulic supply conduit and surface system would have been destroyed as well, if not by the explosion, then by the fire. The Deadman System failed to function 45
Tracking Info Here
Emergency BOP Functions Failed to Secure the Well On this model BOP Stack, the Deadman System relies on lithium battery packs in the subsea control pods to operate the solenoid valves. When these pods were recovered to the surface during the response effort, the Deadman System functions in both were found inoperable. In the Blue Pod, the battery power remaining was significantly below that required to operate the solenoid valve. In the Yellow Pod, there was probably sufficient battery power, but the solenoid valve was inoperable.
How much attention is given to the lines of defense that are considered “last” or “next to last”, especially when there are several barriers before these are needed?
46
Tracking Info Here
Emergency BOP Functions Failed to Secure the Well ROV Intervention also failed to secure the well
The shuttle valves on the Cameron BOP Stack require a minimum flow rate to fully shift and direct fluid to the intended function.
ROV Intervention capability is routinely tested at surface, but it is typically done with a hot line pulling fluid directly from the rig’s accumulator system. It is seldom done with or at a rate equivalent to what the ROV pump can generate.
The rate the ROV could generate was insufficient to shift the shuttle valves on this stack. This was due to the design of the shuttle valves and hydraulic leaks subsequently discovered in the system.
The ROV successfully activated the autoshear function (if armed, this function activates the high pressure BSR when the LMRP is disconnected) by cutting the indicator rod. This was done 07:40, 21 April 2010.
The high pressure BSR failed to secure the well, and this was the last line of defense. Additional attempts were made to actuate components with the ROV intervention panel. It was assumed that attempts to close the “pipe rams” meant the middle VBR, but it was discovered that the bottom, inverted test ram was the one actually plumbed to the ROV intervention panel. 47
Tracking Info Here
Emergency BOP Functions Failed to Secure the Well Failure of the autoshear function, which closes the high-pressure BSR, to secure the well may have been due to: 1. Insufficient hydraulic power to shear the 5-1/2” 21.9 ppf, S-135 which was across the stack at the time of the incident 2. Seal failure due to prevailing flow conditions in the BOP 3. Presence of non-shearable components across the BSR
48
Tracking Info Here
Emergency BOP Functions Failed to Secure the Well 1. Insufficient hydraulic power to shear the 5-1/2” 21.9 ppf, S-135 which was across the stack at the time of the incident Period of approximately 30 hours existed where the subsea accumulators were not being charged from surface (explosion to ROV autoshear activation) During subsequent control efforts, a control system leak of “no greater than” 0.32 gph was determined between pod retrieval and reinstallation. The investigation team stated that a leak of approximately 3 gph for 30 hours would have been required to drop the subsea accumulator pressure below that required to shear the drill pipe.
49
Tracking Info Here
Emergency BOP Functions Failed to Secure the Well 2. BSR seal failure due to prevailing flow conditions in the BOP at the time of actuation. BSR successfully tested during the positive pressure test on the morning of the incident The exact flowrate at the time of actuation is not known, but the effect of closing the BSR under what may have been high flowrates is unknown. Much later in the response a rate of 53,000 BOPD was observed, but this was under different conditions at surface (and probably TD). The investigation team stated that with the leak observed in the hydraulic circuit, the shearing operation would have taken 17 seconds to complete. Without the leak, it should have taken 14 seconds.
50
Tracking Info Here
Emergency BOP Functions Failed to Secure the Well 3. Non-shearable components were across the BSR at the time of actuation Pictures from later in the response effort showed two distinct drill pipe stubs in the riser section that was cut. This immediately raised questions regarding what exactly was across the stack when the BSR were activated. Through examination of the recovered stubs, the investigation team concluded only one string was across the stack at the time of the BSR activation. Erosion, rig drift and hoisting equipment movement likely resulted in pipe movement and parting of the string above the BOP. The location of tool joints relative to the BSR at the time of actuation is not known exactly. Results from the physical inspection of the subsea BOP have not yet been released, but may shed more light on this subject.
51
Tracking Info Here
Emergency BOP Functions Failed to Secure the Well
52
Tracking Info Here
Emergency BOP Functions Failed to Secure the Well
53
Tracking Info Here
Recommendations BP’s Investigation team published 25 recommendations, specific to 8 key findings, in the “Deepwater Horizon Incident Investigation Report”. I would encourage you to read these and determine if and how these may apply to your operations.
Since BP’s recommendations are, in some cases, specific to their structure and culture (and maybe influenced by other objectives), let’s cover some broader and a few deeper recommendations
54
Tracking Info Here
Recommendations In the weeks and months following the Macondo Incident, the industry focused on Prevention. The government then demanded similar focus on Spill Containment and Spill Response. The immediate focus on Prevention is both understandable and warranted. We have all heard that “An ounce of prevention is worth a pound of cure”. An ounce of prevention would have been worth at least 62 lbs of cure in the case of the Macondo incident. The same philosophy holds true when focused entirely on the multiple layers of Prevention that we rely upon. The earlier in the layers of defense that an issue is recognized and aggressively addressed, the more efficient and reliable the response will be.
55
Tracking Info Here
Recommendations Barrier Philosophy Maintaining control of fluids, both produced and injected, throughout the life-cycle of a well is of primary concern and is a basic expectation. The design, installation or use, and proper verification of barriers is critical to meeting this expectation. Examples:
If cement is going to be relied upon as a barrier, then achieving this becomes the primary objective in the design and execution. If trying to meet other needs that may jeopardize the barrier objective, the ability of the cement to perform as an effective barrier should be rigorously verified, or another barrier should be installed and tested.
Safety-critical tests should be as simple and straight forward as practical, not encumbered by steps that could contribute to the misinterpretation of deviations from the expected. The reasons for deviations from the expected should be adequately investigated, the risks assessed if needed, and mitigation efforts implemented before proceeding.
56
Tracking Info Here
Recommendations Secondary and Emergency Control systems should be understood and tested. Deficiencies or failures in these systems should be either remedied or risk assessed. If the risk assessment concludes it prudent to proceed, the implications should be well understood by those potentially relying on the system. If another use or configuration exists for a safety-critical system, but this use or configuration may create additional hazards, the circumstances under which the alternate use can be employed must be well defined and understood. Examples:
How much attention is given to the lines of defense that are considered “last” or “next to last”, especially when there are several barriers before these are needed (Deadman, autoshear and ROV intervention)? At least in the GOM, this is soon to be mandated.
A diverter system is designed to divert flow safely away from personnel and the facility while minimizing the pressure on components with low pressure ratings. With the prevalence of SBM usage in the deepwater environment, the ability to route the diverter to a MGS became common. The diverter should direct flow directly overboard through a large ID line to avoid over pressuring the slip joint packer, diverter element and marine riser components. Since SBM can’t be discharged, and gas has the ability to go into solution (oil phase of the mud) and then be liberated near surface, the use of the MGS to control relatively minor solution-gas events (bottoms up after a trip, extensive sampling operations, or controlling a kick) has been widely accepted. Routing returns to the MGS during a major event, however, poses significant hazards. In the case of the Macondo incident, this action may have resulted in the death of 11 people and the elimination of some critical barriers that are typically relied upon. 57
Tracking Info Here
Recommendations Culture In the days following the Macondo incident, most companies immediately searched for assurances that this could not happen to them. I won’t speculate on how many assurances were made. The established processes that BP had in place (documented reviews, management of change, basis of design) are impressive. Unfortunately, these failed to prevent 11 deaths and a spill of national significance. Although harder to define and measure, and even more difficult to regulate, we pointed to our culture as the single most important differentiating attribute when comparing us to BP. In a recent meeting with an individual who has numerous dealings with BP, he observed that regardless of the purpose of the gathering (planning session to morning rig call), it is almost impossible to determine who is ultimately responsible and accountable for the operation being discussed. Evidence of this exists in the very report this presentation was derived from.
58
Tracking Info Here
Recommendations In a “White Paper” presented to the BOEM, we presented what Marathon considered appropriate safeguards to have in place in order to resume operations in the GOM. The language below comes directly from that letter and was drafted by Greg Sills (VP Upstream Developments). Additional comments are shown in blue: The BP incident serves as a stark reminder, however, that systems and expectations are not enough no matter how well presented – a culture that encourages the appropriate leadership and individual behaviors is perhaps even more important. We intend to continue to reinforce the culture of a highly reliable organization that sustains attributes such as the following:
A preoccupation with deviations, lapses, errors – responding quickly and rigorously to anything which falls outside expectations, and refusing to recalibrate expectations in order to avoid normalization of deviance. (Opposite responses during the negative test, yet rationalized and dismissed; continued warning signs during the displacement that well integrity did not exist)
A listening environment – where leaders listen to the front line and defer to expertise, faint signals are heard, and the front line reports confidently - even (especially) when the report is troublesome. (Our established culture of brutally honest reporting)
Certainty is created where possible – standard procedures are followed, not circumvented creating excess capacity for dealing with the truly “unexpected”. (One of the reasons that drove the creation of our Design and Operating Guidelines – unless you have obtained proper approval for a deviation, the established standards will be followed so attention can be focused on other areas)
These are examples of a responsive and agile organization that detects small misjudgments early, notices the unexpected while it is still forming, arrests it before it expands, and safely returns to normal operation. 59 Tracking Info Here
Recommendations Final Thoughts: Responsibility and Accountability. Focus and awareness increase when you know that you are both responsible and accountable. Take the earlier points made when discussing well monitoring: As long as the BOPs and Marine Riser are attached to the wellhead, a conduit directly to the rig exists. As long as a direct conduit to the to rig exists, constant monitoring to ensure well control is . maintained is required. The Driller is ultimately responsible, regardless of the other operations going on, for ensuring well control is maintained at all times. Would an influx of 1,000 bbls over 49 minutes occur undetected if the Driller truly understood and believed this?
False Sense of Security. We must always guard against complacency in the absence of recent consequences. For years the industry bragged that there had never been a deepwater blowout of any significance. “Last line of defense” safety systems went years without ever being needed. Guards were lowered. We must maintain a sense of vulnerability.
60
Tracking Info Here
