The offshore drilling industry has made tremendous technological strides since a freestanding structure for drilling was built in 1937 in the Gulf of Mexico in 14 feet of water, more than a mile offshore.1 Ten years later, the first productive well located out of sight of land was drilled from a fixed platform located 10.5 miles off the Louisiana coast. During the 1950s, drilling rigs with mobile platforms, “jacked up” out of the water by supporting legs resting on the seafloor, were able to drill into water depths exceeding 100 feet. By 1957, 23 drilling units were operating in the gulf.
Mobile offshore drilling units (MODUs) allowed for drilling while floating in place without the use of supporting legs. The first drillship was introduced in the 1950s; the first semisubmersible rig was introduced in the early 1960s. Semisubmersible rigs on location are designed to have a larger proportion of their mass and structure below the water surface for greater stability against wind and waves.
Use of MODUs in deeper water required operations that were more complex than those practiced on fixed platform rigs. For example, longer and heavier riser systems were needed for the transfer of fluids between the rig and the seafloor. Also, the operation and maintenance of the blowout preventer (BOP) system2 on the seafloor became more difficult under the harsh conditions directly at the seafloor.3
Continued advances in geologic exploration techniques, well designs, and recording of key geologic information enabled drilling operations to expand into
1 This overview of the technological advances in offshore drilling is based on information provided in the final report of the Presidential Commission (2011) and the references cited therein. See Chief Counsel (2011) for background information and illustrations on offshore drilling operations.
3 Jackup rigs typically use surface BOP systems. However, floating rigs have used surface BOP systems only sparingly.
deeper water. For example, in the 1960s digital sound recording and processing greatly enhanced the quality and interpretability of seismic data. In the 1970s advances were made in digital, three-dimensional seismic imaging, and in the 1980s use of computer workstations enabled faster processing of the data generated in geologic surveys. Those and other technological advances dramatically enhanced industry’s accuracy in locating productive wells. Improved accuracy was a critical factor, given the multimillion dollar cost of drilling an individual well in deep water. Between 1985 and 1997, the success rate of offshore exploratory wells for the major companies in the United States increased from 36 to 51 percent (EIA 2008).
New generations of rigs were developed that enabled drilling at water depths of 5,000 to 10,000 feet, and from 20,000 to 30,000 feet of subseafloor depth. Advanced drilling techniques allowed the direction of an individual well to be changed from vertical to horizontal for greater adaptability to geologic conditions. Techniques were also developed to obtain information (such as position, temperature, pressure, and porosity data) from within the borehole while the well was being drilled.
By 1990, most of the oil and gas from the Gulf of Mexico came from wells drilled through an average production-weighted depth of about 250 feet of water. By 1998, the average production-weighted depth of water was greater than 1,000 feet. At that point, deepwater production (at about 700,000 barrels of oil and 2 billion cubic feet of gas per day) surpassed that from shallow water for the first time.
Global deepwater production capacity increased by more than threefold from 2000 to 2009 (from 1.5 million barrels per day in water depths over 2,000 feet to more than 5 million barrels per day). In 2008, total oil and gas discovered in deep water globally exceeded the volume found onshore and in shallow water combined.
Geologic structures beneath the deep water4 of the Gulf of Mexico provide a harsh and unpredictable environment of high-temperature and high-pressure hydrocarbon reservoirs that typically contain significant amounts of dissolved natural gas. These factors require additional precautions in the design and construction of wells.
The formation fracture pressure (the pressure at which a hydraulic fracture forms at the wellbore and propagates out into the formation) usually increases
4 For this report, the committee did not identify a specific depth to distinguish between shallow water and deep water. Although various depths have been identified by other organizations as a transition point, depths greater than 1,000 feet are often considered to define deep water.
with depth, as does the pore pressure (the pressure exerted by the saline water or hydrocarbons in the pore space of rock).5 Rig personnel use dense fluids during drilling (i.e., drilling mud) and different types of barriers inside the well after drilling to control subsurface pressure and prevent unintended hydrocarbon flow from geologic formations into the wellbore.
As the well is being drilled, drilling mud is pumped into the drill pipe connected to a drill bit. Mud flows out of nozzles in the bit and then circulates back to the rig through the space between the drill pipe and the sides of the well (the annular space), carrying away cutting debris and cooling and lubricating the bit and wellbore. In addition, drilling mud is used to control pressures inside the wellbore.
The pore fluids are contained in the reservoir rock by using the weight of a column of drilling mud to create hydrostatic pressure at the reservoir that is higher than the pore pressure. The crew monitors and adjusts the mud weight to keep the pressure exerted by the mud inside the wellbore between the pore pressure and the fracture pressure. Should the mud weight be lower than the pore pressure, an undesired flow of reservoir fluids will enter the wellbore (an event known as a kick). If a kick occurs, a blowout could result if proper well control procedures are not followed.
As the well is drilled deeper, an increase in the mud weight may be necessary to prevent kicks. However, the mud weight must not be so high that the hydrostatic pressure in the wellbore exceeds the fracturing pressure of the exposed rock at any point in the wellbore. If a fracture occurs, drilling mud will flow out of the well into the geologic formation so that mud returns are lost instead of circulating back to the surface. Should lost circulation occur, drilling cannot be continued until the mud losses are stopped. Severe lost circulation can cause the pressure in the well to become too low to prevent reservoir fluids from entering the wellbore. The well may also become unstable and collapse.
The fracture pressure and pore pressure can be difficult to predict in advance of drilling the well, and some formations in the Gulf of Mexico have pore pressures and fracture gradients that can be either higher or lower than anticipated. The pore pressure can be close to the fracture pressure, as was seen in drilling the Macondo well, presenting a substantial challenge to the overall safety of the drilling operation (see Chapter 2).
For cases where the pore pressure is close to the fracture pressure, which is common in the deep water of the Gulf of Mexico, attention is paid to any increases in well pressure that might be caused by drill pipe movement or pumping fluids. Each of these factors can cause the pressure in the wellbore to exceed the fracture pressure, creating well control problems such as lost circulation and possibly a kick.
5 Additional information about designing and constructing offshore wells is given by sources such as Maclachlan (2007), Bommer (2008), and Zoback (2010).
Shallower formations left exposed in the wellbore may not be capable of withstanding the growing pressure caused by increased mud weight and could hydraulically fracture. When drilling mud can no longer be relied on for primary well control, the crew stops drilling and installs steel casing into the wellbore to protect the shallower, weaker formations. A casing string is composed of sections of steel pipe that are screwed together. The bottom portion of the casing string is sealed by pumping a cement slurry down the casing and out into the annulus. When the cement sets, the weaker formations above the end of the casing are isolated from the higher pressures that will be encountered as the well is drilled deeper. Cement also serves to support and anchor the casing to the formation. The intent is to prevent fluids from flowing up the annular space outside the casing.
Casing is also used to isolate the final section of a well once it has been finished. This stabilizes the last open section of the well and allows for the later production of fluids from selected reservoirs. The cement forms a plug in the very bottom of the casing that would otherwise remain open. This final string of casing can extend back to the surface of the well (in this case the wellhead that was installed at the ocean floor) or can be suspended or hung from the end of the previously run casing string.
The rig crew uses additional barriers inside the well to augment the primary barrier system. For example, check valves (a float collar or a float shoe, or both) are installed at the bottom of the casing string. They are intended to prevent flow back into the casing while the cement is setting or in case the cement seal fails. Also, the top of the casing is sealed inside the wellhead or the hanger so that fluids cannot escape past the top of the casing should the cement seal fail in the annulus. Finally, some form of well control cap is placed on top of the wellhead to prevent or control flow out of the casing. During drilling and casing installation, a BOP system is used. In an emergency situation, the BOP system can be activated to seal an open well, close the annular portion of the well around the drill pipe or casing, or cut through the drill pipe with steel shearing blades and then seal the well. A typical BOP system also has more routine functions such as enabling certain pressure tests to assess well integrity and injecting and removing fluid from the well through its “choke” and “kill” lines, which are high-pressure lines running between the BOP and the rig.
After the well is completed, the BOP is replaced by a production control assembly (often called the “Christmas tree” or “tree”). These systems are designed to provide redundant control of the well and prevent unwanted flows from the reservoirs. The integrity of the barriers can be evaluated by pressure tests and by taking measurements with various instruments (logging). If there is a delay between finishing drilling operations and commencing completion operations, the well is temporarily abandoned by setting mechanical or cement plugs inside the casing.
The Macondo well-Deepwater Horizon incident on April 20, 2010, was not the first major blowout associated with offshore drilling (Presidential Commission Staff 2011). Past incidents involving blowouts include the following:
• On January 28, 1969, a blowout occurred at a well located in the Santa Barbara Channel and lasted 11 days. The ultimate release of oil amounted to between 80,000 and 100,000 barrels (Kallman and Wheeler 1984). A failure to keep the hydrostatic pressure in the well greater than the pore pressure resulted in the flow of hydrocarbons into the well. Attempts to control the well led to blowouts in the immediate surrounding area through several breaches in the geologic formation that extended up through the mud line (County of Santa Barbara 2005).
• On June 3, 1979, the Ixtoc I well blowout in Mexico’s Bay of Campeche took 9 months to cap and released an estimated 3.5 million barrels of oil. The formation at the bottom of the well was fractured, causing the loss of mud. Hydrostatic pressure for control of the well was lost after the drill string was pulled out of the borehole. The BOP failed to secure the well because the thick, large-diameter drill collars were inside the BOP stack and prevented the shear rams from cutting the pipe and the pipe rams from closing around the large-diameter pipe.
• On August 21, 2009, a blowout occurred at the Montara Wellhead Platform located off the northwest Australian coast in the Timor Sea. The cement in the well and the float equipment failed to prevent flow from the reservoir into the casing. When the temporary well cap was removed to begin completion operations, the BOP was not installed. This left the well open and flow began from the reservoir, eventually reaching the surface where it could not be controlled. The operator estimated that 400 barrels of crude oil were lost per day. The uncontrolled release continued until November 3, 2009, and response operations continued until December 3, 2009. An investigation found that the operating company “did not observe sensible oilfield practices at the Montara Oilfield. Major shortcomings in the operating company’s procedures were widespread and systemic, directly leading to the blowout” (Borthwick 2010).
On March 19, 2008, BP obtained a 10-year lease to Mississippi Canyon
Block 252 in Central Gulf of Mexico Lease Sale 206, which was conducted by the Minerals Management Service (MMS). Ownership of the lease was shared among BP (65 percent), Anadarko Petroleum (25 percent) and MOEX Offshore (10 percent). As the lease operator, BP was the company responsible for carrying out the operations.
On April 6, 2008, MMS approved the exploration plan for the lease, a revised exploration plan on April 16, and an Application for Permit to Drill the Macondo Well on May 22. In addition, because of the well conditions, BP submitted Applications for Permit to Modify that were approved by MMS at various points during the drilling program.
Initial drilling of the Macondo well began on October 6, 2009, with Transocean’s semisubmersible MODU Marianas in a water depth of greater than 5,000 feet. Drilling was halted about a month later on November 8 as the Marianas was secured and evacuated for Hurricane Ida. The Marianas was subsequently removed after sustaining hurricane damage that required dock repairs. After the repairs, the rig was not returned to drill the Macondo well.
The Deepwater Horizon was selected in January 2010 to finish drilling the Macondo well. The rig was owned and operated by Transocean and had been under contract to BP in the Gulf of Mexico for approximately 9 years. MMS approved an Application for a Revised New Well on January 14, the Macondo plan was updated, and drilling activities began on February 6.
Subsequent activities leading up to the blowout, explosions, and fire are discussed in the following chapters of this report.
The two main components of the committee’s task were to examine the causes of the Macondo well–Deepwater Horizon incident and to identify measures for preventing similar incidents in the future. Offshore drilling is a safety-critical process that warrants a safety system commensurate with the overall risk presented. In that light, the committee considered key factors and decisions that may have contributed to the blowout of the Macondo well, including engineering, testing, and maintenance procedures; operational oversight; regulatory procedures; and personnel training and certification. The committee examined the extent to which there were margins of safety to allow for uncertainties in the interactions of equipment, humans, procedures, and the environment under normal and adverse conditions. The committee developed overall findings of fact related to the incident, observations concerning contributing factors, and recommendations intended to reduce the likelihood and impact of any future well control incidents.7 They are presented in the aggregate in the report summary. The committee also presented more detailed findings, observations, and recom-
7 The findings and observations provide context for the recommendations, but there is not a one-to-one correspondence.
Well Design and Construction
To identify causative factors for the blowout, the committee examined the design of the Macondo well, the processes for developing the well design and for making subsequent changes, and the construction of the well. Particular attention was given to the reported narrow range between pore pressure and fracture gradient (BP 2010) because of the challenges this presents. Attention was also given to the approach selected to temporarily abandon the well given these conditions. A number of key decisions related to the design, construction, and testing of the barriers critical to the temporary abandonment process were examined and found to be flawed. Recommendations for achieving a more robust approach to implementing and verifying the needed barriers are provided (see Chapter 2).
Once the rig crew realized that hydrocarbons were flowing into the well, the BOP system did not recapture well control. The committee tracked the forensic analysis of the BOP arranged by the Marine Board of Investigation9 and considered key factors that affected the performance of the BOP system during the blowout. The committee also considered the findings of past evaluations of the reliability of BOP systems under real-world conditions. Chapter 3 reports on the extent to which the design, testing, and maintenance of the Deepwater Horizon BOP system were commensurate with a high-reliability fail-safe mechanism within an overall safety system. The chapter also provides the committee’s recommendations for improving the reliability of BOP systems.
Mobile Offshore Drilling Unit
Except for the BOP system, there was no evidence implicating the Deepwater Horizon MODU as a causative factor in the blowout. However, there were concerns that aspects of the rig design and operation may have contributed to the
9 The Marine Board of Investigation (sometimes referred to as the Joint Investigation Team) was conducted by the U.S. Department of the Interior’s Bureau of Ocean Energy Management, Regulation, and Enforcement and the U.S. Coast Guard to develop conclusions and recommendations as they relate to the Deepwater Horizon MODU explosion and loss of life.
casualties of the workers. Furthermore, the loss of the rig may have limited options for recapturing control of the well. These concerns led to the assessments and recommendations reported in Chapter 4.
Industry Management of Offshore Drilling
The multiple companies involved in drilling the Macondo well reflect the complex structure of the offshore oil and gas industry and the division of technical expertise among the many contractors engaged in the drilling effort. Chapter 5 reports on the committee’s assessment of the extent to which the actions, policies, and procedures of corporations involved failed to provide an effective systems-safety approach commensurate with risks of the Macondo well. The committee noted that the safe drilling of deepwater wells is inherently dependent on human decision making. Therefore, there is a critical need for adequately trained personnel. The committee assessed the education, training, and certification of key personnel and the extent of industrywide learning from past events that have led to—or avoided—well control incidents. The chapter also provides recommendations for improving various aspects of industry management.
In 2010, the regulatory approach used by MMS was based primarily on prescriptive regulations concerning well design, drilling equipment, well construction, and testing. This approach proved to be inadequate, as evidenced by the Macondo well blowout and the actions that led to the loss of well control. The committee noted the inherent limitations of prescriptive approaches and the progress on goal-oriented regulatory processes being implemented for drilling in the North Sea, Australia, and elsewhere. The approach in the United States is now shifting to be more goal-oriented and less prescriptive. Also, a process of administrative restructuring of MMS began in May 2010. The Bureau of Safety and Environmental Enforcement is currently the federal entity responsible for safety and environmental oversight of offshore oil and gas operations. In Chapter 6, the committee identifies key enhancements needed as regulatory reform proceeds.
Additional background discussions of topics related to the Macondo well–Deepwater Horizon incident are provided in other recent reports (see Box 1-1). The results of these investigations were helpful in informing the committee’s deliberations. Presentations made to the committee are listed in Appendix B.
May 2010. DOI. Increased Safety Measures for Energy Development on the Outer Continental Shelf for 30 CFR Part 250 (“30-day report”). http://www.boemre.gov/eppd/PDF/EAInterimSafetyRule.pdf.
September 2010. BP. Deepwater Horizon Accident Investigation Report. http://www.bp.com/liveassets/bp_internet/globalbp/globalbp_uk_english/gom_response/STAGING/local_assets/downloads_pdfs/Deepwater_Horizon_Accident_Investigation_Report.pdf.
January 2011. National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Deep Water: The Gulf Oil Disaster and the Future of Offshore Drilling. http://www.oilspillcommission.gov/sites/default/files/documents/DEEPWATER_ReporttothePresident_FINAL.pdf.
February 2011. Chief Counsel. Macondo: The Gulf Oil Disaster. Chief Counsel’s Report, National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. http://www.oilspillcommission.gov/sites/default/files/documents/C21462-408_CCR_for_web_0.pdf.
March 2011. DHSG. Final Report on the Investigation of the Macondo Well Blowout. http://ccrm.berkeley.edu/pdfs_papers/bea_pdfs/DHSGFinalReport-March2011-tag.pdf.
March 2011. DNV. Forensic Examination of Deepwater Horizon Blowout Preventer, Vol. I and II (Appendices). Final Report for U.S. Department of the Interior, Bureau of Ocean Energy Management, Regulation, and Enforcement, Washington, D.C. Report No. EP030842. http://www.boemre.gov/pdfs/maps/DNVReportVolI.pdf, http://www.uscg.mil/hq/cg5/cg545/dw/exhib/DNV%20BOP%20report%20-%20Vol%202%20%282%29.pdf.
April 2011. USCG. Report of Investigation into the Circumstances Surrounding the Explosion, Fire, Sinking and Loss of Eleven Crew Members Aboard the Mobile Offshore Drilling Unit Deepwater Horizon in the Gulf of Mexico April 20-22, 2010, Vol. I. http://www.hsdl.org/?view&did=6700.
April 2011. DNV. Addendum to Final Report: Forensic Examination of Deepwater Horizon Blowout Preventer. Report No. EP030842. http://www.boemre.gov/pdfs/maps/AddendumFinal.pdf.
June 2011. Transocean. Macondo Well Incident. Transocean Investigation Report Vol. I and II (Appendices). http://www.deepwater.com/fw/main/Public-Report-1076.html.
August 2011. Republic of the Marshall Islands Office of the Maritime Administrator. Deepwater Horizon Marine Casualty Investigation Report. Office of the Maritime Administrator. http://www.register-iri.com/forms/upload/Republic_of_the_Marshall_Islands_DEEPWATER_HORIZON_Marine_Casualty_Investigation_Report-Low_Resolution.pdf.
September 2011. BOEMRE. Report Regarding the Causes of the April 20, 2010 Macondo Well Blowout. http://www.boemre.gov/pdfs/maps/dwhfinal.pdf.