Appendix C

Findings, Observations, and Recommendations

This appendix presents a compilation of the findings, observations, and recommendations shown in the chapters of this report.1 The sequence in which they are presented is according to the sequence of the chapters and is not intended to imply a sense of priority.

ABBREVIATIONS

ABS      American Bureau of Shipping
AMF      automatic mode function
BOP      blowout preventer
BSEE      Bureau of Safety and Environmental Enforcement
BSR      blind shear ram
CSR      casing shear ram
DoD      U.S. Department of Defense
DOI      U.S. Department of the Interior
DNV      Det Norske Veritas
EDS      emergency disconnect system
LMRP      lower marine riser package
MODU      mobile offshore drilling unit
MUX      multiplexer
OIM      offshore installation manager
ppg      pounds per gallon
ROV      remotely operated vehicle
SEMS      Safety and Environmental Management Systems
VBR      variable bore ram

____________________

1 This compilation was not presented in the prepublication version of this report, which was issued in December 2011.



The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 142
Appendix C Findings, Observations, and Recommendations This appendix presents a compilation of the findings, observations, and recommendations shown in the chapters of this report.1 The sequence in which they are presented is according to the sequence of the chapters and is not in- tended to imply a sense of priority. ABBREVIATIONS ABS American Bureau of Shipping AMF automatic mode function BOP blowout preventer BSEE Bureau of Safety and Environmental Enforcement BSR blind shear ram CSR casing shear ram DoD U.S. Department of Defense DOI U.S. Department of the Interior DNV Det Norske Veritas EDS emergency disconnect system LMRP lower marine riser package MODU mobile offshore drilling unit MUX multiplexer OIM offshore installation manager ppg pounds per gallon ROV remotely operated vehicle SEMS Safety and Environmental Management Systems VBR variable bore ram 1 This compilation was not presented in the prepublication version of this report, which was issued in December 2011. 142

OCR for page 142
143 Appendix C WELL DESIGN AND CONSTRUCTION Findings Summary Finding 2.1: The flow of hydrocarbons that led to the blowout of the Macondo well began when drilling mud was displaced by seawater during the temporary abandonment process.2,3 Summary Finding 2.2: The decision to proceed to displacement of the drilling mud by seawater was made despite a failure to demonstrate the in- tegrity of the cement job even after multiple negative pressure tests. This was but one of a series of questionable decisions in the days preceding the blowout that had the effect of reducing the margins of safety and that evi- denced a lack of safety-driven decision making. Summary Finding 2.3: The reservoir formation, encompassing multiple zones of varying pore pressures and fracture gradients, posed significant challenges to isolation using casing and cement. The approach chosen for well completion failed to provide adequate margins of safety and led to multiple potential failure mechanisms. Finding 2.4: The sequence of fluids used to cement the Macondo well in- cluded a low-density foamed slurry followed by a dense un-foamed tail slurry. The foam cement was designed to have a density of 14.5 ppg at the bottom of the well, but at the surface, where the foam was mixed, the den- sity was extremely light at around 6 ppg. The tail slurry had a density of 16.7 ppg. Because of the extreme density imbalance, the heavy tail cement on top of the foamed cement would have been gravitationally unstable near the surface, and it probably fell into and perhaps through the foamed slurry. This would have had the unintended effect of leaving a tail slurry containing foamed cement in the shoe track at the bottom of the casing rather than leaving the heavy, un-foamed tail cement. Finding 2.5: Foamed cement that may have been inadvertently left in the shoe track would likely not have developed the compressive strength of the un-foamed cement, nor would it have had the strength to resist crush- ing when the differential pressure across the cement was increased during the negative test. 2 “Summary” indicates that a finding, observation, or recommendation is presented in the report summary. 3 The first digit of a finding, observation, or recommendation refers to a chapter of this report in which it appears.

OCR for page 142
144 Macondo Well Deepwater Horizon Blowout Finding 2.6: Evidence available before the blowout indicated that the flapper valves in the float collar probably failed to seal, but this evidence was not acted on at the time. Finding 2.7: On the basis of photographic evidence, it appears that flow was up the inside of the casing, because the inside of the hanger showed signs of fluid erosion while the outside did not. However, not installing a lockdown sleeve left a potential for flow up the annulus. Finding 2.8: Because of the choice of the long string of production casing, it was not possible to reciprocate or rotate the casing during the cementing operation. Casing movement tends to help remove any mud left in the path of the cement and force the cement into pathways that might otherwise be bypassed. The minimum circulation of mud was not achieved in this well, which would have been helpful in removing stagnant mud and debris from the annulus. Thus, the possibility of mud-filled channels or poor cement bonding existed. Finding 2.9: No cement bond log was run to investigate the condition of the cement. The well design placed the float collar above the bottom of the deepest reservoir and would have prevented the log from investigating the lower sections of the well in which cement had been pumped. Finding 2.10: Although data were being transmitted to shore, it appears that no one in authority (from BP onshore management or a regulatory agency) was required to examine test results and other critical data and render an opinion to the personnel on the rig before operations could con- tinue. Observations Summary Observation 2.1: While the geologic conditions encountered in the Macondo well posed challenges to the drilling team, alternative com- pletion techniques and operational processes were available that could have been used to prepare the well safely for temporary abandonment. Observation 2.2: Had an attempt been made to bleed off the drill pipe pressure at the end of the negative test, the communication with the reser- voir would likely have been discovered. Observation 2.3: The results of a variety of static tests of foamed cement mixed at 14.5 ppg and exposed to atmospheric pressure call into question the stability of the foam, because settling of cement and breakout of nitro- gen were observed in these tests. The tests were not performed at condi-

OCR for page 142
145 Appendix C tions that existed during pumping or at the bottom of the well and there- fore cannot be considered as representative of the foam during displace- ment or at bottom hole conditions. Observation 2.4: The pumping sequence of cement slurries and other flu- ids used for cementing the Macondo well subjected the volume of the lead cement slurry to contamination by the spacer or mud that was placed ahead of it. If it was heavily contaminated, the slurry would not have es- tablished a cement cap with the compressive strength of uncontaminated cement. Observation 2.5: Had the path of the blowout been up the annulus, a liner top or the rupture discs could have failed and allowed flow to escape the well into a shallow formation. This would result in a downhole blowout that could breach at the seafloor under the correct conditions. Future well construction could avoid this possibility by running one of the deeper cas- ing strings back to the wellhead where it can be sealed. For example, in this well the 13 5 8 -inch liner could have been run back to the wellhead. This would protect the shallower liner tops and rupture discs from poten- tial exposure to high pressure from flow up the annulus from a deeper res- ervoir. Observation 2.6: The use of a production liner rather than the long string could have allowed for the use of a rotating liner hanger to improve the chances of good cement bonding; allowed for the use of a liner top packer to add a barrier to annular flow near the bottom of the well; allowed for the omission of the differential fill tube, which would remove a potential failure mechanism for the float collar; potentially made the negative test simpler to conduct and interpret; and configured the well to better control and repair a leak in the liner by leaving the well filled with drilling mud to a greater depth and by placing the drill pipe at a greater depth in the well during the test. Recommendations Summary Recommendation 2.1: Given the critical role that margins of safety play in maintaining well control, guidelines should be established to ensure that the design approach incorporates protection against the various credible risks associated with the drilling and completion processes. Recommendation 2.2: During drilling, rig personnel should maintain a reasonable margin of safety between the equivalent circulating density and the density that will cause wellbore fracturing.

OCR for page 142
146 Macondo Well Deepwater Horizon Blowout Summary Recommendation 2.3: All primary cemented barriers to flow should be tested to verify quality, quantity, and location of cement. The in- tegrity of primary mechanical barriers (such as the float equipment, liner tops, and wellhead seals) should be verified by using the best available test procedures. All tests should have established procedures and predefined criteria for acceptable performance and should be subject to independent, near-real-time review by a competent authority. Recommendation 2.4: The general well design should include the review of fitness of components for the intended use and be made a part of the well approval process. Recommendation 2.5: Generally accepted good operational or best prac- tices should be used in the construction of the well. Such practices would ensure that the most accurate well data are passed from the operator to the various contractors for use in simulations and design and that the results are considered by all parties before implementation. BLOWOUT PREVENTER SYSTEM Findings Summary Finding 3.1: The loss of well control was not noted until more than 50 minutes after hydrocarbon flow from the formation started, and at- tempts to regain control by using the BOP were unsuccessful. The BSR failed to sever the drill pipe and seal the well properly, and the EDS failed to separate the lower marine riser and the Deepwater Horizon from the well. Finding 3.2: The crew did not realize that the well was flowing until mud actually exited and was expelled out of the riser by the flow at 21:40. Early detection and control of flow from a reservoir are critical if an im- pending blowout is to be prevented by a BOP whose use against a full- flowing well is untested. Finding 3.3: Once mud began to flow above the rig floor, the crew at- tempted to close the upper annular preventer of the BOP system, but it did not seal properly. The BOP system had been used in the month previously to strip 48 tool joints, and apparently it was untested for integrity after- wards. Annulars are often unable to seal properly after stripping. In addi- tion, the flowing pressure inside the well may have been larger than the preset annular closing pressure could overcome. What tests of sealing against flow have been done on this design of annular are unknown.

OCR for page 142
147 Appendix C Finding 3.4: The crew also closed the VBRs. The damaged pipe under the upper annular demonstrated its failure to seal, and the well was only sealed, resulting in the final pressure spike, when these VBRs were closed. The DNV investigation also found that these rams closed, and they could only be closed by command from the rig control panels and not by an ROV. At this point the flow from below the VBRs would have been closed off, but gas and oil had already flowed into the marine riser above the BOP system and continued to rise to the surface, where the gas ex- ploded. Finding 3.5: The internal BOP, which functions as a safety valve on the top of the drill pipe, was not closed (BP 2010, 25). Also, approximately 30 minutes after the explosion the traveling block was observed to fall and the rotary hose (used to conduct drilling fluid) could have been destroyed. The growing fire indicates that the drill pipe was broken in the initial ex- plosion and the fall of the traveling block could have allowed even more flow to escape up the drill string. This was the likely path of hydrocarbon flow before the closure of the BSR. Finding 3.6: Once the fire started on the rig, an attempt was made (after 7 minutes) to activate the EDS, which should have closed the BSR and dis- connected the LMRP. This appears to have failed because the MUX com- munication cables were destroyed by the explosion or fire. Finding 3.7: Once hydraulic and electrical connection with the rig was lost at the BOP, the AMF should have activated the BSR. It might have failed at this time because of a low battery charge in one control pod and a mis- wired solenoid valve in the other, but both these points are in dispute. However, no short-term reduction in hydrocarbon flow from the well was observed after the initial fire and explosion. Such a reduction would nec- essarily have resulted from the VBRs sealing the annulus in the BOP and the failed BSR shearing action effectively choking, at least for a brief pe- riod of time, virtually the entire cross section of the 5½-inch drill string. Viewed in total, the evidence appears more supportive of the autoshear ac- tivation of the BSR. Finding 3.8: The BSR appears to have been activated after 07:40 on April 22, 2010, if not earlier, when the hydraulic plunger to the autoshear valve was cut by an ROV. However, regardless of when the BSR was activated, the well continued to flow out of control. Finding 3.9: DNV hypothesized that the drill pipe below the annular pre- venter was being forced upward by the pressure of the flowing well, re- sulting in a 115,000-pound net compressive force on the drill pipe in the BOP sufficient to buckle the drill pipe until it came in contact with the in-

OCR for page 142
148 Macondo Well Deepwater Horizon Blowout side of the BOP system (DNV 2011a, I, 174). However, the fluid mechan- ics inherent in this assumption are dubious. The 135,000 pounds of buoyed drill string weight above the BOP appears to be a more plausible source of the compression. Finding 3.10: When it was activated, the BSR was unable to center the drill pipe in its blades and failed to cut the pipe completely. The blades of the ram were of the old straight and V combination, which has been shown to be inferior in its shearing performance to the double-V blade geometry (West Engineering Services 2004). Because the BSR blades did not fully span the BOP annular, a mashed segment of pipe was caught between the rams and prevented them from closing to the point where they could seal (DNV 2011b, 17). Finding 3.11: After the rig lost power and drifted off station, the marine riser kept the vessel tethered to the BOP system. Finding 3.12: Flow from the well then exited the partially severed drill pipe in the BSR and began to erode parts of the ram and BOP stack by fluid flow. Finding 3.13: After the vessel sank at 10:22 on April 22, 2010, the marine riser with the drill pipe inside was bent at a number of places, including the connector to the BOP, and oil and gas began to flow into the ocean. Finding 3.14: The effect of closing the CSR on April 29, 2010, was to provide a new flow path exiting the severed drill pipe below the CSR and passing the CSR rams that were not designed to seal. Severe fluid erosion occurred past the CSR, with deep cuts made in the surrounding steel of the BOP housing itself, endangering the integrity of the housing. Finding 3.15: Unfortunately, even if the BSR had functioned after being activated by the EDS or the AMF, it would not likely have prevented the initial explosions, fire, and resulting loss of life, because hydrocarbons had already flowed into the marine riser above the BOP system. If the BOP system had been able to seal the well, the rig might not have sunk, and the resulting oil spill would likely have been minimized. Summary Finding 3.16: The BOP system was neither designed nor tested for the dynamic conditions that most likely existed at the time that at- tempts were made to recapture well control. Furthermore, the design, test, operation, and maintenance of the BOP system were not consistent with a high-reliability, fail-safe device.

OCR for page 142
149 Appendix C Finding 3.17: Regulations in effect before the incident required the peri- odic testing of the BOP system. However, they did not require testing un- der conditions that simulated the hydrostatic pressure at the depth of the BOP system or under the condition of pipe loading that actually occurred under dynamic flow, with the possible entrained formation rock, sand, and cement, and no such tests were run. Furthermore, because of the inade- quate monitoring technology, the condition of the subsea control pods at the time of the blowout was unknown. Finding 3.18: The committee’s assessment of the available information on the capabilities and performance of the BOP system at the Macondo well points to a number of deficiencies (listed below) that are indicative of de- ficiencies in the design process. Past studies suggest that the shortcomings also may be present for BOP systems deployed for other deepwater drill- ing operations. 1. The committee could find no evidence that the BOP design criteria or performance envelope was ever fully integrated into an overall well control system perspective, nor that BOP design was consistent with the BOP’s critical role in well control. 2. While individual subsystems of various BOP designs have been studied on an ad hoc basis over the years, the committee could find no evidence of a reliability assessment of the entire BOP system, which would have included functioning at depth under precisely the condi- tions of a dynamic well blowout. Furthermore, the committee could find no publicly available design criteria for BOP reliability. 3. The entire BOP system design is characterized by a previously iden- tified lack of redundancy:  There is only one BSR.  One shuttle valve is used by both control pods.  Each MUX cable is incapable of monitoring the entire BOP sys- tem independently. 4. No design consideration appears to have been given to BSR per- formance on pipe in compression. 5. The BSR was not designed to shear all types and sizes of pipe that might be present in the BOP system. 6. The BSR probably did not have the capability of shearing or sealing any pipe in significant compression.

OCR for page 142
150 Macondo Well Deepwater Horizon Blowout 7. There was a lack of BOP status monitoring capabilities on the rig, including  Battery condition,  Condition of the solenoid valves,  Flow velocity inside the BOP system,  Ram position,  Pipe and tool joint position inside the BOP system, and  Detection of faults in the BOP system and cessation of drilling operations on that basis. Finding 3.19: The failure of the AMF to activate might have been due to malfunctions in the control pods that could not be detected. In view of the state of the pipe in the well after the explosion, whether the BSR would have functioned properly is uncertain. This issue is moot if the rams could not perform their intended functions whenever they were activated. Finding 3.20: The regulations did not require that the design of the equipment allow for real-time monitoring of critical features, such as the battery condition in the control pod, so that maintenance issues could be readily discovered. The current test protocol for the BSRs, for example, is designed for near-ideal surface conditions rather than the harsher condi- tions found on the ocean floor. Finding 3.21: When a signal is sent from the drilling rig to the BOP (on the seafloor) to execute a command, the BOP sends a message back that the signal has been received. However, there are no transducers that detect the position or status of key components, and there are no devices to send a signal that any command has been executed (such as pressure or dis- placement sensors confirming that the hydraulics have been actuated, that rams have moved, or that pipe has been cut). Furthermore, there are no sensors to communicate flow or pressures in the BOP to the rig floor. Observations Observation 3.1: In the confusion of an emergency such as the one on the Deepwater Horizon, it is not surprising that a drill crew would not take the time to determine whether a tool joint was located in the plane of the BSR or whether tension was properly maintained in the drill pipe. Observation 3.2: In terms of emergency procedures, such as an emergency disconnect or autoshear function of the BOP system on its own, there is no ability to manipulate the tool joint position or the level of tension or com- pression in the drill pipe. The BSR was not designed to work for the full range of conditions that could be realistically anticipated in an emergency.

OCR for page 142
151 Appendix C Recommendations Summary Recommendation 3.1: BOP systems should be redesigned to provide robust and reliable cutting, sealing, and separation capabilities for the drilling environment to which they are being applied and under all foreseeable operating conditions of the rig on which they are installed. Test and maintenance procedures should be established to ensure operabil- ity and reliability appropriate to their environment of application. Fur- thermore, advances in BOP technology should be evaluated from the per- spective of overall system safety. Operator training for emergency BOP operation should be improved to the point that the full capabilities of a more reliable BOP can be competently and correctly employed when needed in the future. Recommendation 3.2: The design capabilities of the BOP system should be improved so that the system can shear and seal all combinations of pipe under all possible conditions of load from the pipe and from the well flow, including entrained formation rock and cement, with or without human in- tervention. Such a system should be designed to go into the “well closed” position in the event of a system failure. This does not mean that the BOP must be capable of shearing every drill pipe at every point. It does mean that the BOP design should be such that for any drill string being used in a particular well, there will always be a shearable section of the drill pipe in front of some BSR in the BOP. Recommendation 3.3: The performance of the design capabilities de- scribed in the preceding recommendation should be demonstrated and in- dependently certified on a regular basis by test or other means. Recommendation 3.4: The instrumentation on the BOP system should be improved so that the functionality and condition of the BOP can be moni- tored continuously. Summary Recommendation 3.5: Instrumentation and expert system deci- sion aids should be used to provide timely warning of loss of well control to drillers on the rig (and ideally to onshore drilling monitors as well). If the warning is inhibited or not addressed in an appropriate time interval, autonomous operation of the BSRs, EDS, general alarm, and other safety systems on the rig should occur.4 Recommendation 3.6: An unambiguous procedure, supported with proper instrumentation and automation, should be created for use as part of the 4 This recommendation is repeated as Summary Recommendation 4.1.

OCR for page 142
152 Macondo Well Deepwater Horizon Blowout BOP system. The operational status of the system, including battery charge and pressures, should be continuously monitored from the surface. Recommendation 3.7: A BOP system with a critical component that is not operating properly, or one that loses redundancy in a critical component, should cause drilling operations to cease. Drilling should not resume until the BOP’s emergency operation capability is fully cured. Recommendation 3.8: A reliable and effective EDS is needed to complete the three-part objective of cutting, sealing, and separating as a true “dead man” operation when communication with the rig is lost. The operation should not depend on manual intervention from the rig, as was the case with the Deepwater Horizon. The components used to implement this rec- ommendation should be monitored or tested as necessary to ensure their operation when needed. If the consequence of losing communication and status monitoring of the BOP system is an automatic severing of the drill pipe and disconnection from the well, the quality and reliability of this communication link will improve dramatically. Recommendation 3.9: BOP systems should be designed to be testable without concern for compromising the integrity of the system for future use. MOBILE OFFSHORE DRILLING UNITS Findings Summary Finding 4.1: Once well control was lost, the large quantities of gaseous hydrocarbons released onto the Deepwater Horizon, exacerbated by low wind velocity and questionable venting selection, made ignition all but inevitable. Finding 4.1a: Uncontrolled flow of hydrocarbons through the derrick resulted in a huge cloud of combustible atmosphere surrounding the rig. Finding 4.1b: The rig was not designed to prevent explosion or fire once it was surrounded by the extent of combustible atmosphere facing the Deepwater Horizon. Finding 4.1c: Hydrocarbon flow was not redirected overboard. Over- board discharge of the blowout might have delayed the explosion and fire aboard the rig.

OCR for page 142
155 Appendix C Recommendations Summary Recommendation 4.1: Instrumentation and expert system deci- sion aids should be used to provide timely warning of loss of well control to drillers on the rig (and ideally to onshore drilling monitors as well). If the warning is inhibited or not addressed in an appropriate time interval, autonomous operation of the BSRs, EDS, general alarm, and other safety systems on the rig should occur.5 Recommendation 4.2: Rigs should be designed so that their instrumenta- tion, expert system decision aids, and safety systems are robust and highly reliable under all foreseeable normal and extreme operating conditions. The design should account for hazards that may result from drilling opera- tions and attachment to an uncontrolled well. The aggregate effects of cas- cading casualties and failures should be considered to avoid the coupling of failure modes to the maximum reasonable extent. Recommendation 4.3: Industry and regulators should develop fail-safe de- sign requirements for the combined systems of rig, riser, BOP, drilling equipment, and well to ensure that (a) blowouts are prevented and (b) if a blowout should occur the hydrocarbon flow will be quickly isolated and the rig can disconnect and reposition. The criteria for these requirements should be maximum reasonable assurance of (a) and (b) and successful crew evacuation under both scenarios. Recommendation 4.4: Industry and regulators should implement a method of design review for systemic risks for future well design that uses a framework with attributes similar to those of the Department of Defense Standard Practice for System Safety (DoD 2000), which articulates stan- dard practices for system safety for the U.S. military, to address the com- plex and integrated “system of systems” challenges faced in safely operat- ing deepwater drilling rigs. The method should take into consideration the coupled effects of well design and rig design. Recommendation 4.5: Industry should institute design improvements in systems, technology, training, and qualification to ensure that crew mem- bers are best prepared to cope with serious casualties. Recommendation 4.6: ABS should eliminate any ambiguity in its rules re- quiring that propulsion control systems for MODUs shall “in general” comply with the Steel Vessel Rules. All of the primary control and moni- toring systems and critical backup systems on these MODUs should be designed and tested to the highest standards in the industry. 5 This recommendation is repeated as Summary Recommendation 3.5.

OCR for page 142
156 Macondo Well Deepwater Horizon Blowout Recommendation 4.7: Industry should develop and implement passive or automatic methods to redirect hydrocarbon flow overboard. Ideally, the methods would include some artificial intelligence capability to evaluate the magnitude of the flow and prevailing wind. Recommendation 4.8: Recovery of main electrical power is a vital capabil- ity for MODUs. Industry should ensure that standby generator systems will be reliable and robust for automatic starting. Moreover, standby gen- erator location, controls, and power lines should be positioned to minimize the likelihood of damage from fire or explosions in the main engine room or from other casualties affecting the primary electric power system. Recommendation 4.9: Data logger systems should be designed for han- dling the bandwidth of sensor data that may arise under the most stressing casualty conditions. The systems should be able to transmit in real time to shore so that accurate records are potentially available for determination of root cause in subsequent investigation. Recommendation 4.10: Inhibition of alarms should be allowed only when approved by a senior officer in the vessel. Regulators should require that the master, OIM, and chief engineer review periodically the status of alarms and indications and take action to resolve conditions of complacent behavior. This should be a standard item of regulatory and class inspec- tions. Recommendation 4.11: Drilling rig contractors should review designs to ensure adequate redundancy in alarms and indicators in key areas of the rig. Recommendation 4.12: Drilling rig contractors should require realistic and effective training in operations and emergency situations for key personnel before assignment to any rig. Industry should also require that personnel aboard the rig achieve and maintain a high degree of expertise in their as- signed watch station, including formal qualification and periodic reexami- nation. Recommendation 4.13: Realistic simulators should be used to expose key operators to conditions of stress that are expected in major conflagrations, including heat and loss of visibility. Recommendation 4.14: Realistic major drill scenarios with independent oversight should be part of the normal routine at sea.

OCR for page 142
157 Appendix C Recommendation 4.15: Regulators should require that all permanent crew on a rig achieve a basic level of qualification in damage control and es- cape systems to ensure that all hands are able to contribute to resolving a major casualty. Recommendation 4.16: Regulators should increase the qualification re- quirements of the OIM to reflect a level of experience commensurate with the consequences of potential failure in his or her decision making. Recommendation 4.17: Definition of command at sea should be absolutely unambiguous and should not change during emergencies. Recommendation 4.18: Regulators should establish the unity of command and clearly articulate the hierarchy of roles and responsibilities of com- pany man, master, and OIM. Recommendation 4.19: Operating companies and drilling contractors should institute a certification authority, accountable to the head of the company, to act as the senior corporate official responsible and account- able for meeting the conditions set out in a safety management system. This appointment should provide a powerful voice for safe execution of operations and surety in dealing with emergencies: the official should have the authority and responsibility to stop work if necessary. Recommendation 4.20: Industry and regulators should consider relevant aspects of programs for system safety certification that were established for other safety-critical large-scale activities, such as the U.S. Navy’s Submarine Safety Program, as guidance in developing a response to the Deepwater Horizon incident. Recommendation 4.21: Industry and regulators should develop and im- plement a certification to ensure that design requirements, material condi- tion, maintenance, modernization, operating and emergency instructions, manning, and training are all effective in meeting the requirements of Recommendation 4.3 throughout the rig’s service life. Recommendation 4.22: Regulators should require that the rig, the entire sys- tem, and the crew be examined annually by an experienced and objective outside team to achieve and maintain certification in operational drilling safeguards. The consequence of unsatisfactory findings should be suspen- sion of the crew’s operation except under special supervisory conditions.

OCR for page 142
158 Macondo Well Deepwater Horizon Blowout INDUSTRY MANAGEMENT OF OFFSHORE DRILLING Finding Summary Finding 5.1: The actions, policies, and procedures of the corpo- rations involved did not provide an effective system safety approach commensurate with the risks of the Macondo well. The lack of a strong safety culture resulting from a deficient overall systems approach to safety is evident in the multiple flawed decisions that led to the blowout. Indus- trial management involved with the Macondo well–Deepwater Horizon disaster failed to appreciate or plan for the safety challenges presented by the Macondo well. Observations Summary Observation 5.1: The ability of the oil and gas industry to per- form and maintain an integrated assessment of the margins of safety for a complex well like Macondo is impacted by the complex structure of the offshore oil and gas industry and the divisions of technical expertise among the many contractors engaged in the drilling effort. Observation 5.2: Processes within the oil and gas industry to assess ade- quately the integrated risks associated with drilling a deepwater well, such as Macondo, are currently lacking. Observation 5.3: As offshore drilling extends into deeper water, its com- plexity increases. However, in-house technical capabilities within many operating companies for well drilling operations have diminished in favor of reliance on multiple contractors. This, in turn, diminishes the capacity of operations companies (the “operator”) to assess and integrate the multi- plicity of factors potentially affecting the safety of the well. Observation 5.4: The operating leaseholder company is the only entity in- volved in offshore drilling that is positioned to manage the overall system safety of well drilling and rig operations. Summary Observation 5.5: The extent of industry training of key person- nel and decision makers has been inconsistent with the complexities and risks of deepwater drilling. Observation 5.6: There are too few standardized requirements across companies for education, training, and certification of personnel involved in deepwater drilling.

OCR for page 142
159 Appendix C Summary Observation 5.7: Overall, the companies involved have not made effective use of real-time data analysis, information on precursor in- cidents or near misses, or lessons learned in the Gulf of Mexico and worldwide to adjust practices and standards appropriately. Summary Observation 5.8: Industry’s R&D efforts have been focused dis- proportionately on exploration, drilling, and production technologies as opposed to safety. Recommendations Summary Recommendation 5.1: Operating companies should have ulti- mate responsibility and accountability for well integrity, because only they are in a position to have visibility into all its aspects. Operating companies should be held responsible and accountable for well design, well construc- tion, and the suitability of the rig and associated safety equipment. Not- withstanding the above, the drilling contractor should be held responsible and accountable for the operation and safety of the offshore equipment.6 Recommendation 5.1a: Coordination of multiple contractors should be reinforced to maintain a common focus on overall safety. Recommendation 5.1b: Operating companies should develop and main- tain the proper oversight of contractor work. Summary Recommendation 5.2: Industry should greatly expand R&D ef- forts focused on improving the overall safety of offshore drilling in the ar- eas of design, testing, modeling, risk assessment, safety culture, and sys- tems integration. Such efforts should encompass well design, drilling and marine equipment, human factors, and management systems. These en- deavors should be conducted to benefit the efforts of industry and gov- ernment to instill a culture of safety. Summary Recommendation 5.3: Industry should undertake efforts to ex- pand significantly the formal education and training of industry personnel engaged in offshore drilling to support proper implementation of system safety. Recommendation 5.3a: Education of rig personnel early in their careers can be provided through a system similar to community or technical colleges. 6 This recommendation is also presented as Summary Recommendation 6.20.

OCR for page 142
160 Macondo Well Deepwater Horizon Blowout Recommendation 5.3b: In addition to rig personnel, onshore personnel involved in overseeing or supporting rig-based operations should have sufficient understanding of the fundamental processes and risks in- volved. Recommendation 5.3c: A research process is needed for establishing standardized requirements for education, training, and certification of everyone working on an offshore drilling rig. Additional standardized requirements should be established for education, training, and certifi- cation of key drilling-related personnel working offshore and onshore. Summary Recommendation 5.4: Industry and regulators should improve corporate and industrywide systems for reporting safety-related incidents. Reporting should be facilitated by enabling anonymous or “safety privi- leged” inputs. Corporations should investigate all such reports and dis- seminate their lessons-learned findings in a timely manner to all their op- erating and decision-making personnel and to the industry as a whole. A comprehensive lessons-learned repository should be maintained for indus- trywide use. This information can be used for training in accident preven- tion and continually improving standards.7 Summary Recommendation 5.5: Industry should foster an effective safety culture through consistent training, adherence to principles of human fac- tors, system safety, and continued measurement through leading indica- tors. Recommendation 5.5a: The committee endorses the concept of a “cen- ter for offshore safety” to train, monitor the work experience of, and certify (license) personnel. Leadership of the center should involve per- sons affiliated with one or more neutral organizations that are outside of the petroleum industry. Recommendation 5.5b: Effective response to a crisis situation requires teamwork to share information and perform actions. Training should involve on-site team exercises to develop competent decision making, coordination, and communication. Emergency team drills should in- volve full participation, as would be required in actual emergency situa- tions, including a well blowout. Companies should approach team training as a means of instilling overall safety as a high priority. Recommendation 5.5c: Use of training simulators similar to those ap- plied in the aerospace industry and the military should be considered. 7 This recommendation is also presented as Summary Recommendation 6.14.

OCR for page 142
161 Appendix C Approaches using simulators should include team training for coordina- tion of activities in crisis situations. Summary Recommendation 5.6: Efforts to reduce the probability of future blowouts should be complemented by capabilities of mitigating the conse- quences of a loss of well control. Industry should ensure timely access to demonstrated well-capping and containment capabilities. REGULATORY REFORM Observations Summary Observation 6.1: The regulatory regime was ineffective in ad- dressing the risks of the Macondo well. The actions of the regulators did not display an awareness of the risks or the very narrow margins of safety. Summary Observation 6.2: The extent of training of key personnel and de- cision makers in regulatory agencies has been inconsistent with the com- plexities and risks of deepwater drilling. Summary Observation 6.3: Overall, the regulatory community has not made effective use of real-time data analysis, information on precursor in- cidents or near misses, or lessons learned in the Gulf of Mexico and worldwide to adjust practices and standards appropriately. Recommendations Summary Recommendation 6.1: The United States should fully implement a hybrid regulatory system that incorporates a limited number of prescrip- tive elements into a proactive, goal-oriented risk management system for health, safety, and the environment. Recommendation 6.2: BSEE should continue to work closely with private industry and other agencies in adopting and developing comprehensive goals and standards to govern the many processes and systems involved in offshore drilling. Recommendation 6.3: BSEE should make effective use of existing indus- try standards, well-established international standards, and best practice guidelines used by other countries, but it should recognize that standards need to be updated and revised continually. Recommendation 6.4: As the SEMS program moves forward in the United States, BSEE should incorporate the steps already taken by private indus-

OCR for page 142
162 Macondo Well Deepwater Horizon Blowout try (and industry associations and consortia) to improve offshore drilling safety after the Deepwater Horizon accident. Recommendation 6.5: Quantitative risk analysis should be an essential part of goal-oriented risk management systems. Summary Recommendation 6.6: BSEE and other regulators should iden- tify and enforce safety-critical points during well construction and aban- donment that warrant explicit regulatory review and approval before op- erations can proceed. Recommendation 6.7: To augment SEMS, BSEE should work closely with private industry to develop a list of safety-critical points during well con- struction and abandonment that will require explicit regulatory review and approval before operations can proceed. Recommendation 6.8: As part of a hybrid risk management system, BSEE should establish safe operating limits, which, when exceeded, would re- quire regulatory approval for operations to proceed. Recommendation 6.9: BSEE should incorporate requirements for approval and certification of key steps during well construction into codes and stan- dards. Recommendation 6.10: BSEE should review existing codes and standards to determine which should be improved regarding requirements for (a) use of state-of-the-art technologies, especially in areas related to well con- struction, cementing, BOP functionality, and alarm and evacuation sys- tems, among others, and (b) approval and certification incumbent to man- agement of changes in original plans for well construction. Recommendation 6.11: The manner in which the above-mentioned codes and standards will be enforced should be specified by BSEE in the well plan submitted by operating companies for approval. Recommendation 6.12: BSEE should adopt a system of precertification of operators, contractors, and service companies before granting a drilling permit for especially challenging projects. Recommendation 6.13: BSEE should consider the use of independent well examiners to help in reviewing well plans and in regularly monitoring on- going activities during drilling, completion, and abandonment. Summary Recommendation 6.14: Industry, BSEE, and other regulators should improve corporate and industrywide systems for reporting safety-

OCR for page 142
163 Appendix C related incidents. Reporting should be facilitated by enabling anonymous or “safety privileged” inputs. Corporations should investigate all such re- ports and disseminate their lessons-learned findings in a timely manner to all their operating and decision-making personnel and to the industry as a whole. A comprehensive lessons-learned repository should be maintained for industrywide use. This information can be used for training in accident prevention and continually improving standards.8 Summary Recommendation 6.15: A single U.S. government agency should be designated with responsibility for ensuring an integrated approach for system safety for all offshore drilling activities. Recommendation 6.16: As a first step, DOI should work with other de- partments and agencies with jurisdiction over some aspect of offshore drilling activities to simplify and streamline the regulatory process for drilling on the U.S. outer continental shelf. Recommendation 6.17: BSEE should work with other federal agencies to delegate supporting regulatory responsibilities and accountabilities for en- suring system safety, integrating all aspects of system safety for the parts of offshore drilling operations in which a particular agency is involved. BSEE should strive to involve the domain expertise and core competen- cies of the other relevant agencies. BSEE should have purview over inte- grating regulation, inspection, and monitoring enforcement for all aspects of system safety for offshore drilling operations. Recommendation 6.18: BSEE should work with other federal agencies to develop efficient and effective mechanisms for investigating future acci- dents and incidents. Recommendation 6.19: DOI should require BSEE to provide the Secretary of the Interior with a net assessment of the risks of future drilling activities so that such risks can be factored into decisions with regard to new leases. Focusing on system safety, the assessment should be a formal probabilistic risk analysis that evaluates risks associated with all operations having the potential for significant harm to individuals, environmental damage, or economic loss. The operations addressed by the assessment should include drilling and well construction, temporary well abandonment, oil and gas production, and eventual well abandonment. Summary Recommendation 6.20: Operating companies should have ulti- mate responsibility and accountability for well integrity, because only they are in a position to have visibility into all aspects. Operating companies 8 This recommendation is also presented as Summary Recommendation 5.4.

OCR for page 142
164 Macondo Well Deepwater Horizon Blowout should be held responsible and accountable for well design, well construc- tion, and the suitability of the rig and associated safety equipment. Not- withstanding the above, the drilling contractor should be held responsible and accountable for the operation and safety of the offshore equipment.9 Recommendation 6.21: In carrying out its regulatory responsibilities, BSEE should view operating companies as taking full responsibility for the safety of offshore equipment and its use. Recommendation 6.22: While the operating company is recognized to have the principal responsibility for compliance with rules and regulations governing offshore operations, BSEE should require the partner compa- nies (as co-lease holders) to have a “see to” responsibility to ensure that the operator conducts activities in such a manner that risk is as low as rea- sonably practicable. Summary Recommendation 6.23: BSEE and other regulators should un- dertake efforts to expand significantly the formal education and training of regulatory personnel engaged in offshore drilling roles to support proper implementation of system safety. Recommendation 6.24: BSEE should exert every effort to recruit, develop, and retain experienced and capable technical experts with critical domain competencies. Summary Recommendation 6.25: BSEE and other regulators should foster an effective safety culture through consistent training, adherence to princi- ples of human factors, system safety, and continued measurement through leading indicators. Recommendation 6.26: As a regulator, BSEE should enhance its internal safety culture to provide a positive example to the drilling industry through its own actions and the priorities it establishes. REFERENCES BP. 2010. Deepwater Horizon Accident Investigation Report, http://www.bp.com/liveas- sets/bp_internet/globalbp/globalbp_uk_english/gom_response/STAGING/local_as sets/downloads_pdfs/Deepwater_Horizon_Accident_Investigation_Report.pdf. Most recently accessed Jan. 17, 2012. DNV. 2011a. Forensic Examination of Deepwater Horizon Blowout Preventer, Vols. 1 and 2 (Appendices). Final Report for U. S. Department of the Interior, Bureau of Ocean Energy Management, Regulation, and Enforcement, Washington, D.C. Re- 9 This recommendation is also presented as Summary Recommendation 5.1.

OCR for page 142
165 Appendix C port No. EP030842. http://www.boemre.gov/pdfs/maps/DNVReportVolI.pdf, http: //www.uscg.mil/hq/cg5/cg545/dw/exhib/DNV%20BOP%20report%20-%20Vol% 202%20%282%29.pdf . Most recently accessed Jan. 17, 2012. DNV. 2011b. Addendum to Final Report: Forensic Examination of Deepwater Horizon Blowout Preventer. Report No. EP030842. http://www.boemre.gov/pdfs/maps/ AddendumFinal.pdf. Most recently accessed Jan. 17, 2012. DoD. 2000. Standard Practice for System Safety. MIL-STD-882D. Feb. 10. http://www. everyspec.com/MIL-STD/MIL-STD+(0800+-+0899)/MIL_STD_882D_934/. Most recently accessed Jan. 17, 2012. USCG. 2011. Report of Investigation into the Circumstances Surrounding the Explosion, Fire, Sinking and Loss of Eleven Crew Members aboard the Mobile Offshore Drilling Unit Deepwater Horizon in the Gulf of Mexico April 20–22, 2010, Vol. I. https://www.hsdl.org/?view&did=6700. Most recently accessed Jan. 17, 2012. West Engineering Services, Inc. 2004. Shear Ram Capabilities Study for U.S. Minerals Management Service. Requisition No. 3-4025-1001. Sept. http://www.boemre.gov/ tarprojects/463/(463)%20West%20Engineering%20Final%20Report.pdf. Most re- cently accessed Jan. 17, 2012.