In his think piece for OE’s July issue, consultant Ian Fitzsimmons drew parallels between the Deepwater Horizon tragedy and the earlier Titanic, Ixtoc-1, Piper Alpha, Comet and Challenger disasters in terms of their presumed design infallibility. Here he turns his attention to the 200-plus pages of Macondo operator BP’s accident report.
BP’s preliminary Deepwater Horizon – Accident Investigation Report makes uncomfortable reading. I use ‘preliminary’ in the sense that the full facts surrounding the BOP have yet to be revealed, and the final chapter of this report cannot be written until that autopsy has been made public. The BOP is currently impounded, so the autopsy results could be a long time coming.
‘This report does nothing to assuage either public opinion or anger. Nothing in it will have persuaded the American public that the BP Macondo well design and execution was anything other than reckless.’ Ian FitzsimmonsThe BP accident report is the first to be published, but it will not be the last. More accident reports prepared by public bodies and learned institutions will soon follow. The definitive account of the Deepwater Horizon accident has yet to be written. In the meantime, this report is the best version of the events leading to the accident that we have. It has not met with general approval. Persistent claims by BP (repeated in the report) that the Macondo well design was safe have not been endorsed by any other operator in the Gulf of Mexico, including the Macondo joint venture partners. This report does nothing to assuage either public opinion or anger. Nothing in it will have persuaded the American public that the BP Macondo well design and execution was anything other than reckless; driven by cost-saving and schedule constraints, and without due regard for the safety of the rig crew. The report cites eight critical findings said to have contributed to the disaster, but makes no criticism of the well design and planning. Other contributory factors may eventually arise. The following overview covers the most critical aspects of the Macondo disaster, including selected quotes from the report to hopefully provide a better understanding of this terrible tragedy. It is, however, a work in progress.
Figure 1 from BP's accident investigation report shows barriers breached and the relationship of barriers to critical factors (adapted from James Reason 1997).Long string design
Summarising the BP position in respect of the long string completion (page 77, section 4.4) the report states: The investigation team determined that using a 97/8in liner x 7in long string production casing was an acceptable decision and provided a sound basis for design.’ ‘Industry data in Mississippi Canyon Block 252 area also indicates that 57% of the wells used long strings, while approximately 36% used liners or liners with tie-backs.’ The use of selective statistics to validate the Macondo well design is unacceptable. In the aftermath of this tragedy, the statistics have changed. Much the same could be said for the Comet disasters. Its design was considered safe until it was demonstrably proved otherwise. In respect of the depth of the cement plug used (p65, s2.6), which should have been 1000ft in accordance with internal BP practice, the report states: ‘On the Macondo well, 1000ft of cement above the uppermost hydrocarbon sand would have placed the cement inside the previous casing string, potentially creating a trapped annulus and causing problems with annular pressure build up.’ ‘The BP Macondo well team decided to place the TOC 500ft above the uppermost hydrocarbon-bearing sand, per MMS regulations.’ The following concerns arise: The most popular response to the foregoing is that BP did not follow its own 1000ft cement guideline. The casing design was such that it was not possible to put 1000ft of cement in place. Since the Macondo casing design did not permit compliance with the 1000ft BP recommendation (Section 5 ETP, GP 10-60 Zonal Isolation Requirements), it is difficult to understand how BP can claim that the well design was not at fault.
In mitigation of the foregoing, the same BP document states that if any reduction in the 1000ft requirement is planned, then TOC must be determined by a ‘proven cement evaluation technique, such as a cement evaluation log’. But no such log was performed.
The foregoing appears to suggest that the well design limited the ability to run a full 1000ft plug and to run a full cement bond log. This claim has been repeated in the press and before public hearings. It remains to be seen if any operator, including BP, will elect to use this well design again. That will be the acid test for the Macondo well design.
Simplified process flow diagram of selected Deepwater Horizon surface equipment reproduced from BP’s accident investigation report.Cement testing
The cement used for isolating the reservoir was not qualified for application on Macondo. You will not find these exact words anywhere in the report, but they are implied under the heading ‘Work that the investigation team was unable to conduct’ (p189, s7): ‘Test nitrified cement slurry at downhole temperature and pressures.’ Following the tragedy, BP carried out laboratory testing on the cement type used for Macondo. The results of the cement slurry tests, carried out at ambient surface pressure and temperature, clearly demonstrated this cement was neither suitable nor qualified for Macondo. Given that the cement plug was the primary barrier to isolate reservoir hydrocarbons from the wellbore and the environment, the decision to use this product for Macondo application was inexcusable. It was a reckless decision and it is obvious that the cement plug failed. The report is critical of those rig personnel (including BP) involved in the decision making process.
Negative pressure test
The purpose of the ‘negative’ pressure test is to test the cement plug as the primary barrier to hydrocarbons. To generate the ‘negative’ pressure required for the test, the drilling mud providing a stable, overbalanced, well condition, was partially replaced by seawater. As a result, the well became under- balanced (reservoir pressure exceeded hydrostatic pressure), thereby testing the integrity of the cement plug from below. The negative pressure test failed and the well began to flow. According to the report, this went unnoticed by the rig personnel. Not only had the cement plug failed, but the two flapper (check) valves in the cement shoe/float collar must also have failed. The following quotes refer to the observations made in the report: ‘. . . abnormal pressures observed during the negative- pressure test were indicative of a failed or inconclusive test; however, the test was deemed successful.’ (Hydrocarbons entered the well, p79, Analysis 5B) ‘The negative-pressure test was accepted although well integrity had not been established.’ (p80, Key Finding 3) ‘The investigation team could not identify any established industry standards for conducting negative- pressure test; this is supported by expert testimony during the July 23 2010, MBI hearings.’ (Conducted the negative-pressure test, p85, 2.4) Notwithstanding the foregoing, we find that subsequent displacement of the well to seawater again put the well in an underbalanced condition, allowing the well to flow (p89, s3). In light of the report extracts, we can only assume that supposedly competent rig personnel were responding to pressure from their managers. If you listen carefully, you can hear a faint echo from the Challenger tragedy.
Mud gas separator (MGS)
When control of the well had been lost, the diverter was closed, and for some incomprehensible reason, well fluid was diverted through the mud gas separator (MGS). A process flow schematic of the low pressure diverter system can be found on page 114 of the report. The MGS is part of the diverter system and, as its name suggests, conditions drilling mud returns. The schematic also illustrates the two large diameter vent lines (port and starboard) that should have been used to divert gas and well fluid overboard and freely vent to the environment. But that did not happen. Overwhelmed by gas and well fluid, the low pressure MGS exploded, resulting in the death of 11 crew members and eventually sinking the Deepwater Horizon.
Executive summary
I have read the BP report several times with growing discomfort. Its executive summary contains the saddest words I have ever encountered in an accident report (p104, paras 5-6): ‘If the decision had been made to direct flow overboard rather than to the MGS, the subsequent diversion of flow overboard may have provided the rig crew more time to respond to the well control situation, and the consequences of the event would likely have been reduced.’ This quiet explanation confirms that even after the blowout, all was not lost and 11 men might have been saved. They still had a sporting chance. We will never know why the rig crew took their fateful decision. But it is easy to say that sitting in front of a computer in a comfortable study room. Within the offshore drilling community, there is a clear understanding that when well control is lost you vent the gas and fluid overboard and head for the lifeboats. No written procedure is required when faced with an obviously life- threatening danger; you just think about your loved ones and jump. The executive summary identifies eight major contributory factors that came together to cause the Deepwater Horizon tragedy. It is not possible to argue with those findings. But there is one glaring omission: the planning and design of the well is not mentioned as a contributory factor – quite the opposite. Considering the self-evident outcome, this is a shocking omission, and the one most likely to give rise to public anger. However, the published contributory factors as we currently understand them, are self-evident. We may find other contributory factors, but those already identified are sufficient to explain the tragedy.
Well design options considered for the Macondo well. By comparison with the ‘liner’ and ‘liner with tieback’ options, the absence of conventional casing packers and bridging plugs from the from the ‘long string’ design is obvious.
Ian Fitzsimmons, a regular contributor to OE, is an independent consultant with more than 30 years' offshore industry experience. He has worked for major operators around the world and major subsea hardware/drilling equipment contractors, and has extensive due diligence and expert witness experience. He was chief engineer for RJ Brown & Associates in London. The views expressed in this article are the author's own and do not necessarily reflect OE's position.Partial conclusion
Photograph taken by ROV of the lower end of the riser after it was cut, showing two sections of pipe inside.Similarities with the tragic loss of the Titanic, and the destruction of the Comet and Challenger shuttle can be found echoing throughout Deepwater Horizon: accident investigation report. I have reviewed all eight contributory factors described in the executive summary. For the purposes of this article, I have only highlighted the most critical contributory issues as I see them. This does not mean I either disagree with, or have disregarded in any way, the other issues. Other contributory factors, for example well design, commercial/schedule considerations and management pressure, will surely be added to those listed. That process is already well under way. If I have anything to add to the debate, it concerns training – training people to expect both the unthinkable and failure; teaching them to cope with, and adapt to, both situations, and trying to rid them of the smug paradigm of familiarity. Long before pilots can fly and astronauts lift-off, they are trained in flight simulators. Thereafter they enter the simulator for testing on a yearly basis. Part of that training involves being fed with unpredictable events – curve balls and reverse swing, as some would say. Some of these events are non-recovery situations. Very few pilots, if any, have never crashed in a simulator under dire conditions. It occurs to me that we have something to learn from NASA and aircraft manufacturers. We should train our drilling crews in simulators, and on a regular basis. Such simulators already exist but are not mandatory for drilling crews. In return, we should present them with a safe well design, qualified cement, mandatory casing hanger lockdown assemblies, proven mechanical bridging plugs, massive deluge systems, high volume overboard vents, and improved BOP/ LMRP configurations and systems. I have not forgotten the BOP, our ultimate bulwark against loss of well control. Why did it fail the Deepwater Horizon? That story has still to be told. We do not know the full operational and service history of the Deepwater Horizon BOP. Perhaps it does not exist. BOPs may be big and ugly, but they still deserve respect and careful maintenance. They need health checks on an annual basis. Not just a strength test, but a system test. If only they could talk. OE
Subscribe
