the path to disaster the deepwater horizon bp’s … 2013 dwh... · the path to disaster the...
TRANSCRIPT
21/08/2013
1
The Path to Disaster
The Deepwater Horizon
BP’s disaster in the Gulf of Mexico
Professor Patrick Hudson & Tim Hudson
Hudson Global Consulting 4th Annual Plexus Industrial Safety Lecture
Industrial Psychology Research Centre
14th August, 2013
Transocean
Deepwater
Horizon
21/08/2013
2
The accident
• 20th April 2010
• Hydrocarbons escaped into the well while it was being underbalanced with seawater
• The Blow Out Preventer (BOP) was activated late and failed to shut in the well
• The riser was not disconnected
• The escaping gas ignited
• 11 dead
• The drilling rig Deepwater Horizon sank after 2 days
21/08/2013
3
Conclusion
• The accident was preventable
• If BP’s Operating Management System OMS had
been applied rigorously, the temporary
abandonment could have been completed safely
• The dominant failures were associated with no
risk analyses or assessments despite major
changes and problems with the well
• The primary causes can be related back to BP’s
organizational culture
Mississippi Canyon 252
• Original plan to produce a well for an Anadarko facility
• Poor offset data– Exploration well rather than a production well
• Drilled by Transocean Marianas– The Pharos from Piper Alpha
• Marianas forced off in late 2009 after hurricane damage
• Replaced early 2010 by Deepwater Horizon
• Described as “the well from hell”
21/08/2013
4
The well
Drilling Margin
• Three factors to consider
• Pore pressure
– Formation pressure acting in on the hole
• Fracture gradient
– Point at which rock breaks with mud pressure
• Equivalent Circulating Density
– Extra pressure due to mud pump pressure
21/08/2013
5
Drilling the well
21/08/2013
6
Well Design
March 8th Dress Rehearsal
• On March 8th there was a kick (influx of hydrocarbon)
• The kick was detected late
– There were crane operations at the time
– The Sperry-Sun mud-logger was not believed
• The well was shut in successfully
• Recovery required a sidetrack
• Costs including rig time exceeded $10M
• No MIA report was made to London
• The same crew was also on board on 20th April
21/08/2013
7
Temporary Abandonment April
• Original plan to have a keeper well – to be completed for production at a later date
• The well ran out of drilling margin at 18360 ft
• Formation pressure 16,800 psi -1150 bar
• They drilled on to get below the pay-zone
• An initial plan was produced on April 12th
• Feedback was that a pressure test for integrity was missing
• The decision to set the lockdown sleeve was retained
• The temporary cement plug was to be set in seawater
Sequence of abandonment plans
21/08/2013
8
Procedure for temporary abandonment of
the well
Cementing the well
• Run long string 7” casing
• Centralize production casing to avoid channelling
• Clean out the well – bottoms up
• Convert float collar
• Pump spacer
• Pump nitrogen foamed cement
• Test well integrity
– Positive pressure test
– Negative pressure test
21/08/2013
9
Centralizers
• Centralizers are necessary to ensure the
annulus is constant, otherwise cement leaves
mud behind allowing the possibility of
hydrocarbon escaping through the mud
• Halliburton ran its Opticem software and
recommended 21 centralizers
• BP eventually ran with 6 without consulting
Halliburton
21/08/2013
10
Centralizers on the rig,
but not used
Cleaning the well
• A well needs to be cleaned by circulating mud
• Circulation also breaks gel that sets if the mud
is left alone
• Ideal and standard is 1x or 1.5x bottoms up
• Extra pumping adds pressure as an increase in
ECD
• BP rejected the Halliburton recommendation
to run a full bottoms up
21/08/2013
11
Float Collar
• A float collar is a two-way valve that can be converted to a one-way valve to ensure the cement does not flow back up the casing (U-tubing)
• The float collar has to be converted with a sufficient flow rate of mud
• This was never achieved, but conversion was accepted because of the high pressure applied to the float collar (3142 psi)
21/08/2013
12
21/08/2013
13
Debris in the shoe
BP Confidential: Horizon Investigation Update 26
Shoe – 18,304’
FC – 18,115’
TOC – 17,260’
Shoe – 17,168’
Cement
Mud
Spacer
Seawater
Influx
Cement
Mud
Spacer
Seawater
Influx
Sea Floor
ChokeBoost
BOP
Kill
Description of Event – Placement of Cement
April 19th – 20th
• 19:30 – 00:30 - Cement job pumped as planned.
• 60 bbls cement
• Foamed cement used to reduce risk of losses
• 6 inline centralizers were spaced across the
main pay
• 00:35 – 7:00 – Seal assembly installed and pressure
tested, but not locked down to wellhead. Proceeded
to preparation for positive casing test.
• ~7:30 – Decision made not to run Cement Bond Log
(CBL) premised on minimal losses and lift pressures
observed during cement displacement.
Cement
Top of Cement 17260’
Primary reservoir sands
14.17ppg SOBM
12.6ppg13.1ppg14.0ppg
12.6ppg
12.6ppg
21/08/2013
14
Pressure Test
• Positive pressure test to ascertain if the casing above the plugs will hold – Overbalance the well (i.e. pump up from above)
• Negative pressure test to ascertain whether the cement barrier is effective– Underbalance the well by removing mud and
replacing it with sea-water (pump out from above)
– If the well is safe then there should be no change in pressure through the BOP
– Proposal in MMS plan to measure on kill line rather than drill-pipe
BP Confidential: Horizon Investigation
Update28Shoe – 18,304’
FC – 18,115’
TOC – 17,260’
Shoe – 17,168’
2700PSI
Cement
Mud
Spacer
Seawater
Influx
Cement
Mud
Spacer
Seawater
Influx
Sea Floor
ChokeBoost
BOP
Kill
Description of Event - Positive Pressure Test
April 20th
• 7:00 – 12:00 - Successful positive pressure test for
production casing and seal assembly.
–Low Pressure 250 psi
–High Pressure 2700 psi
• Note: The positive test is not designed to verify
integrity of the shoe track (cement and float collar).
Drill pipe
Closed Blind Ram
BOP
2700 psi
Primary reservoir sands
12.6ppg13.1ppg14.0ppg
12.6ppg
12.6ppg
14.17ppg SOBM
21/08/2013
15
Negative Pressure Test
First Negative Pressure test
21/08/2013
16
Second Negative Pressure test
BP Confidential: Horizon Investigation
Update32
1400PSI
0PSI
Shoe – 18,304’
FC – 18,115’
TOC – 17,260’
Shoe – 17,168’
Cement
Mud
Spacer
Seawater
Influx
Cement
Mud
Spacer
Seawater
Influx
Sea Floor
ChokeBoost
BOP
Kill
Description of Event - Negative Pressure Test
April 20th
• Negative test designed to verify integrity of seal
assembly, casing, and shoe track in an underbalanced
condition. This simulates conditions for T&A and rig
demobilization.
• 12:00 – 15:04 - Reviewed displacement procedure
and commenced preparation for negative test.
• 15:04 – 15:56 – Displaced mud with sea water to
underbalance the well.
• 15:56 – 16:53 – Spacer inadvertently placed across
the BOP due to leaking annular.
• 16:53 – 17:52 – Test started by monitoring pressure
on drill pipe.
• 17:52 – 19:55 – Negative pressure test procedure
switched to monitor pressure on kill line.
– No pressure and no flow observed on the kill
line
– 1400 psi observed on the drill pipe
• 19:55 – Test was concluded to be successful.
Seawater
Drill pipe
Closed Annular BOP
Viscous Spacer
Primary reservoir sands
12.6ppg13.1ppg14.0ppg
12.6ppg
12.6ppg
14.17ppg SOBM
21/08/2013
17
BP Confidential: Horizon Investigation
Update33
Kill
Shoe – 18,304’
FC – 18,115’
TOC – 17,260’
Shoe – 17,168’
Cement
Mud
Spacer
Seawater
Influx
Cement
Mud
Spacer
Seawater
Influx
Sea Floor
ChokeBoost
BOP
Description of Event - Initial Recognition of Abnormal Well Conditions
April 20th
Note: the following details are largely based on
interpretation of data and witness statements:
• 21:31 – After completely displacing the spacer out of
the riser, the pumps were shut down.
• 21:31 – 21:34 – Rig crew discussed abnormal drill
pipe pressure increase.
• 21:36 – Rig crew bled the drill pipe to investigate the
abnormal pressure.
• 21:38 – Hydrocarbons began to enter riser.
• 21:40 – Mud overflowed the flow-line and onto rig.
• 21:41 – Mud shot up through the derrick. Rig crew
diverted to the mud gas separator (MGS) and shut the
annular BOP.
Seawater
Hydrocarbon Influx above
BOP
Primary reservoir sands
12.6ppg13.1ppg14.0ppg
12.6ppg
12.6ppg
21:41
Kick detection
21/08/2013
18
21/08/2013
19
KillBoost
Choke
BOP
Flow LinePort
Overboard Diverter Line
MudSystem
Starboard Overboard
6” VacuumBreaker
Rated to 60 psi
IBOP
Slip Joint
RotaryHose
Diverter
12” Vent
MGSMGS
Bursting Disk
Starboard Overboard
Rated to 100 or 500 psi
Hydrocarbons routed
to MGS
Diverter overboard
lines closed
MGS vented to
manned and
hazardous areas
System quickly
overwhelmed by
pressure and volume,
leading to loss of
containment
21/08/2013
20
Blowout Preventer (BOP)
Emergency Disconnect System (EDS)
21/08/2013
21
What was the immediate cause of the
blowout?
• Most common explanation in terms of failure of cement to provide an adequate barrier
– But see an alternative explanation
• With low expectations of a kick during abandonment (rather than during ordinary drilling) small and slow moving indicators were missed
• Simultaneous operations for discharging together with major crane activities made observations hard
– The Sperry-Sun mudloggers complained, but to no avail
• Transocean’s emergency structure created problems with the use of the BOP and detachment from the riser
Shoe Track & Cement
21/08/2013
22
How did this come to pass?
BP 1990 - 2010
• BP was a medium-sized North Sea operator
• 1990 John Browne appointed as CEO BP Exploration and Production (upstream)
• 1995 Browne appointed CEO British Petroleum
• Sequence of mergers, mostly in USA, to overtake Shell Group– Amoco
– Arco
– Burmah-Castrol
• Number of disasters from 2000 onward– Grangemouth, Texas City, Thunder Horse, Prudhoe Bay
– Market fixing prosecutions in USA
21/08/2013
23
Cost Cutting
• Browne instituted a rigorous discipline of cost-cutting
• This was rated as the cause of problems at both Texas City and Prudhoe Bay
• Texas City had 2 25% across the board cost reduction targets prior to the disaster
• The financial community loved Browne – The Sun King – for his financial discipline – even in an article published 20th April 2010
• Browne created a company that was loss averse, unlike its risk averse competitors (Shell and Exxon-Mobil)
• Tony Hayward continued the culture with “Every dollar counts”
2000 Grangemouth
• Number of major incidents, no fatalities
• Pleaded guilty to criminal charges
21/08/2013
24
Texas City 2005
• 15 dead, 170 severely injured, >500 wounded
• More than $ 1500 M set aside for compensation
and $ 1000 M for remediation & improvement
• Not including lost production
• BP’s Texas City refinery had a major explosion on March 23rd 2005 of the isomerization plant
21/08/2013
25
Thunder Horse 2005
• July 2005, after hurricane Dennis in the GoM, BP personnel returned to find the platform with a 20o list
• Start production in 2008, instead of original 2006 start-up
• Losses (cost and 2 years lost revenue) exceeded $10 Billion Thunder Horse Platform, Gulf of Mexico
BP Alaska Prudhoe Bay
2006
• Production losses were 400,000 bbl/day
– Total 50,000,000 bbl ($3 Billion)
• Reputation damage increased with 2nd closure
• Scrutiny from US Congress
• Fatality Nov 13
• 2006 a leak of crude (1m litres) from the North Slope to Valdez pipeline led to shutting down part of the pipeline
• A second pipeline problem emerged leading to a major shutdown of production
21/08/2013
26
Issues
• Personal vs Process safety
– Stop the Job
– Workforce did not see process safety issues as relevant (more about environment than safety)
• The contracts and safety responsibility
– Bridging documents
– Exclusion clauses
• Foamed cement slurry stability
• 1st and 2nd line kick detection
Hypothesis – they blew the bottom off it
• Proposal – backed up by logging from relief wells– Discussed by Chief Counsel but rejected for no reason
• The bottom part of the casing , shoe track, was buckled or sheared
• Transient block load of 140,000 lb (reported as 10,000) on final running of production casing– Evidence from Sperry-Sun recording of block load
– This is ± 70 tonnes (about 3 double-decker busses)
• Consequence that the cement never got near the pay-zone– Made blowout inevitable if the float collar failed
– We know the annulus cement worked
21/08/2013
27
How did this come to pass?
• Changes in well design
• Abandonment plan
• Lack of management of change
• Lack of formal risk management
• Lack of requirements for risk management
21/08/2013
28
Risk Assessments
• The risk of catastrophic loss of containment was
recognized as #1 at the Group level (London) and
SPU level (Houston)
• This was driven partly by downstream major
incidents (Texas City, Grangemouth, Prudhoe Bay)
• Macondo was downgraded from high to
moderate
• Kicks were downgraded from catastrophic loss of
containment as consequence
BP Group Risk Register
21/08/2013
29
No Drilling Surprises
21/08/2013
30
Design
• Beyond the Best, Drilling and Well Operations
Plan (DWOP) systems in place in GoM Drilling
and Completions
• gHSSEr old SMS was replaced after Texas City
by OMS (Operations Management System)
OMS
• OMS was designed after Texas City as the solution to BP’s Process Safety management problems
• Design started 2005, completed 2007
• Rollout late 2009 with USA as first wave
• Local OMS (LOMS) to be defined for specific operations
• BP assets (Texas City, Prudhoe Bay, Thunder Horse) rolled out first
• Later rollout for contractor owned assets starting 2010
21/08/2013
31
The grandfather decision
• Because MC-252 was already under
construction and was planned to be finished
by the time the Local OMS was rolled out BP
decided not to implement the LOMS on the
well and thus not subject it to the risk
management processes it mandated.
• “We decided not to grandfather it in”
Risk decisions
• Numerous risk decisions were made in the
design of the well
• Variances from technical standards were
approved by the internal technical authority
• These decisions were made by technically
competent engineers in the engineering
department and were subject to review
21/08/2013
32
Additional risk decisions
• The temporary abandonment plan was not subjected to the same level of risk assessment and not reviewed at all
• The regulator (MMS) approved the plan in less than 90 minutes
• There were several changes to the well design that weren’t subjected to formal management of change nor any form of formal risk management
• The plan implemented (Ops plan) deviated from the MMS approved plan
Risk management
• There was no process in place or in operation requiring and driving formal risk management of decisions
• There was no management oversight of the decisions being made by the well team
• The members of the well team did not have the skills to use the risk management tools provided by company
• Silos between operations and engineering meant that each was waiting for the other to initiate risk assessments
21/08/2013
33
D&C senior engineer
Q. Okay. All right. When you made the decision not to use the additional centralizers and to reposition this six existing centralizers —the subs, I believe, that you had on the rig — did you do a written risk assessment?
A. No, ma'am.
Q. Did you instruct anybody to do a written risk assessment?
A. No, ma'am.
Q. Was the risk register updated in connection with this decision?
A. Not to my knowledge.
Q. All right. And that was ultimately your responsibility, wasn't it?
A. Yes, ma'am.
D&C Well Team Leader
Q. Do you know what the BP risk assessment
tool is, the RAT?
A. Yes.
Q. Do you know how to use it?
A. No.
21/08/2013
34
Drivers
• Press-on-itis
• Infrequent post drilling kicks
• Focus on the next jobs (Nile P&A, Kaskida)
Not weak signals
• Throughout the abandonment process there
were a number of signals and inputs that
provided BP with information that there
decisions were increasing the risk of failure of
the operation
• These were disregarded for a number of
reasons
21/08/2013
35
Example Signals
• The failure to catch the March 8th kick in a
timely fashion was a signal that the well
control process was not as robust as expected
• The communication by the cementers that the
decision not to carry out a full bottoms-up and
the decision not to run all the centralizers
placed the quality of the cement job in
jeopardy
Why were they ignored?
• Lack of formal risk management processes
meant that there was an incomplete
understanding of the potential downsides of
the decisions made
• They had a purely forward looking point of
view that failed to take account of their
previous decisions that increased the overall
risk
21/08/2013
36
FIDO
• “I’m afraid we’ve blown something higher up
in the casing string.” (Well Site Leader)
• In the words of the Chief Counsel’s report,
“the rig crew proceeded onward”.
Did they take safety seriously?
• About 100 STOP cards were issued every day
• March 29th A dropped winch handle was found on the rig floor– 2 hour shutdown, team flown out specially
• A senior management visit to the rig was on the rig when it blew out– Including BP and Transocean VPs
• The problem was safety was seen as personal, rather than personal + process safety– A fire on March 28th had no equivalent response
– BP used the word Integrity rather than safety for processes
21/08/2013
37
Safety Management System (SMS)
Pro
du
ctio
n
Protection
Better defenses
converted to increased
production
21/08/2013
38
Safety Management System (SMS)
Protection
Best practice
operations
under SMS
Pro
du
ctio
n
Bly Report Swiss Cheese Picture
21/08/2013
39
Federal Judge Carl J. Barbier
Magistrate Judge Sally Sushan
The Court Case - MDL 2179
MDL 2179
• A large number of parties in civil litigation– Plaintiffs (300,000 + in Plaintiffs’ Steering Committee)
– US Department of Justice
– Louisiana, Alabama (Florida & Mississipi later)
– BP
– Transocean
– Halliburton
– MI-Swaco
– Cameron Iron works
• Separate from Criminal prosecutions– BP & Transocean pleaded guilty (only prosecutions)
21/08/2013
40
Plexus Industrial Safety Lecture Series Hosted by the Industrial Psychology Research Centre
University of Aberdeen
Details of previous Plexus lectures:
2012 Professor Stanton ‘Forensic Human Factors: Ladbroke Rail Crash’
2011 Dr Mica Endsley ‘Situation Awareness: Research and Design’
2010 Professor Erik Hollnagel ‘Resilience Engineering’
can be found on: www.abdn.ac.uk/iprc