ocean energy safety institute (oesi)oesi.tamu.edu/wp-content/uploads/2016/july/mulcahy.pdf · mary...
TRANSCRIPT
Mary Beth Mulcahy, Ph.D. [email protected] www.csb.gov
July 19, 2016
Advisory Committee Meeting
Ocean Energy Safety Institute (OESI)
Chemical Safety Board (CSB) • Independent Federal Agency
• Non-regulatory
Mission
To prevent chemical accidents
• Conducting root cause investigations
• Reporting findings publicly
• Making recommendations to organizations and agencies that can affect change • Companies
• Government Agencies (local, state and federal)
• Standard setting, i.e. American Petroleum Institute (API)
Root Cause Investigation
Technical
(equipment & engineered controls)
Organizational
(policies & procedures)
Operational
(human action)
Management System Failures
[the negative test procedure] “broad, operational guidelines” [and the crew would use] “the method consistent with their regular practice on prior wells.”
“BP was responsible
Macondo Gap
developing detailed plans as to where and how the Macondo well was to be drilled…and for obtaining approval of those plans from MMS.”
Missing Tools to Minimize the gap
• Transocean drilling team and BP well site leaders expected to deal with any problems by employing their knowledge, experience and skills. • Missing: tools that could have minimized the gap between WAI and WAD.
• Transocean did not follow its corporate policies to meaningfully engage the workforce
• (1) Transocean policies required written safety critical procedures for negative pressure test. • “The rig crew does not have to be told how to run a negative test. This
should be a routine operation that fits within their training.”—MDL Expert
• (2) Generic Deepwater Horizon safety critical procedures identified hazards focused on personal safety or relatively minor spills of drilling mud on the rig and overboard. • “But we do warn that every time we do a job, the conditions are changed.
The weather conditions may be different. The experience of the crew may be different. You have to take into account that every time you do it, it may not be exactly the same as the last time.” Transocean VP QHSE
•Modifying behavior
• Finding fault in order to blame
•Weeding out the bad apples
Human factors is NOT about
•Understanding expectations
•Determining if those expectations are reasonable
• Putting in place systems and processes that ensure those expectations can be achieved
− Design
− Planning
− Execution
Human factors IS
Pre-Macondo: Well Kick Expectations
• Crew will be able to detect gas influx into the riser soon after it occurs
• Crew will be able to determine that gas in the riser is of sufficient magnitude that it should be routed overboard
• Crew will be able to complete correct sequence of buttons on control board to send flow overboard
• System will have capacity to divert well fluids overboard
The Reality
• Company practice to pre-set route to MGS
− Well Control Manual neutral on preferred pre-set route and did not identify route-decision criteria
− Environmental penalties for discharges into water
− Mud is expensive and onsite supplies may be limited
The Reality (cont.)
• Heavy reliance on crew to make real-time decisions if/when to route overboard
• Crew did not detect influx until mud released out onto the deck
• Design required multi-step process to manually route overboard
The Reality (cont.)
• Not enough time
− Rate of gas migration depends on many factors – cannot be reliably predicted or readily detected until gas nears the surface
− Contents of the 5,000-ft (1,524-m) riser erupted on rig floor only 2-3 minutes after the BOP initially sealed the well
The Reality (cont.)
• High potential that gas volume might have overwhelmed the system anyway
• Gas-in-riser scenario not well understood
− Generally not possible to predict surface flow rates of gas-in-riser events
− Speed at which gas can propagate up riser varies
− Even with best reaction time response, system could be overwhelmed
Lessons from Diverter Analysis
• Expectations of crew may be unreasonable
• Potential technical gap, not human “failure”
• Environmental/regulatory penalties may cause drift back to original practice of MGS-routing
• Improved kick detection capabilities and further study on riser unloading events
Seemingly Insignificant Decisions
Unusual spacer
No risk assessment
Generic procedure
Equipment assumptions
Rationalization
Rationalization Riser level was not full. The level could have dropped before BOP was closed or after. After = leak past annular Before = well integrity lost Crew assumed it was after the BOP was closed. This option made more sense to them.
Post-Incident Well Data Analysis • Real-time Deepwater Horizon data indicates the drillpipe
pressure began to drop just after the crew closed an annular preventer, implying a loss of well integrity NOT leaking annular.
Why did that assumption seem more plausible?
• Challenges of well up to this point successfully overcome, reinforcing mentality that success was inevitable - Multiple loss-of-well control events - Changes to drilling plans to accommodate challenges
• Various personnel deemed the cement job successful • Positive pressure test was successful (e.g., no leaks from inside
the well to the outside) • It is “not uncommon” to see an annular leak.
Volume 3 further addresses
• HUMAN FACTORS • ORGANIZATIONAL FACTORS • SAFETY PERFORMANCE INDICATORS
• (1) Metrics of barriers and safety systems and • (2) Active monitoring of real-time barrier indicators meant to
drive daily decisions, as well as slow moving management system indicators.
• RISK MANAGEMENT PRACTICES • The complexity of the operator-contractor relationship can
lead to vaguely defined safety roles for both parties. • CORPORATE GOVERNANCE
Volume 3 further addresses • SAFETY CULTURE
• Poor adherence to their own corporate major hazard management policies, which were stronger than regulatory requirements;
• Inadequate individual performance contracts and bonus structures with limited inclusion of process safety goals
• Inadequate development and usage of relevant process safety performance indicators
• Failed efforts aimed toward bridging major risks
Volume 4 further addresses
• US OFFSHORE SAFETY REGULATION DURING AND AFTER MACONDO
• ATTRIBUTES OF AN EFFECTIVE REGULATOR AND REGULATORY SYSTEM