This report examines the causes of the blowout of the Macondo well that occurred in the Gulf of Mexico on April 20, 2010, and provides a series of recommendations, for both the oil and gas industry and government regulators, intended to reduce the likelihood and impact of any future losses of well control during offshore drilling. The report presents the consensus view of a committee of 15 experts convened by the National Academy of Engineering (NAE), operating through the National Research Council (NRC), in response to a request from the Secretary of the U.S. Department of the Interior (DOI). The report has been subjected to a peer review in accordance with NAE–NRC procedures.
The areas of expertise of the 15 members spanned geophysics, petroleum engineering, marine systems, accident investigations, safety systems, risk analysis, human factors, and organizational behavior. This breadth of expertise enabled the committee to address both the immediate and the root causes of the various failures that led to the loss of well control and to provide a unique perspective that should complement those provided by other investigative efforts.
Offshore drilling, especially in deep water,1 is an inherently hazardous activity. Construction of deepwater wells like Macondo is a complex process. Sophisticated equipment is used, such as the Deepwater Horizon drilling rig, which must operate in a highly coordinated manner in areas of uncertain geology, often under challenging environmental conditions, and subject to failures from a variety of sources including those induced by human and organizational errors. The industry has developed an impressive set of technologies to enable the construction of such wells, and it appears that viable solutions were available to address the various challenges posed by Macondo. However, the selection and application of suitable technologies will always be subject to the vagaries of the human decision-making processes, as it was in April 2010 in the Gulf of Mexico.
1For this report, the committee did not identify a specific depth to distinguish between shallow water and deep water. Although various depths have been identified by other organizations as a transition point, depths greater than 1,000 feet are often considered to define deep water.
The committee believes that material improvements to the management and safety systems used by the companies engaged in offshore oil development, along with enhancements to the regulatory regime, can and should be made, and that such efforts will materially improve all aspects of safety offshore.
THE MACONDO WELL–DEEPWATER HORIZON DISASTER
The Macondo well is located approximately 50 miles off the coast of Louisiana in the Mississippi Canyon region of the Gulf of Mexico. It was intended as an exploratory well, drilled to assess the presence of extractable hydrocarbons and to survey the associated reservoir structures. The well was originally planned for a total depth of 19,650 feet. A decision was made in early April 2010 to halt drilling at a total depth of 18,360 feet and prepare the well for temporary abandonment in order to utilize the well later for oil and gas production. According to BP’s accident investigation report, four hydrocarbon zones had been discovered at depths ranging from 17,788 to 18,223 feet (BP 2010, 54). Furthermore, the differences between the highest reservoir pore pressure, which had to be offset by the drilling mud to prevent reservoir fluid flow, and the fracture gradients of the formation were becoming very small, leaving little margin for safe drilling. During March and April 2010, the Deepwater Horizon drilling team had encountered both “kicks” (hydrocarbon flows) and lost circulation events2 (due to formation fracturing). This included a lost circulation event on April 4 at a depth of 18,260 feet (BP 2010, 17; Transocean 2011a, I, 20).
Temporary abandonment of a well intended to be used for production is a standard practice. It provides the operator time to install the substantial infrastructure needed to transport the recovered hydrocarbons to shore while releasing the expensive drilling rig for other activities. Sealing the well to ensure that no hydrocarbon flow occurs is critical to the temporary abandonment process. This is typically done through the use of cemented liners or casings, along with additional cement or mechanical plugs that provide multiple barriers to hydrocarbon flow.
The narrow margins between pore pressure and fracture gradient established a challenging environment for sealing the well. The approach chosen was to use a long-string production casing (9 ⅞ × 7 inches) extending from the seafloor to the bottom of the well, cemented in place with a low-density, foamed cement slurry (BP 2010, 18; Transocean 2011a, I, 27). During the cementing operation, difficulties were encountered, including those associated with converting (closing) check valves on the float collar near the bottom of the casing at 18,115 feet. Nonetheless, the drilling team determined mistakenly that the cementing operation had been completed successfully and proceeded to conduct a negative pressure test to establish the integrity of the cemented production casing. A negative pressure test, conducted by displacing some of the heavy drilling
2Lost circulation is a loss of drilling fluids into the formation.
mud with lighter seawater and checking for flow, is a standard technique for establishing the integrity of the cemented barrier. Multiple negative pressure tests were made, all of which indicated inconclusive and confusing results (BP 2010, 85; Transocean 2011a, I, 29). However, the team mistakenly determined that the negative pressure test had been conducted successfully and proceeded to abandon the well temporarily by displacing drilling mud with seawater, recovering the mud, and discharging overboard the spacer fluid that had been used in previous operations. Various anomalies were noted during this process, starting at roughly 21:00 on April 20. At approximately 21:40, mud was observed flowing onto the rig floor and well control actions were initiated, diverting flow to the mud–gas separator and activating the upper annular and upper pipe rams on the blowout preventer (BOP).
The procedures taken did not reestablish control over the well. Flammable gas alarms on the Deepwater Horizon sounded at approximately 21:47, followed by two explosions at approximately 21:49.
The explosions and resulting fire led to the death of 11 workers and serious injuries to 16 others. The Deepwater Horizon rig sank roughly 36 hours later. Nearly 5 million barrels of oil were released into the Gulf of Mexico (McNutt et al. 2011).
COMMITTEE AND ITS TASK
In response to a request from the DOI Secretary, NAE and NRC formed a committee to examine the causes of the Deepwater Horizon–Macondo well blowout, explosion, fire, and oil spill and to identify measures for preventing similar incidents in the future. As part of its task, the committee provided an interim letter report to the DOI Secretary on November 16, 2010. That report presented preliminary findings and observations concerning key factors and decisions that may have contributed to the blowout of the Macondo well, including engineering, testing, and maintenance procedures; operational oversight; regulatory procedures; and personnel training and certification. This final report presents the committee’s overall findings with regard to the causes of the disaster and its recommended approaches for improved safety.
SUMMARY OF FINDINGS, OBSERVATIONS, AND RECOMMENDATIONS
On the basis of its assessment of the evidence collected for this final report, the committee has developed the following findings, observations, and recommendations. The sequence in which they are presented is not intended to
imply a sense of priority. They are discussed in subsequent chapters of this report, along with more detailed findings, observations, and recommendations.3
It is the committee’s assessment that the following findings of facts have been established by the available evidence.
2. The decision to proceed to displacement of the drilling mud by seawater was made despite a failure to demonstrate the integrity of the cement job even after multiple negative pressure tests. This was but one of a series of questionable decisions in the days preceding the blowout that had the effect of reducing the margins of safety and that evidenced a lack of safety-driven decision making. (Finding 2.2)
3. The reservoir formation, encompassing multiple zones of varying pore pressures and fracture gradients, posed significant challenges to isolation using casing and cement. The approach chosen for well completion failed to provide adequate margins of safety and led to multiple potential failure mechanisms. (Finding 2.3)
4. The loss of well control was not noted until more than 50 minutes after hydrocarbon flow from the formation started, and attempts to regain control by using the BOP were unsuccessful. The blind shear ram failed to sever the drill pipe and seal the well properly, and the emergency disconnect system failed to separate the lower marine riser and the Deepwater Horizon from the well. (Finding 3.1)
5. The BOP system was neither designed nor tested for the dynamic conditions that most likely existed at the time that attempts were made to recapture well control. Furthermore, the design, test, operation, and maintenance of the BOP system were not consistent with a high-reliability, fail-safe device. (Finding 3.16)
6. Once well control was lost, the large quantities of gaseous hydrocarbons released onto the Deepwater Horizon, exacerbated by low wind velocity and questionable venting selection, made ignition all but inevitable. (Finding 4.1)
7. The actions, policies, and procedures of the corporations involved did not provide an effective system safety approach commensurate with the risks of the Macondo well. The lack of a strong safety culture resulting from a defi-
3A compilation of all the report’s findings, observations, and recommendations is presented in Appendix C.
4The first digit of a finding, observation, or recommendation refers to a chapter of this report.
cient overall systems approach to safety is evident in the multiple flawed decisions that led to the blowout. Industrial management involved with the Macondo well–Deepwater Horizon disaster failed to appreciate or plan for the safety challenges presented by the Macondo well. (Finding 5.1)
During the course of its investigations, the committee made several observations with regard to the processes and procedures used by industry and government regulators.
1. While the geologic conditions encountered in the Macondo well posed challenges to the drilling team, alternative completion techniques and operational processes were available that could have been used to prepare the well safely for temporary abandonment. (Observation 2.1)
2. The ability of the oil and gas industry to perform and maintain an integrated assessment of the margins of safety for a complex well like Macondo is impacted by the complex structure of the offshore oil and gas industry and the divisions of technical expertise among the many contractors engaged in the drilling effort. (Observation 5.1)
3. The regulatory regime was ineffective in addressing the risks of the Macondo well. The actions of the regulators did not display an awareness of the risks or the very narrow margins of safety. (Observation 6.1)
4. The extent of training of key personnel and decision makers both in industry and in regulatory agencies has been inconsistent with the complexities and risks of deepwater drilling. (Observations 5.5 and 6.2)
5. Overall, neither the companies involved nor the regulatory community has made effective use of real-time data analysis, information on precursor incidents or near misses, or lessons learned in the Gulf of Mexico and worldwide to adjust practices and standards appropriately. (Observations 5.7 and 6.3)
6. Industry’s and government’s research and development efforts have been focused disproportionately on exploration, drilling, and production technologies as opposed to safety. (Observation 5.8)
On the basis of its investigation of the Macondo well–Deepwater Horizon disaster and discussions with industry operating in the United States and the North Sea and with regulators from the United States, the Republic of the Marshall Islands, Australia, the United Kingdom, and Norway, the committee has developed a series of recommendations that it believes would materially improve the safety of future operations in the Gulf of Mexico.
1. Given the critical role that margins of safety play in maintaining well control, guidelines should be established to ensure that the design approach incorporates protection against the various credible risks associated with the drilling and completion processes. (Recommendation 2.1)
2. All primary cemented barriers to flow should be tested to verify quality, quantity, and location of cement. The integrity of primary mechanical barriers (such as the float equipment, liner tops, and wellhead seals) should be verified by using the best available test procedures. All tests should have established procedures and predefined criteria for acceptable performance and should be subject to independent, near-real-time review by a competent authority. (Recommendation 2.3)
3. BOP systems should be redesigned to provide robust and reliable cutting, sealing, and separation capabilities for the drilling environment to which they are being applied and under all foreseeable operating conditions of the rig on which they are installed. Test and maintenance procedures should be established to ensure operability and reliability appropriate to their environment of application. Furthermore, advances in BOP technology should be evaluated from the perspective of overall system safety. Operator training for emergency BOP operation should be improved to the point that the full capabilities of a more reliable BOP can be competently and correctly employed when needed in the future. (Recommendation 3.1)
4. Instrumentation and expert system decision aids should be used to provide timely warning of loss of well control to drillers on the rig (and ideally to onshore drilling monitors as well). If the warning is inhibited or not addressed in an appropriate time interval, autonomous operation of the blind shear rams, emergency disconnect system, general alarm, and other safety systems on the rig should occur. (Recommendations 3.5 and 4.1)
5. Efforts to reduce the probability of future blowouts should be complemented by capabilities of mitigating the consequences of a loss of well control. Industry should ensure timely access to demonstrated well-capping and containment capabilities. (Recommendation 5.6)
6. The United States should fully implement a hybrid regulatory system that incorporates a limited number of prescriptive elements into a proactive, goal-oriented risk management system for health, safety, and the environment. (Recommendation 6.1)
7. The Bureau of Safety and Environmental Enforcement (BSEE) of the U.S. Department of the Interior and other regulators should identify and enforce safety-critical points during well construction and abandonment that warrant explicit regulatory review and approval before operations can proceed. (Recommendation 6.6)
8. A single U.S. government agency should be designated with responsibility for ensuring an integrated approach for system safety for all offshore drilling activities. (Recommendation 6.15)
9. Operating companies should have ultimate responsibility and accountability for well integrity, because only they are in a position to have visibil-
ity into all its aspects. Operating companies should be held responsible and accountable for well design, well construction, and the suitability of the rig and associated safety equipment. Notwithstanding the above, the drilling contractor should be held responsible and accountable for the operation and safety of the offshore equipment. (Recommendations 5.1 and 6.20)
10. Industry should greatly expand R&D efforts focused on improving the overall safety of offshore drilling in the areas of design, testing, modeling, risk assessment, safety culture, and systems integration. Such efforts should encompass well design, drilling and marine equipment, human factors, and management systems. These endeavors should be conducted to benefit the efforts of industry and government to instill a culture of safety. (Recommendation 5.2)
11. Industry, BSEE, and other regulators should undertake efforts to expand significantly the formal education and training of personnel engaged in offshore drilling to support proper implementation of system safety. (Recommendations 5.3 and 6.23)
12. Industry, BSEE, and other regulators should improve corporate and industrywide systems for reporting safety-related incidents. Reporting should be facilitated by enabling anonymous or “safety privileged” inputs. Corporations should investigate all such reports and disseminate their lessons-learned findings in a timely manner to all their operating and decision-making personnel and to the industry as a whole. A comprehensive lessons-learned repository should be maintained for industrywide use. This information can be used for training in accident prevention and continually improving standards. (Recommendations 5.4 and 6.14)
13. Industry, BSEE, and other regulators should foster an effective safety culture through consistent training, adherence to principles of human factors, system safety, and continued measurement through leading indicators. (Recommendations 5.5 and 6.25)
On the basis of the available evidence, the committee has identified the principal causes of the incident, as summarized above and described in the report in greater detail. Certain factors, such as the complete hydrocarbon flow path, may never be definitively identified, since the requisite forensic evidence lies more than 2 miles beneath the seabed. Similarly, many questions concerning the Deepwater Horizon rig will remain unanswerable so long as it lies on the bottom of the Gulf of Mexico, with its equipment unavailable for inspection and data recorders unreadable. Furthermore, the loss of several of the workers involved in the pivotal decisions on the Deepwater Horizon limits inquiry into the causes and rationale involved in those decisions. Even so, the committee believes that it was able to identify and assess the principal direct and root causes of the incident and develop a series of recommendations that would provide suitable and cost-effective corrective actions, materially reducing the likelihood of a similar event in the future.