21/08/2013
The Path to Disaster
The Deepwater Horizon
BP’s disaster in the Gulf of Mexico
Professor Patrick Hudson & Tim Hudson
Hudson Global Consulting
4th Annual Plexus Industrial Safety Lecture
Industrial Psychology Research Centre
14th August, 2013
Transocean
Deepwater
Horizon
1
21/08/2013
The accident
• 20th April 2010
• Hydrocarbons escaped into the well while it was
being underbalanced with seawater
• The Blow Out Preventer (BOP) was activated late
and failed to shut in the well
• The riser was not disconnected
• The escaping gas ignited
• 11 dead
• The drilling rig Deepwater Horizon sank after 2
days
2
21/08/2013
Conclusion
• The accident was preventable
• If BP’s Operating Management System OMS had
been applied rigorously, the temporary
abandonment could have been completed safely
• The dominant failures were associated with no
risk analyses or assessments despite major
changes and problems with the well
• The primary causes can be related back to BP’s
organizational culture
Mississippi Canyon 252
• Original plan to produce a well for an Anadarko
facility
• Poor offset data
– Exploration well rather than a production well
• Drilled by Transocean Marianas
– The Pharos from Piper Alpha
• Marianas forced off in late 2009 after hurricane
damage
• Replaced early 2010 by Deepwater Horizon
• Described as “the well from hell”
3
21/08/2013
The well
Drilling Margin
• Three factors to consider
• Pore pressure
– Formation pressure acting in on the hole
• Fracture gradient
– Point at which rock breaks with mud pressure
• Equivalent Circulating Density
– Extra pressure due to mud pump pressure
4
21/08/2013
Drilling the well
5
21/08/2013
Well Design
March 8th Dress Rehearsal
• On March 8th there was a kick (influx of hydrocarbon)
• The kick was detected late
– There were crane operations at the time
– The Sperry-Sun mud-logger was not believed
•
•
•
•
•
The well was shut in successfully
Recovery required a sidetrack
Costs including rig time exceeded $10M
No MIA report was made to London
The same crew was also on board on 20th April
6
21/08/2013
Temporary Abandonment April
• Original plan to have a keeper well – to be completed
for production at a later date
• The well ran out of drilling margin at 18360 ft
• Formation pressure 16,800 psi -1150 bar
• They drilled on to get below the pay-zone
• An initial plan was produced on April 12th
• Feedback was that a pressure test for integrity was
missing
• The decision to set the lockdown sleeve was retained
• The temporary cement plug was to be set in seawater
Sequence of abandonment plans
7
21/08/2013
Procedure for temporary abandonment of
the well
Cementing the well
•
•
•
•
•
•
•
Run long string 7” casing
Centralize production casing to avoid channelling
Clean out the well – bottoms up
Convert float collar
Pump spacer
Pump nitrogen foamed cement
Test well integrity
– Positive pressure test
– Negative pressure test
8
21/08/2013
Centralizers
• Centralizers are necessary to ensure the
annulus is constant, otherwise cement leaves
mud behind allowing the possibility of
hydrocarbon escaping through the mud
• Halliburton ran its Opticem software and
recommended 21 centralizers
• BP eventually ran with 6 without consulting
Halliburton
9
21/08/2013
Centralizers on the rig,
but not used
Cleaning the well
• A well needs to be cleaned by circulating mud
• Circulation also breaks gel that sets if the mud
is left alone
• Ideal and standard is 1x or 1.5x bottoms up
• Extra pumping adds pressure as an increase in
ECD
• BP rejected the Halliburton recommendation
to run a full bottoms up
10
21/08/2013
Float Collar
• A float collar is a two-way valve that can be
converted to a one-way valve to ensure the
cement does not flow back up the casing (Utubing)
• The float collar has to be converted with a
sufficient flow rate of mud
• This was never achieved, but conversion was
accepted because of the high pressure applied
to the float collar (3142 psi)
11
21/08/2013
12
21/08/2013
Debris in the shoe
Description of Event – Placement of Cement
Choke
Boost
April 19th – 20th
• 19:30 – 00:30 - Cement job pumped as planned.
• 60 bbls cement
• Foamed cement used to reduce risk of losses
• 6 inline centralizers were spaced across the
main pay
• 00:35 – 7:00 – Seal assembly installed and pressure
tested, but not locked down to wellhead. Proceeded
to preparation for positive casing test.
• ~7:30 – Decision made not to run Cement Bond Log
(CBL) premised on minimal losses and lift pressures
observed during cement displacement.
Kill
BOP
Sea Floor
Cement
Mud
Spacer
Seawater
14.17ppg
SOBM
Influx
Shoe – 17,168’
Cement
TOC – 17,260’
FC – 18,115’
Top of
Cement
17260’
14.0ppg
13.1ppg
12.6ppg
12.6ppg
Primary reservoir sands
12.6ppg
Shoe – 18,304’
BP Confidential: Horizon Investigation Update
26
13
21/08/2013
Pressure Test
• Positive pressure test to ascertain if the casing
above the plugs will hold
– Overbalance the well (i.e. pump up from above)
• Negative pressure test to ascertain whether the
cement barrier is effective
– Underbalance the well by removing mud and
replacing it with sea-water (pump out from above)
– If the well is safe then there should be no change in
pressure through the BOP
– Proposal in MMS plan to measure on kill line rather
than drill-pipe
Description of Event - Positive Pressure Test
2700
PSI
Choke
Boost
April 20th
Kill
Drill pipe
Closed
Blind Ram
BOP
BOP
Sea Floor
• 7:00 – 12:00 - Successful positive pressure test for
production casing and seal assembly.
–Low Pressure 250 psi
–High Pressure 2700 psi
• Note: The positive test is not designed to verify
integrity of the shoe track (cement and float collar).
Cement
Mud
Spacer
Seawater
2700 psi
Influx
14.17ppg
SOBM
Shoe – 17,168’
TOC – 17,260’
FC – 18,115’
14.0ppg
13.1ppg
12.6ppg
12.6ppg
Primary reservoir sands
12.6ppg
Shoe – 18,304’
BP Confidential: Horizon Investigation
Update
28
14
21/08/2013
Negative Pressure Test
First Negative Pressure test
15
21/08/2013
Second Negative Pressure test
Description of Event - Negative Pressure Test
1400
PSI
Choke
Boost
0
PSI
Kill
Closed
Annular BOP
Drill pipe
BOP
Sea Floor
Viscous
Spacer
Cement
Mud
Seawater
Spacer
Seawater
Influx
14.17ppg
SOBM
FC – 18,115’
• 15:04 – 15:56 – Displaced mud with sea water to
underbalance the well.
• 15:56 – 16:53 – Spacer inadvertently placed across
the BOP due to leaking annular.
• 16:53 – 17:52 – Test started by monitoring pressure
on drill pipe.
• 17:52 – 19:55 – Negative pressure test procedure
switched to monitor pressure on kill line.
– No pressure and no flow observed on the kill
line
– 1400 psi observed on the drill pipe
• 19:55 –
Shoe – 17,168’
TOC – 17,260’
April 20th
• Negative test designed to verify integrity of seal
assembly, casing, and shoe track in an underbalanced
condition. This simulates conditions for T&A and rig
demobilization.
• 12:00 – 15:04 - Reviewed displacement procedure
and commenced preparation for negative test.
Test was concluded to be successful.
14.0ppg
13.1ppg
12.6ppg
12.6ppg
Primary reservoir sands
12.6ppg
Shoe – 18,304’
BP Confidential: Horizon Investigation
Update
32
16
21/08/2013
Description of Event - Initial Recognition of Abnormal Well Conditions
Choke
Boost
Kill
Hydrocarbon
Influx above
BOP
Seawater
BOP
Sea Floor
April 20th
Note: the following details are largely based on
interpretation of data and witness statements:
• 21:31 – After completely displacing the spacer out of
the riser, the pumps were shut down.
• 21:31 – 21:34 – Rig crew discussed abnormal drill
pipe pressure increase.
Mud
• 21:36 – Rig crew bled the drill pipe to investigate the
abnormal pressure.
Spacer
• 21:38 – Hydrocarbons began to enter riser.
Cement
Seawater
• 21:40 – Mud overflowed the flow-line and onto rig.
• 21:41 – Mud shot up through the derrick. Rig crew
diverted to the mud gas separator (MGS) and shut the
annular BOP.
21:41
Influx
Shoe – 17,168’
TOC – 17,260’
14.0ppg
13.1ppg
12.6ppg
FC – 18,115’
12.6ppg
Primary reservoir sands
12.6ppg
Shoe – 18,304’
BP Confidential: Horizon Investigation
Update
33
Kick detection
17
21/08/2013
18
21/08/2013
12” Vent
6” Vacuum
Breaker
Bursting Disk
M GS
Rated to 60 psi
Rotary
Hose
M ud
System
IBOP
Hydrocarbons routed
to MGS
Port
Overboard
Starboard
Overboard
Diverter
Flow Line
Diverter Line
Slip Joint
Boost
Diverter overboard
lines closed
MGS vented to
manned and
hazardous areas
Starboard
Overboard
Rated to 100 or 500 psi
Kill
Choke
BOP
System quickly
overwhelmed by
pressure and volume,
leading to loss of
containment
19
21/08/2013
Blowout Preventer (BOP)
Emergency Disconnect System (EDS)
20
21/08/2013
What was the immediate cause of the
blowout?
• Most common explanation in terms of failure of
cement to provide an adequate barrier
– But see an alternative explanation
• With low expectations of a kick during abandonment
(rather than during ordinary drilling) small and slow
moving indicators were missed
• Simultaneous operations for discharging together with
major crane activities made observations hard
– The Sperry-Sun mudloggers complained, but to no avail
• Transocean’s emergency structure created problems
with the use of the BOP and detachment from the riser
Shoe Track & Cement
21
21/08/2013
How did this come to pass?
BP 1990 - 2010
• BP was a medium-sized North Sea operator
• 1990 John Browne appointed as CEO BP Exploration and
Production (upstream)
• 1995 Browne appointed CEO British Petroleum
• Sequence of mergers, mostly in USA, to overtake Shell
Group
– Amoco
– Arco
– Burmah-Castrol
• Number of disasters from 2000 onward
– Grangemouth, Texas City, Thunder Horse, Prudhoe Bay
– Market fixing prosecutions in USA
22
21/08/2013
Cost Cutting
• Browne instituted a rigorous discipline of cost-cutting
• This was rated as the cause of problems at both Texas
City and Prudhoe Bay
• Texas City had 2 25% across the board cost reduction
targets prior to the disaster
• The financial community loved Browne – The Sun King
– for his financial discipline – even in an article
published 20th April 2010
• Browne created a company that was loss averse, unlike
its risk averse competitors (Shell and Exxon-Mobil)
• Tony Hayward continued the culture with “Every dollar
counts”
2000 Grangemouth
• Number of major incidents, no fatalities
• Pleaded guilty to criminal charges
23
21/08/2013
Texas City 2005
• BP’s Texas City
refinery had a major
explosion on March
23rd 2005 of the
isomerization plant
• 15 dead, 170 severely injured, >500 wounded
• More than $ 1500 M set aside for compensation
and $ 1000 M for remediation & improvement
• Not including lost production
24
21/08/2013
Thunder Horse 2005
• July 2005, after hurricane
Dennis in the GoM, BP
personnel returned to find
the platform with a 20o list
• Start production in 2008,
instead of original 2006
start-up
• Losses (cost and 2 years lost
revenue) exceeded $10
Billion
Thunder Horse Platform, Gulf of Mexico
BP Alaska Prudhoe Bay
2006
• 2006 a leak of crude (1m litres) from
the North Slope to Valdez pipeline led
to shutting down part of the pipeline
• A second pipeline problem emerged
leading to a major shutdown of
production
• Production losses were 400,000 bbl/day
– Total 50,000,000 bbl ($3 Billion)
• Reputation damage increased with 2nd closure
• Scrutiny from US Congress
• Fatality Nov 13
25
21/08/2013
Issues
• Personal vs Process safety
– Stop the Job
– Workforce did not see process safety issues as
relevant (more about environment than safety)
• The contracts and safety responsibility
– Bridging documents
– Exclusion clauses
• Foamed cement slurry stability
• 1st and 2nd line kick detection
Hypothesis – they blew the bottom off it
• Proposal – backed up by logging from relief wells
– Discussed by Chief Counsel but rejected for no reason
• The bottom part of the casing , shoe track, was buckled or
sheared
• Transient block load of 140,000 lb (reported as 10,000) on
final running of production casing
– Evidence from Sperry-Sun recording of block load
– This is ± 70 tonnes (about 3 double-decker busses)
• Consequence that the cement never got near the payzone
– Made blowout inevitable if the float collar failed
– We know the annulus cement worked
26
21/08/2013
How did this come to pass?
•
•
•
•
•
Changes in well design
Abandonment plan
Lack of management of change
Lack of formal risk management
Lack of requirements for risk management
27
21/08/2013
Risk Assessments
• The risk of catastrophic loss of containment was
recognized as #1 at the Group level (London) and
SPU level (Houston)
• This was driven partly by downstream major
incidents (Texas City, Grangemouth, Prudhoe Bay)
• Macondo was downgraded from high to
moderate
• Kicks were downgraded from catastrophic loss of
containment as consequence
BP Group Risk Register
28
21/08/2013
No Drilling Surprises
29
21/08/2013
Design
• Beyond the Best, Drilling and Well Operations
Plan (DWOP) systems in place in GoM Drilling
and Completions
• gHSSEr old SMS was replaced after Texas City
by OMS (Operations Management System)
OMS
• OMS was designed after Texas City as the solution
to BP’s Process Safety management problems
• Design started 2005, completed 2007
• Rollout late 2009 with USA as first wave
• Local OMS (LOMS) to be defined for specific
operations
• BP assets (Texas City, Prudhoe Bay, Thunder
Horse) rolled out first
• Later rollout for contractor owned assets starting
2010
30
21/08/2013
The grandfather decision
• Because MC-252 was already under
construction and was planned to be finished
by the time the Local OMS was rolled out BP
decided not to implement the LOMS on the
well and thus not subject it to the risk
management processes it mandated.
• “We decided not to grandfather it in”
Risk decisions
• Numerous risk decisions were made in the
design of the well
• Variances from technical standards were
approved by the internal technical authority
• These decisions were made by technically
competent engineers in the engineering
department and were subject to review
31
21/08/2013
Additional risk decisions
• The temporary abandonment plan was not
subjected to the same level of risk assessment
and not reviewed at all
• The regulator (MMS) approved the plan in less
than 90 minutes
• There were several changes to the well design
that weren’t subjected to formal management of
change nor any form of formal risk management
• The plan implemented (Ops plan) deviated from
the MMS approved plan
Risk management
• There was no process in place or in operation
requiring and driving formal risk management of
decisions
• There was no management oversight of the
decisions being made by the well team
• The members of the well team did not have the
skills to use the risk management tools provided
by company
• Silos between operations and engineering meant
that each was waiting for the other to initiate risk
assessments
32
21/08/2013
D&C senior engineer
Q. Okay. All right. When you made the decision not to use the
additional centralizers and to reposition this six existing centralizers —
the subs, I believe, that you had on the rig — did you do a written risk
assessment?
A. No, ma'am.
Q. Did you instruct anybody to do a written risk assessment?
A. No, ma'am.
Q. Was the risk register updated in connection with this decision?
A. Not to my knowledge.
Q. All right. And that was ultimately your responsibility, wasn't it?
A. Yes, ma'am.
D&C Well Team Leader
Q. Do you know what the BP risk assessment
tool is, the RAT?
A. Yes.
Q. Do you know how to use it?
A. No.
33
21/08/2013
Drivers
• Press-on-itis
• Infrequent post drilling kicks
• Focus on the next jobs (Nile P&A, Kaskida)
Not weak signals
• Throughout the abandonment process there
were a number of signals and inputs that
provided BP with information that there
decisions were increasing the risk of failure of
the operation
• These were disregarded for a number of
reasons
34
21/08/2013
Example Signals
• The failure to catch the March 8th kick in a
timely fashion was a signal that the well
control process was not as robust as expected
• The communication by the cementers that the
decision not to carry out a full bottoms-up and
the decision not to run all the centralizers
placed the quality of the cement job in
jeopardy
Why were they ignored?
• Lack of formal risk management processes
meant that there was an incomplete
understanding of the potential downsides of
the decisions made
• They had a purely forward looking point of
view that failed to take account of their
previous decisions that increased the overall
risk
35
21/08/2013
FIDO
• “I’m afraid we’ve blown something higher up
in the casing string.” (Well Site Leader)
• In the words of the Chief Counsel’s report,
“the rig crew proceeded onward”.
Did they take safety seriously?
• About 100 STOP cards were issued every day
• March 29th A dropped winch handle was found on the
rig floor
– 2 hour shutdown, team flown out specially
• A senior management visit to the rig was on the rig
when it blew out
– Including BP and Transocean VPs
• The problem was safety was seen as personal, rather
than personal + process safety
– A fire on March 28th had no equivalent response
– BP used the word Integrity rather than safety for processes
36
21/08/2013
Production
Safety Management System (SMS)
Better defenses
converted to increased
production
Protection
37
21/08/2013
Safety Management System (SMS)
Production
Best practice
operations
under SMS
Protection
Bly Report Swiss Cheese Picture
38
21/08/2013
The Court Case - MDL 2179
Magistrate Judge Sally Sushan
Federal Judge Carl J. Barbier
MDL 2179
• A large number of parties in civil litigation
–
–
–
–
–
–
–
–
Plaintiffs (300,000 + in Plaintiffs’ Steering Committee)
US Department of Justice
Louisiana, Alabama (Florida & Mississipi later)
BP
Transocean
Halliburton
MI-Swaco
Cameron Iron works
• Separate from Criminal prosecutions
– BP & Transocean pleaded guilty (only prosecutions)
39
21/08/2013
Plexus Industrial Safety Lecture Series
Hosted by the Industrial Psychology Research Centre
University of Aberdeen
Details of previous Plexus lectures:
2012 Professor Stanton ‘Forensic Human Factors: Ladbroke Rail Crash’
2011 Dr Mica Endsley ‘Situation Awareness: Research and Design’
2010 Professor Erik Hollnagel ‘Resilience Engineering’
can be found on: www.abdn.ac.uk/iprc
40