This report examines the causes of the blowout of the Macondo well that occurred in the Gulf of Mexico on April 20, 2010, and provides a series of recommendations, for both the oil and gas industry and government regulators, intended to reduce the likelihood and impact of any future losses of well control during offshore drilling. The report presents the consensus view of a committee of 15 experts convened by the National Academy of Engineering (NAE), operating through the National Research Council (NRC), in response to a request from the Secretary of the U.S. Department of the Interior (DOI). The report has been subjected to a peer review in accordance with NAE–NRC procedures.
The areas of expertise of the 15 members spanned geophysics, petroleum engineering, marine systems, accident investigations, safety systems, risk analysis, human factors, and organizational behavior. This breadth of expertise enabled the committee to address both the immediate and the root causes of the various failures that led to the loss of well control and to provide a unique perspective that should complement those provided by other investigative efforts.
Offshore drilling, especially in deep water,1 is an inherently hazardous activity. Construction of deepwater wells like Macondo is a complex process. Sophisticated equipment is used, such as the Deepwater Horizon drilling rig, which must operate in a highly coordinated manner in areas of uncertain geology, often under challenging environmental conditions, and subject to failures from a variety of sources including those induced by human and organizational errors. The industry has developed an impressive set of technologies to enable the construction of such wells, and it appears that viable solutions were available to address the various challenges posed by Macondo. However, the selection and application of suitable technologies will always be subject to the vagaries of the human decision-making processes, as it was in April 2010 in the Gulf of Mexico.
1For this report, the committee did not identify a specific depth to distinguish between shallow water and deep water. Although various depths have been identified by other organizations as a transition point, depths greater than 1,000 feet are often considered to define deep water.
Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 3
Summary This report examines the causes of the blowout of the Macondo well that occurred in the Gulf of Mexico on April 20, 2010, and provides a series of rec- ommendations, for both the oil and gas industry and government regulators, intended to reduce the likelihood and impact of any future losses of well control during offshore drilling. The report presents the consensus view of a committee of 15 experts convened by the National Academy of Engineering (NAE), operat- ing through the National Research Council (NRC), in response to a request from the Secretary of the U.S. Department of the Interior (DOI). The report has been subjected to a peer review in accordance with NAE–NRC procedures. The areas of expertise of the 15 members spanned geophysics, petroleum engineering, marine systems, accident investigations, safety systems, risk analy- sis, human factors, and organizational behavior. This breadth of expertise en- abled the committee to address both the immediate and the root causes of the various failures that led to the loss of well control and to provide a unique per- spective that should complement those provided by other investigative efforts. Offshore drilling, especially in deep water,1 is an inherently hazardous ac- tivity. Construction of deepwater wells like Macondo is a complex process. So- phisticated equipment is used, such as the Deepwater Horizon drilling rig, which must operate in a highly coordinated manner in areas of uncertain geology, often under challenging environmental conditions, and subject to failures from a vari- ety of sources including those induced by human and organizational errors. The industry has developed an impressive set of technologies to enable the construc- tion of such wells, and it appears that viable solutions were available to address the various challenges posed by Macondo. However, the selection and applica- tion of suitable technologies will always be subject to the vagaries of the human decision-making processes, as it was in April 2010 in the Gulf of Mexico. 1 For this report, the committee did not identify a specific depth to distinguish be- tween shallow water and deep water. Although various depths have been identified by other organizations as a transition point, depths greater than 1,000 feet are often consid- ered to define deep water. 3
OCR for page 3
4 Macondo Well Deepwater Horizon Blowout The committee believes that material improvements to the management and safety systems used by the companies engaged in offshore oil development, along with enhancements to the regulatory regime, can and should be made, and that such efforts will materially improve all aspects of safety offshore. THE MACONDO WELL–DEEPWATER HORIZON DISASTER The Macondo well is located approximately 50 miles off the coast of Lou- isiana in the Mississippi Canyon region of the Gulf of Mexico. It was intended as an exploratory well, drilled to assess the presence of extractable hydrocarbons and to survey the associated reservoir structures. The well was originally planned for a total depth of 19,650 feet. A decision was made in early April 2010 to halt drilling at a total depth of 18,360 feet and prepare the well for tem- porary abandonment in order to utilize the well later for oil and gas production. According to BP’s accident investigation report, four hydrocarbon zones had been discovered at depths ranging from 17,788 to 18,223 feet (BP 2010, 54). Furthermore, the differences between the highest reservoir pore pressure, which had to be offset by the drilling mud to prevent reservoir fluid flow, and the frac- ture gradients of the formation were becoming very small, leaving little margin for safe drilling. During March and April 2010, the Deepwater Horizon drilling team had encountered both “kicks” (hydrocarbon flows) and lost circulation events2 (due to formation fracturing). This included a lost circulation event on April 4 at a depth of 18,260 feet (BP 2010, 17; Transocean 2011a, I, 20). Temporary abandonment of a well intended to be used for production is a standard practice. It provides the operator time to install the substantial infra- structure needed to transport the recovered hydrocarbons to shore while releas- ing the expensive drilling rig for other activities. Sealing the well to ensure that no hydrocarbon flow occurs is critical to the temporary abandonment process. This is typically done through the use of cemented liners or casings, along with additional cement or mechanical plugs that provide multiple barriers to hydro- carbon flow. The narrow margins between pore pressure and fracture gradient estab- lished a challenging environment for sealing the well. The approach chosen was to use a long-string production casing (9 7 8 7 inches) extending from the sea- floor to the bottom of the well, cemented in place with a low-density, foamed cement slurry (BP 2010, 18; Transocean 2011a, I, 27). During the cementing operation, difficulties were encountered, including those associated with con- verting (closing) check valves on the float collar near the bottom of the casing at 18,115 feet. Nonetheless, the drilling team determined mistakenly that the ce- menting operation had been completed successfully and proceeded to conduct a negative pressure test to establish the integrity of the cemented production cas- ing. A negative pressure test, conducted by displacing some of the heavy drilling 2 Lost circulation is a loss of drilling fluids into the formation.
OCR for page 3
5 Summary mud with lighter seawater and checking for flow, is a standard technique for establishing the integrity of the cemented barrier. Multiple negative pressure tests were made, all of which indicated inconclusive and confusing results (BP 2010, 85; Transocean 2011a, I, 29). However, the team mistakenly determined that the negative pressure test had been conducted successfully and proceeded to abandon the well temporarily by displacing drilling mud with seawater, recover- ing the mud, and discharging overboard the spacer fluid that had been used in previous operations. Various anomalies were noted during this process, starting at roughly 21:00 on April 20. At approximately 21:40, mud was observed flow- ing onto the rig floor and well control actions were initiated, diverting flow to the mud–gas separator and activating the upper annular and upper pipe rams on the blowout preventer (BOP). The procedures taken did not reestablish control over the well. Flammable gas alarms on the Deepwater Horizon sounded at approximately 21:47, followed by two explosions at approximately 21:49. The explosions and resulting fire led to the death of 11 workers and seri- ous injuries to 16 others. The Deepwater Horizon rig sank roughly 36 hours later. Nearly 5 million barrels of oil were released into the Gulf of Mexico (McNutt et al. 2011). COMMITTEE AND ITS TASK In response to a request from the DOI Secretary, NAE and NRC formed a committee to examine the causes of the Deepwater Horizon–Macondo well blowout, explosion, fire, and oil spill and to identify measures for preventing similar incidents in the future. As part of its task, the committee provided an interim letter report to the DOI Secretary on November 16, 2010. That report presented preliminary findings and observations concerning key factors and de- cisions that may have contributed to the blowout of the Macondo well, including engineering, testing, and maintenance procedures; operational oversight; regula- tory procedures; and personnel training and certification. This final report pre- sents the committee’s overall findings with regard to the causes of the disaster and its recommended approaches for improved safety. SUMMARY OF FINDINGS, OBSERVATIONS, AND RECOMMENDATIONS On the basis of its assessment of the evidence collected for this final re- port, the committee has developed the following findings, observations, and recommendations. The sequence in which they are presented is not intended to
OCR for page 3
6 Macondo Well Deepwater Horizon Blowout imply a sense of priority. They are discussed in subsequent chapters of this re- port, along with more detailed findings, observations, and recommendations.3 Summary Findings It is the committee’s assessment that the following findings of facts have been established by the available evidence. 1. The flow of hydrocarbons that led to the blowout of the Macondo well began when drilling mud was displaced by seawater during the temporary abandonment process. (Finding 2.1)4 2. The decision to proceed to displacement of the drilling mud by sea- water was made despite a failure to demonstrate the integrity of the cement job even after multiple negative pressure tests. This was but one of a series of ques- tionable decisions in the days preceding the blowout that had the effect of reduc- ing the margins of safety and that evidenced a lack of safety-driven decision making. (Finding 2.2) 3. The reservoir formation, encompassing multiple zones of varying pore pressures and fracture gradients, posed significant challenges to isolation using casing and cement. The approach chosen for well completion failed to provide adequate margins of safety and led to multiple potential failure mecha- nisms. (Finding 2.3) 4. The loss of well control was not noted until more than 50 minutes af- ter hydrocarbon flow from the formation started, and attempts to regain control by using the BOP were unsuccessful. The blind shear ram failed to sever the drill pipe and seal the well properly, and the emergency disconnect system failed to separate the lower marine riser and the Deepwater Horizon from the well. (Finding 3.1) 5. The BOP system was neither designed nor tested for the dynamic conditions that most likely existed at the time that attempts were made to recap- ture well control. Furthermore, the design, test, operation, and maintenance of the BOP system were not consistent with a high-reliability, fail-safe device. (Finding 3.16) 6. Once well control was lost, the large quantities of gaseous hydrocar- bons released onto the Deepwater Horizon, exacerbated by low wind velocity and questionable venting selection, made ignition all but inevitable. (Finding 4.1) 7. The actions, policies, and procedures of the corporations involved did not provide an effective system safety approach commensurate with the risks of the Macondo well. The lack of a strong safety culture resulting from a defi- 3 A compilation of all the report’s findings, observations, and recommendations is presented in Appendix C. 4 The first digit of a finding, observation, or recommendation refers to a chapter of this report.
OCR for page 3
7 Summary cient overall systems approach to safety is evident in the multiple flawed deci- sions that led to the blowout. Industrial management involved with the Macondo well–Deepwater Horizon disaster failed to appreciate or plan for the safety chal- lenges presented by the Macondo well. (Finding 5.1) Summary Observations During the course of its investigations, the committee made several obser- vations with regard to the processes and procedures used by industry and gov- ernment regulators. 1. While the geologic conditions encountered in the Macondo well posed challenges to the drilling team, alternative completion techniques and operational processes were available that could have been used to prepare the well safely for temporary abandonment. (Observation 2.1) 2. The ability of the oil and gas industry to perform and maintain an in- tegrated assessment of the margins of safety for a complex well like Macondo is impacted by the complex structure of the offshore oil and gas industry and the divisions of technical expertise among the many contractors engaged in the drill- ing effort. (Observation 5.1) 3. The regulatory regime was ineffective in addressing the risks of the Macondo well. The actions of the regulators did not display an awareness of the risks or the very narrow margins of safety. (Observation 6.1) 4. The extent of training of key personnel and decision makers both in industry and in regulatory agencies has been inconsistent with the complexities and risks of deepwater drilling. (Observations 5.5 and 6.2) 5. Overall, neither the companies involved nor the regulatory commu- nity has made effective use of real-time data analysis, information on precursor incidents or near misses, or lessons learned in the Gulf of Mexico and world- wide to adjust practices and standards appropriately. (Observations 5.7 and 6.3) 6. Industry’s and government’s research and development efforts have been focused disproportionately on exploration, drilling, and production tech- nologies as opposed to safety. (Observation 5.8) Summary Recommendations On the basis of its investigation of the Macondo well–Deepwater Horizon disaster and discussions with industry operating in the United States and the North Sea and with regulators from the United States, the Republic of the Mar- shall Islands, Australia, the United Kingdom, and Norway, the committee has developed a series of recommendations that it believes would materially im- prove the safety of future operations in the Gulf of Mexico.
OCR for page 3
8 Macondo Well Deepwater Horizon Blowout 1. Given the critical role that margins of safety play in maintaining well control, guidelines should be established to ensure that the design approach in- corporates protection against the various credible risks associated with the drill- ing and completion processes. (Recommendation 2.1) 2. All primary cemented barriers to flow should be tested to verify qual- ity, quantity, and location of cement. The integrity of primary mechanical barri- ers (such as the float equipment, liner tops, and wellhead seals) should be veri- fied by using the best available test procedures. All tests should have established procedures and predefined criteria for acceptable performance and should be subject to independent, near-real-time review by a competent authority. (Rec- ommendation 2.3) 3. BOP systems should be redesigned to provide robust and reliable cut- ting, sealing, and separation capabilities for the drilling environment to which they are being applied and under all foreseeable operating conditions of the rig on which they are installed. Test and maintenance procedures should be estab- lished to ensure operability and reliability appropriate to their environment of application. Furthermore, advances in BOP technology should be evaluated from the perspective of overall system safety. Operator training for emergency BOP operation should be improved to the point that the full capabilities of a more reliable BOP can be competently and correctly employed when needed in the future. (Recommendation 3.1) 4. Instrumentation and expert system decision aids should be used to provide timely warning of loss of well control to drillers on the rig (and ideally to onshore drilling monitors as well). If the warning is inhibited or not addressed in an appropriate time interval, autonomous operation of the blind shear rams, emergency disconnect system, general alarm, and other safety systems on the rig should occur. (Recommendations 3.5 and 4.1) 5. Efforts to reduce the probability of future blowouts should be com- plemented by capabilities of mitigating the consequences of a loss of well con- trol. Industry should ensure timely access to demonstrated well-capping and containment capabilities. (Recommendation 5.6) 6. The United States should fully implement a hybrid regulatory system that incorporates a limited number of prescriptive elements into a proactive, goal-oriented risk management system for health, safety, and the environment. (Recommendation 6.1) 7. The Bureau of Safety and Environmental Enforcement (BSEE) of the U.S. Department of the Interior and other regulators should identify and enforce safety-critical points during well construction and abandonment that warrant explicit regulatory review and approval before operations can proceed. (Rec- ommendation 6.6) 8. A single U.S. government agency should be designated with respon- sibility for ensuring an integrated approach for system safety for all offshore drilling activities. (Recommendation 6.15) 9. Operating companies should have ultimate responsibility and ac- countability for well integrity, because only they are in a position to have visibil-
OCR for page 3
9 Summary ity into all its aspects. Operating companies should be held responsible and ac- countable for well design, well construction, and the suitability of the rig and associated safety equipment. Notwithstanding the above, the drilling contractor should be held responsible and accountable for the operation and safety of the offshore equipment. (Recommendations 5.1 and 6.20) 10. Industry should greatly expand R&D efforts focused on improving the overall safety of offshore drilling in the areas of design, testing, modeling, risk assessment, safety culture, and systems integration. Such efforts should en- compass well design, drilling and marine equipment, human factors, and man- agement systems. These endeavors should be conducted to benefit the efforts of industry and government to instill a culture of safety. (Recommendation 5.2) 11. Industry, BSEE, and other regulators should undertake efforts to ex- pand significantly the formal education and training of personnel engaged in offshore drilling to support proper implementation of system safety. (Recom- mendations 5.3 and 6.23) 12. Industry, BSEE, and other regulators should improve corporate and industrywide systems for reporting safety-related incidents. Reporting should be facilitated by enabling anonymous or “safety privileged” inputs. Corporations should investigate all such reports and disseminate their lessons-learned findings in a timely manner to all their operating and decision-making personnel and to the industry as a whole. A comprehensive lessons-learned repository should be maintained for industrywide use. This information can be used for training in accident prevention and continually improving standards. (Recommendations 5.4 and 6.14) 13. Industry, BSEE, and other regulators should foster an effective safety culture through consistent training, adherence to principles of human factors, system safety, and continued measurement through leading indicators. (Recom- mendations 5.5 and 6.25) On the basis of the available evidence, the committee has identified the principal causes of the incident, as summarized above and described in the re- port in greater detail. Certain factors, such as the complete hydrocarbon flow path, may never be definitively identified, since the requisite forensic evidence lies more than 2 miles beneath the seabed. Similarly, many questions concerning the Deepwater Horizon rig will remain unanswerable so long as it lies on the bottom of the Gulf of Mexico, with its equipment unavailable for inspection and data recorders unreadable. Furthermore, the loss of several of the workers in- volved in the pivotal decisions on the Deepwater Horizon limits inquiry into the causes and rationale involved in those decisions. Even so, the committee be- lieves that it was able to identify and assess the principal direct and root causes of the incident and develop a series of recommendations that would provide suitable and cost-effective corrective actions, materially reducing the likelihood of a similar event in the future.