Transocean Deepwater Horizon 1 21/08/2013 The accident 20 th - - PDF document

21/08/2013 1

The Path to Disaster The Deepwater Horizon BP’s disaster in the Gulf of Mexico

Professor Patrick Hudson & Tim Hudson Hudson Global Consulting

4th Annual Plexus Industrial Safety Lecture Industrial Psychology Research Centre 14th August, 2013

Transocean Deepwater Horizon

21/08/2013 2

The accident

• 20th April 2010
• Hydrocarbons escaped into the well while it was

being underbalanced with seawater

• The Blow Out Preventer (BOP) was activated late

and failed to shut in the well

• The riser was not disconnected
• The escaping gas ignited
• 11 dead
• The drilling rig Deepwater Horizon sank after 2

days

21/08/2013 3

Conclusion

• The accident was preventable
• If BP’s Operating Management System OMS had

been applied rigorously, the temporary abandonment could have been completed safely

• The dominant failures were associated with no

risk analyses or assessments despite major changes and problems with the well

• The primary causes can be related back to BP’s
• rganizational culture

Mississippi Canyon 252

• Original plan to produce a well for an Anadarko

facility

• Poor offset data

– Exploration well rather than a production well

• Drilled by Transocean Marianas

– The Pharos from Piper Alpha

• Marianas forced off in late 2009 after hurricane

damage

• Replaced early 2010 by Deepwater Horizon
• Described as “the well from hell”

21/08/2013 4

The well Drilling Margin

• Three factors to consider
• Pore pressure

– Formation pressure acting in on the hole

• Fracture gradient

– Point at which rock breaks with mud pressure

• Equivalent Circulating Density

– Extra pressure due to mud pump pressure

21/08/2013 5

Drilling the well

21/08/2013 6

Well Design March 8th Dress Rehearsal

• On March 8th there was a kick (influx of hydrocarbon)
• The kick was detected late

– There were crane operations at the time – The Sperry-Sun mud-logger was not believed

• The well was shut in successfully
• Recovery required a sidetrack
• Costs including rig time exceeded $10M
• No MIA report was made to London
• The same crew was also on board on 20th April

21/08/2013 7

Temporary Abandonment April

• Original plan to have a keeper well – to be completed

for production at a later date

• The well ran out of drilling margin at 18360 ft
• Formation pressure 16,800 psi -1150 bar
• They drilled on to get below the pay-zone
• An initial plan was produced on April 12th
• Feedback was that a pressure test for integrity was

missing

• The decision to set the lockdown sleeve was retained
• The temporary cement plug was to be set in seawater

Sequence of abandonment plans

21/08/2013 8

Procedure for temporary abandonment of the well

Cementing the well

• Run long string 7” casing
• Centralize production casing to avoid channelling
• Clean out the well – bottoms up
• Convert float collar
• Pump spacer
• Pump nitrogen foamed cement
• Test well integrity

– Positive pressure test – Negative pressure test

21/08/2013 9

Centralizers

• Centralizers are necessary to ensure the

annulus is constant, otherwise cement leaves mud behind allowing the possibility of hydrocarbon escaping through the mud

• Halliburton ran its Opticem software and

recommended 21 centralizers

• BP eventually ran with 6 without consulting

Halliburton

21/08/2013 10

Centralizers on the rig, but not used

Cleaning the well

• A well needs to be cleaned by circulating mud
• Circulation also breaks gel that sets if the mud

is left alone

• Ideal and standard is 1x or 1.5x bottoms up
• Extra pumping adds pressure as an increase in

ECD

• BP rejected the Halliburton recommendation

to run a full bottoms up

21/08/2013 11

Float Collar

• A float collar is a two-way valve that can be

converted to a one-way valve to ensure the cement does not flow back up the casing (U- tubing)

• The float collar has to be converted with a

sufficient flow rate of mud

• This was never achieved, but conversion was

accepted because of the high pressure applied to the float collar (3142 psi)

21/08/2013 12

21/08/2013 13

Debris in the shoe

BP Confidential: Horizon Investigation Update 26

Shoe – 18,304’ FC – 18,115’ TOC – 17,260’ Shoe – 17,168’

Cement Mud Spacer Seawater Influx Cement Mud Spacer Seawater Influx

Sea Floor Choke Boost BOP Kill

Description of Event – Placement of Cement

April 19th – 20th

• 19:30 – 00:30 - Cement job pumped as planned.
• 60 bbls cement
• Foamed cement used to reduce risk of losses
• 6 inline centralizers were spaced across the

main pay

• 00:35 – 7:00 – Seal assembly installed and pressure

tested, but not locked down to wellhead. Proceeded to preparation for positive casing test.

• ~7:30 – Decision made not to run Cement Bond Log

(CBL) premised on minimal losses and lift pressures

• bserved during cement displacement.

Cement Top of Cement 17260’ Primary reservoir sands 14.17ppg SOBM

12.6ppg 13.1ppg 14.0ppg 12.6ppg 12.6ppg

21/08/2013 14

Pressure Test

• Positive pressure test to ascertain if the casing

above the plugs will hold

– Overbalance the well (i.e. pump up from above)

• Negative pressure test to ascertain whether the

cement barrier is effective

– Underbalance the well by removing mud and replacing it with sea-water (pump out from above) – If the well is safe then there should be no change in pressure through the BOP – Proposal in MMS plan to measure on kill line rather than drill-pipe

BP Confidential: Horizon Investigation Update 28

Shoe – 18,304’ FC – 18,115’ TOC – 17,260’ Shoe – 17,168’

2700 PSI

Cement Mud Spacer Seawater Influx Cement Mud Spacer Seawater Influx

Sea Floor Choke Boost BOP Kill

Description of Event - Positive Pressure Test

April 20th

• 7:00 – 12:00 - Successful positive pressure test for

production casing and seal assembly. –Low Pressure 250 psi –High Pressure 2700 psi

• Note: The positive test is not designed to verify

integrity of the shoe track (cement and float collar). Drill pipe Closed Blind Ram BOP

2700 psi

Primary reservoir sands

12.6ppg 13.1ppg 14.0ppg 12.6ppg 12.6ppg

14.17ppg SOBM

21/08/2013 15

Negative Pressure Test First Negative Pressure test

21/08/2013 16

Second Negative Pressure test

BP Confidential: Horizon Investigation Update 32

1400 PSI PSI

Shoe – 18,304’ FC – 18,115’ TOC – 17,260’ Shoe – 17,168’

Cement Mud Spacer Seawater Influx Cement Mud Spacer Seawater Influx

Sea Floor Choke Boost BOP Kill

Description of Event - Negative Pressure Test

April 20th

• Negative test designed to verify integrity of seal

assembly, casing, and shoe track in an underbalanced

• condition. This simulates conditions for T&A and rig

demobilization.

• 12:00 – 15:04 - Reviewed displacement procedure

and commenced preparation for negative test.

• 15:04 – 15:56 – Displaced mud with sea water to

underbalance the well.

• 15:56 – 16:53 – Spacer inadvertently placed across

the BOP due to leaking annular.

• 16:53 – 17:52 – Test started by monitoring pressure
• n drill pipe.
• 17:52 – 19:55 – Negative pressure test procedure

switched to monitor pressure on kill line. – No pressure and no flow observed on the kill line – 1400 psi observed on the drill pipe

• 19:55 – Test was concluded to be successful.

Seawater Drill pipe Closed Annular BOP Viscous Spacer Primary reservoir sands

12.6ppg 13.1ppg 14.0ppg 12.6ppg 12.6ppg

14.17ppg SOBM

21/08/2013 17

BP Confidential: Horizon Investigation Update 33

Kill

Shoe – 18,304’ FC – 18,115’ TOC – 17,260’ Shoe – 17,168’

Cement Mud Spacer Seawater Influx Cement Mud Spacer Seawater Influx

Sea Floor Choke Boost BOP

Description of Event - Initial Recognition of Abnormal Well Conditions

April 20th Note: the following details are largely based on interpretation of data and witness statements:

• 21:31 – After completely displacing the spacer out of

the riser, the pumps were shut down.

• 21:31 – 21:34 – Rig crew discussed abnormal drill

pipe pressure increase.

• 21:36 – Rig crew bled the drill pipe to investigate the

abnormal pressure.

• 21:38 – Hydrocarbons began to enter riser.
• 21:40 – Mud overflowed the flow-line and onto rig.
• 21:41 – Mud shot up through the derrick. Rig crew

diverted to the mud gas separator (MGS) and shut the annular BOP. Seawater Hydrocarbon Influx above BOP Primary reservoir sands

12.6ppg 13.1ppg 14.0ppg 12.6ppg 12.6ppg

21:41

Kick detection

21/08/2013 18

21/08/2013 19

Kill Boost Choke BOP

Flow Line Port Overboard Diverter Line Mud System Starboard Overboard 6” Vacuum Breaker

Rated to 60 psi

IBOP

Slip Joint

Rotary Hose Diverter 12” Vent

MGS MGS

Bursting Disk Starboard Overboard

Rated to 100 or 500 psi

Hydrocarbons routed to MGS Diverter overboard lines closed MGS vented to manned and hazardous areas System quickly

• verwhelmed by

pressure and volume, leading to loss of containment

21/08/2013 20

Blowout Preventer (BOP)

Emergency Disconnect System (EDS)

21/08/2013 21

What was the immediate cause of the blowout?

• Most common explanation in terms of failure of

cement to provide an adequate barrier

– But see an alternative explanation

• With low expectations of a kick during abandonment

(rather than during ordinary drilling) small and slow moving indicators were missed

• Simultaneous operations for discharging together with

major crane activities made observations hard

– The Sperry-Sun mudloggers complained, but to no avail

• Transocean’s emergency structure created problems

with the use of the BOP and detachment from the riser

Shoe Track & Cement

21/08/2013 22

How did this come to pass? BP 1990 - 2010

• BP was a medium-sized North Sea operator
• 1990 John Browne appointed as CEO BP Exploration and

Production (upstream)

• 1995 Browne appointed CEO British Petroleum
• Sequence of mergers, mostly in USA, to overtake Shell

Group

– Amoco – Arco – Burmah-Castrol

• Number of disasters from 2000 onward

– Grangemouth, Texas City, Thunder Horse, Prudhoe Bay – Market fixing prosecutions in USA

21/08/2013 23

Cost Cutting

• Browne instituted a rigorous discipline of cost-cutting
• This was rated as the cause of problems at both Texas

City and Prudhoe Bay

• Texas City had 2 25% across the board cost reduction

targets prior to the disaster

• The financial community loved Browne – The Sun King

– for his financial discipline – even in an article published 20th April 2010

• Browne created a company that was loss averse, unlike

its risk averse competitors (Shell and Exxon-Mobil)

• Tony Hayward continued the culture with “Every dollar

counts”

2000 Grangemouth

• Number of major incidents, no fatalities
• Pleaded guilty to criminal charges

21/08/2013 24

Texas City 2005

• 15 dead, 170 severely injured, >500 wounded
• More than $ 1500 M set aside for compensation

and $ 1000 M for remediation & improvement

• Not including lost production
• BP’s Texas City

refinery had a major explosion on March 23rd 2005 of the isomerization plant

21/08/2013 25

Thunder Horse 2005

• July 2005, after hurricane

Dennis in the GoM, BP personnel returned to find the platform with a 20o list

• Start production in 2008,

instead of original 2006 start-up

• Losses (cost and 2 years lost

revenue) exceeded $10 Billion

Thunder Horse Platform, Gulf of Mexico

BP Alaska Prudhoe Bay 2006

• Production losses were 400,000 bbl/day

– Total 50,000,000 bbl ($3 Billion)

• Reputation damage increased with 2nd closure
• Scrutiny from US Congress
• Fatality Nov 13
• 2006 a leak of crude (1m litres) from

the North Slope to Valdez pipeline led to shutting down part of the pipeline

• A second pipeline problem emerged

leading to a major shutdown of production

21/08/2013 26

Issues

• Personal vs Process safety

– Stop the Job – Workforce did not see process safety issues as relevant (more about environment than safety)

• The contracts and safety responsibility

– Bridging documents – Exclusion clauses

• Foamed cement slurry stability
• 1st and 2nd line kick detection

Hypothesis – they blew the bottom off it

• Proposal – backed up by logging from relief wells

– Discussed by Chief Counsel but rejected for no reason

• The bottom part of the casing , shoe track, was buckled or

sheared

• Transient block load of 140,000 lb (reported as 10,000) on

final running of production casing

– Evidence from Sperry-Sun recording of block load – This is ± 70 tonnes (about 3 double-decker busses)

• Consequence that the cement never got near the pay-

zone

– Made blowout inevitable if the float collar failed – We know the annulus cement worked

21/08/2013 27

How did this come to pass?

• Changes in well design
• Abandonment plan
• Lack of management of change
• Lack of formal risk management
• Lack of requirements for risk management

21/08/2013 28

Risk Assessments

• The risk of catastrophic loss of containment was

recognized as #1 at the Group level (London) and SPU level (Houston)

• This was driven partly by downstream major

incidents (Texas City, Grangemouth, Prudhoe Bay)

• Macondo was downgraded from high to

moderate

• Kicks were downgraded from catastrophic loss of

containment as consequence

BP Group Risk Register

21/08/2013 29

No Drilling Surprises

21/08/2013 30

Design

• Beyond the Best, Drilling and Well Operations

Plan (DWOP) systems in place in GoM Drilling and Completions

• gHSSEr old SMS was replaced after Texas City

by OMS (Operations Management System)

OMS

• OMS was designed after Texas City as the solution

to BP’s Process Safety management problems

• Design started 2005, completed 2007
• Rollout late 2009 with USA as first wave
• Local OMS (LOMS) to be defined for specific
• perations
• BP assets (Texas City, Prudhoe Bay, Thunder

Horse) rolled out first

• Later rollout for contractor owned assets starting

2010

21/08/2013 31

The grandfather decision

• Because MC-252 was already under

construction and was planned to be finished by the time the Local OMS was rolled out BP decided not to implement the LOMS on the well and thus not subject it to the risk management processes it mandated.

• “We decided not to grandfather it in”

Risk decisions

• Numerous risk decisions were made in the

design of the well

• Variances from technical standards were

approved by the internal technical authority

• These decisions were made by technically

competent engineers in the engineering department and were subject to review

21/08/2013 32

Additional risk decisions

• The temporary abandonment plan was not

subjected to the same level of risk assessment and not reviewed at all

• The regulator (MMS) approved the plan in less

than 90 minutes

• There were several changes to the well design

that weren’t subjected to formal management of change nor any form of formal risk management

• The plan implemented (Ops plan) deviated from

the MMS approved plan

Risk management

• There was no process in place or in operation

requiring and driving formal risk management of decisions

• There was no management oversight of the

decisions being made by the well team

• The members of the well team did not have the

skills to use the risk management tools provided by company

• Silos between operations and engineering meant

that each was waiting for the other to initiate risk assessments

21/08/2013 33

D&C senior engineer

• Q. Okay. All right. When you made the decision not to use the

additional centralizers and to reposition this six existing centralizers — the subs, I believe, that you had on the rig — did you do a written risk assessment?

• A. No, ma'am.
• Q. Did you instruct anybody to do a written risk assessment?
• A. No, ma'am.
• Q. Was the risk register updated in connection with this decision?
• A. Not to my knowledge.
• Q. All right. And that was ultimately your responsibility, wasn't it?
• A. Yes, ma'am.

D&C Well Team Leader

• Q. Do you know what the BP risk assessment

tool is, the RAT?

• A. Yes.
• Q. Do you know how to use it?
• A. No.

21/08/2013 34

Drivers

• Press-on-itis
• Infrequent post drilling kicks
• Focus on the next jobs (Nile P&A, Kaskida)

Not weak signals

• Throughout the abandonment process there

were a number of signals and inputs that provided BP with information that there decisions were increasing the risk of failure of the operation

• These were disregarded for a number of

reasons

21/08/2013 35

Example Signals

• The failure to catch the March 8th kick in a

timely fashion was a signal that the well control process was not as robust as expected

• The communication by the cementers that the

decision not to carry out a full bottoms-up and the decision not to run all the centralizers placed the quality of the cement job in jeopardy

Why were they ignored?

• Lack of formal risk management processes

meant that there was an incomplete understanding of the potential downsides of the decisions made

• They had a purely forward looking point of

view that failed to take account of their previous decisions that increased the overall risk

21/08/2013 36

FIDO

• “I’m afraid we’ve blown something higher up

in the casing string.” (Well Site Leader)

• In the words of the Chief Counsel’s report,

“the rig crew proceeded onward”.

Did they take safety seriously?

• About 100 STOP cards were issued every day
• March 29th A dropped winch handle was found on the

rig floor

– 2 hour shutdown, team flown out specially

• A senior management visit to the rig was on the rig

when it blew out

– Including BP and Transocean VPs

• The problem was safety was seen as personal, rather

than personal + process safety

– A fire on March 28th had no equivalent response – BP used the word Integrity rather than safety for processes

21/08/2013 37

• Production

Protection

Better defenses converted to increased production

21/08/2013 38

• Protection

Best practice

• perations

under SMS Production

Bly Report Swiss Cheese Picture

21/08/2013 39

Federal Judge Carl J. Barbier Magistrate Judge Sally Sushan

The Court Case - MDL 2179 MDL 2179

• A large number of parties in civil litigation

– Plaintiffs (300,000 + in Plaintiffs’ Steering Committee) – US Department of Justice – Louisiana, Alabama (Florida & Mississipi later) – BP – Transocean – Halliburton – MI-Swaco – Cameron Iron works

• Separate from Criminal prosecutions

– BP & Transocean pleaded guilty (only prosecutions)

21/08/2013 40

Plexus Industrial Safety Lecture Series

Hosted by the Industrial Psychology Research Centre University of Aberdeen

Details of previous Plexus lectures: 2012 Professor Stanton ‘Forensic Human Factors: Ladbroke Rail Crash’ 2011 Dr Mica Endsley ‘Situation Awareness: Research and Design’ 2010 Professor Erik Hollnagel ‘Resilience Engineering’ can be found on: www.abdn.ac.uk/iprc