Chapter Four Source: Deepwater: The Gulf Oil disaster & the future of offshore drilling (2011), Report to the President, Commission on the BP Deepwater Oil spill and Offshore drilling, January, 2011. “But, who cares, it’s done, end of story, [we] will probably be fine and we’ll get a good cement job.” The Macondo Well and the Blowout Introduction In March 2008, BP paid a little over $34 million to the Minerals Management Service for an exclusive lease to drill in Mississippi Canyon Block 252, a nine-square-mile plot in the Gulf of Mexico. Although the Mississippi Canyon area has many productive oil fields, BP knew relatively little about the geology of Block 252: Macondo would be its first well on the new lease. BP planned to drill the well to 20,200 feet, both to learn more about the geology of the area and because it thought—based on available geological data—that it might find an oil and gas reservoir that would warrant installing production equipment at the well.1 At the time, BP would have had good reason to expect that the well would be capable of generating a large profit. Little more than two years later, however, BP found itself paying out tens of billions of dollars to contain a blowout at the Macondo well, mitigate the damage resulting from the millions of gallons of oil flowing from that well into the Gulf of Mexico, and compensate the hundreds of thousands of individuals and businesses harmed by the spill. And that is likely just the beginning. BP, its partners (Anadarko and MOEX), and its key contractors (particularly Halliburton and Transocean) face potential liability for the billions more necessary to restore natural resources harmed by the spill. The well blew out because a number of separate risk factors, oversights, and outright mistakes combined to overwhelm the safeguards meant to prevent just such an event from happening. But most of the mistakes and oversights at Macondo can be traced back to a single overarching failure—a failure of management. Better management by BP, Halliburton, and Transocean would almost certainly have prevented the blowout by improving the ability of individuals involved to identify the risks they faced, and to properly evaluate, communicate, and address them. A blowout in deepwater was not a statistical inevitability. The Challenges of Deepwater Drilling at the Macondo Well High Pressures and Risk of a Well Blowout The principal challenge in deepwater drilling is to drill a path to the hydrocarbon-filled pay zone in a manner that simultaneously controls these enormous pressures and avoids fracturing the geologic formation in which the reservoir is found. It is a delicate balance. The drillers must balance the reservoir pressure (pore pressure) pushing hydrocarbons into the well with counter-pressure from inside the wellbore. If too much counter-pressure is used, the formation can be fractured. But if too little counter-pressure is used, the result can be an uncontrolled intrusion of hydrocarbons into the well, and a discharge from the well itself as the oil and gas rush up and out of the well. An uncontrolled discharge is known as a blowout. Drill Pipe, Mud, Casing, Cement, and Well Control Those drilling in deepwater, just like those drilling on land, use drill pipe, casing, mud, and cement in a series of carefully calibrated steps to control pressure while drilling thousands of feet below the seafloor to reach the pay zone. Drilling mud, which is used to lubricate and cool the drill bit during drilling, plays a critical role in controlling the hydrocarbon pressure in a well. The weight of the column of mud in a well exerts pressure that counterbalances the pressure in the hydrocarbon formation. If the mud weight is too low, fluids such as oil and gas can enter the well, causing what is known as a “kick.” But if the mud weight is too high, it can fracture the surrounding rock, potentially leading to “lost returns”—leakage of the mud into the formation. The rig crew therefore monitors and adjusts the weight (density) of the drilling mud as the well is being drilled—one of many sensitive, technical tasks requiring special equipment and the interpretation of data from difficult drilling environments. Casing strings, which are a series of steel tubes installed to line the well as the drilling progresses, also help to control pressures. First, they protect more fragile sections of the well structure outside the casing from the pressure of the mud inside. Second, they prevent high-pressure fluids (like hydrocarbons) outside the casing from entering the wellbore and flowing up the well. To secure the casing, crews pump in cement to seal the space between the casing and the wellbore. If a completed well can yield economically valuable oil and gas, the crews can initiate production by punching holes through the casing and surrounding cement to allow hydrocarbons to flow into the well. Designed and used properly, drilling mud, cement, and casing work together to enable the crew to control wellbore pressure. If they fail, the crew can, in an emergency, close powerful blowout-preventer valves that should seal off the well at the wellhead. Deepwater Horizon Arrives and Resumes Drilling the Well After purchasing the rights to drill in Block 252, BP became the legal “operator” for any activities on that block. But BP neither owned the rigs, nor operated them in the normal sense of the word. Rather, the company’s Houston-based engineering team designed the well and specified in detail how it was to be drilled. A team of specialized contractors would then do the physical work of actually drilling the well—a common industry practice. Transocean, a leading owner of deepwater drilling rigs, would provide BP with a rig and the crew to run it. Two BP “Well Site Leaders” (the “company men”) would be on the rig at all times to direct the crew and contractors and their work, and would maintain regular contact with the BP engineers on shore. When the Deepwater Horizon arrived, its first task was to lower its giant blowout preventer (BOP) onto the wellhead that the Marianas had left behind. The BOP is a stack of enormous valves that rig crews use both as a drilling tool and as an emergency safety device. Once it is put in place, everything needed in the well—drilling pipe, bits, casing, and mud—passes through the BOP. Every drilling rig has its own BOP, which its crew must test before and during drilling operations. After a week of surface testing, the Deepwater Horizon rig crew lowered the 400-ton device down through a mile of seawater and used a remotely operated vehicle (ROV) to guide it so that it could be latched onto the wellhead below. FIGURE 4.1: Macondo Well Schematic “Lost Circulation” Event at the Pay Zone, and a Revised Plan for the Well By early April, the Deepwater Horizon crew had begun to penetrate the pay zone—the porous hydrocarbon-bearing rock that BP had hoped to find. But on April 9, they suffered a setback. At 18,193 feet below sea level, the pressure exerted by the drilling mud exceeded the strength of the formation. Mud began flowing into cracks in the formation instead of returning to the rig. The rig had to stop drilling until the crew could seal the fracture and restore mud circulation. Preparing the Well for Subsequent Production The engineers recognized that the lost circulation problems and delicacy of the rock formation at the bottom of the well would make it challenging to install the production casing. After the rig crew lowered the casing into its final position, Halliburton would cement it into place. Halliburton would pump a specialized cement blend down the inside of the casing string; when it reached the end of the casing, cement would flow out the bottom and up into the annular space between the casing and the sides of the open hole. Once cured, the cement would bond to the formation and the casing and—if all went well—seal off the annular space. BP and Halliburton had cemented the previous casing strings at Macondo, and this cement job would be particularly important. The first attempt at cementing any casing string is commonly called the primary cement job. For a primary cement job to be successful, it must seal off, or “isolate,” the hydrocarbon-bearing zone from the annular space around the casing and from the inside of the casing itself. The Engineers Select a “Long String” Casing BP’s design team originally had planned to use a “long string” production casing—a single continuous wall of steel between the wellhead on the seafloor, and the oil and gas zone at the bottom of the well. But after the lost circulation event, they were forced to reconsider. As another option, they evaluated a “liner”—a shorter string of casing hung lower in the well and anchored to the next higher string. (Figure 4.2) A liner would result in a more complex—and theoretically more leak-prone—system over the life of the well. But it would be easier to cement into place at Macondo. FIGURE 4.2: “Long String” vs. “Liner” Lowering the Casing String Into Position Early on the morning of April 18, with a centralizer plan in hand, the rig crew finally began assembling and lowering the long string into position. The leading end of the casing, the “shoe track,” began with a “reamer shoe”—a bullet-shaped piece of metal with three holes designed to help guide the casing down the hole. (Figure 4.4) The reamer shoe was followed by 180 feet of seven-inch-diameter steel casing. Then came a Weatherford manufactured “float collar,” a simple arrangement of two flapper (float) valves, spaced one after the other, held open by a short “auto-fill tube” through which the mud in the well could flow. As the long string was lowered down the wellbore, the mud passed through the holes in the reamer shoe and auto-fill tube that propped open the float valves, giving it a clear flow path upward. Preparation for Cementing—and Unexpected Pressure Anomalies in the Well During the cementing process, fluids pumped into the well should flow in a one-way path: down the center of the last casing string, out the bottom, and up the annulus (between the exterior of the steel casing and the surrounding rock formations). To ensure unidirectional flow, the crew needed to push the auto-fill tube downward, so it would no longer prop open the float valves. Once the float valves had converted, Halliburton could pump cement down through the casing and up around the annulus; the valves would keep cement from flowing back up the casing once the crew stopped pumping. BP’s team concluded that the float valves had converted, but noted another anomaly. The drilling-mud subcontractor, M-I SWACO, had predicted that it would take a pressure of 570 psi to circulate mud after converting the float valves.27 Instead, the rig crew reported that circulation pressure was much lower: only 340 psi. BP’s Well Site Leader Bob Kaluza expressed concern about low circulating pressure.28 He and the Transocean crew switched circulating pumps to see if that made a difference, and eventually concluded that the pressure gauge they had been relying on was broken.29 Believing they had converted the float valves and reestablished mud circulation in the well, BP was ready at last to pump cement down the production casing and complete the primary cement job. The Inherently Uncertain Cementing Process Cementing an oil well is an inherently uncertain process. To establish isolation across a hydrocarbon zone at the bottom of a well, engineers must send a slug of cement down the inside of the well. They then pump mud in after it to push the cement down until it “turns the corner” at the bottom of the well and flows up into the annular space. If done properly, the slug of cement will create a long and continuous seal around the production casing, and will fill the shoe track in the bottom of the final casing string. But things can go wrong even under optimal conditions. If the cement is pumped too far or not far enough, it may not isolate the hydrocarbon zones. If oil-based drilling mud contaminates the water-based cement as the cement flows down the well, the cement can set slowly or not at all. And, as previously noted, the cement can “channel,” filling the annulus unevenly and allowing hydrocarbons to bypass cement in the annular space. Given the variety of things that can go wrong with a cement job, it is hardly surprising that a 2007 MMS study identified cementing problems as one of the “most significant factors” leading to blowouts between 1992 and 2006. Even following best practices, a cement crew can never be certain how a cement job at the bottom of the well is proceeding as it is pumped. Cement does its work literally miles away from the rig floor, and the crew has no direct way to see where it is, whether it is contaminated, or whether it has sealed off the well. To gauge progress, the crew must instead rely on subtle, indirect indicators like pressure and volume: they know how much cement and mud they have sent down the well and how hard the pumps are working to push it. The crew can use these readings to check whether each barrel of cement pumped into the well displaces an equal volume of drilling mud—producing “full returns.” While they suggest generally that the job has gone as planned, these indicators say little specific about the location and quality of the cement at the bottom of the well. None of them can take the place of pressure testing and cement evaluation logging. Evaluating the Cementing Job Transocean’s rig crew and Halliburton’s cementers finished pumping the primary cement job at 12:40 a.m. on April 20.48 Once the pumps were off, a BP representative and Vincent Tabler of Halliburton performed a check to see whether the float valves were closed and holding. They opened a valve at the cementing unit to see whether any fluid flowed from the well. If more fluid came back than expected, that would indicate that cement was migrating back up into the casing and pushing the fluids above it out of the top of the well. Models had predicted 5 barrels of flow back. According to Brian Morel, the two men observed 5.5 barrels of flow, tapering off to a “finger tip trickle.”49 According to Morel, 5.5 barrels of flow-back volume was within the acceptable margin for error.50 Tabler testified that they watched flow “until it was probably what we call a pencil stream,” which stopped, started up again, and then stopped altogether.51 While it is not clear how long the two men actually watched for potential flow, they eventually concluded the float valves were holding. With no lost returns, BP and Halliburton declared the job a success. Nathaniel Chaisson, one of Halliburton’s crew on the rig, sent an e-mail to Jesse Gagliano at 5:45 a.m. saying, “We have completed the job and it went well.”52 He attached a detailed report stating that the job had been “pumped as planned” and that he had seen full returns throughout the process.53 And just before leaving the rig, Morel e-mailed the rest of the BP team to say “the Halliburton cement team . . . did a great job.” The primary criterion BP appears to have used to determine whether to perform the cement evaluation test was whether there were “[l]osses while cementing [the] long string.” Having seen no lost returns during the cement job, BP sent the Schlumberger team home and moved on to prepare the well for temporary abandonment. Temporary Abandonment and Preparing to Move On to the Next Job Once BP decided to send the Schlumberger team home, Deepwater Horizon’s crew began the final phase of its work. Drilling the Macondo well had required a giant offshore rig of Deepwater Horizon’s capabilities. By contrast, BP, like most operators, would give the job of “completing” the well to a smaller (and less costly) rig, which would install hydrocarbon-collection and -production equipment. To make way for the new rig, the Deepwater Horizon would have to remove its riser and blowout preventer from the wellhead—and before it could do those things, the crew had to secure the well through a process called “temporary abandonment.” At 10:43 a.m., Morel e-mailed an “Ops Note” to the rest of the Macondo team listing the temporary abandonment procedures for the well. It was the first time the BP Well Site Leaders on the rig had seen the procedures they would use that day. BP first shared the procedures with the rig crew at the 11 a.m. pre-tour meeting that morning. The basic sequence was as follows: ⦁ Perform a positive-pressure test to test the integrity of the production casing; ⦁ Run the drill pipe into the well to 8,367 feet (3,300 feet below the mud line); ⦁ Displace 3,300 feet of mud in the well with seawater, lifting the mud above the BOP and into the riser; ⦁ Perform a negative-pressure test to assess the integrity of the well and bottom-hole cement job to ensure outside fluids (such as hydrocarbons) are not leaking into the well; ⦁ Displace the mud in the riser with seawater; ⦁ Set the surface cement plug at 8,367 feet; and ⦁ Set the lockdown sleeve. The crew would never get through all of the steps in the procedure. Countdown to Blowout The first step in the temporary abandonment was to test well integrity: to make sure there were no leaks in the well. The Positive-Pressure Test The positive-pressure test evaluates, among other things, the ability of the casing in the well to hold in pressure. MMS regulations require a positive-pressure test prior to temporary abandonment.65 To perform the test at Macondo, the Deepwater Horizon’s crew first closed off the well below the BOP by shutting the blind shear ram (there was no drill pipe in the well at the time). Then, much like pumping air into a bike tire to check for leaks, the rig crew pumped fluids into the well (through pipes running from the rig to the BOP) to generate pressure and then checked to see if it would hold. The crew started the positive-pressure test at noon. They pressured the well up to 250 psi for 5 minutes, and then pressured up to 2,500 psi and watched for 30 minutes. The pressure inside the well remained steady during both tests, showing there were no leaks in the production casing through which fluids could pass from inside the well to the outside. The drilling crew and BP’s Well Site Leader Bob Kaluza considered the test successful. Later in the afternoon, Kaluza showed visiting BP executive Pat O’Bryan the pressure chart from the test; O’Bryan remarked, “Things looked good with the positive test.” The Negative-Pressure Test: Unexpected Pressure Readings The negative-pressure test checks not only the integrity of the casing, like the positive pressure test, but also the integrity of the bottomhole cement job. At the Macondo well, the negative-pressure test was the only test performed that would have checked the integrity of the bottomhole cement job. If the test showed that hydrocarbons would leak into the well once it was underbalanced, BP would need to diagnose and fix the problem (perhaps remediating the cement job) before moving on, a process that could take many days. While drilling crews routinely use water-based spacer fluids to separate oil-based drilling mud from seawater, the spacer BP chose to use during the negative pressure test was unusual. At BP’s direction, M-I SWACO combined the materials to create an unusually large volume of spacer that had never previously been used by anyone on the rig or by BP as a spacer, nor been thoroughly tested for that purpose. The Transocean crew and BP Well Site Leaders met on the rig floor to discuss the readings. According to Lambert, Anderson explained that heavy mud in the riser was exerting pressure on the annular preventer, which in turn transmitted pressure to the drill pipe. Lambert said that he did not recall anyone agreeing or disagreeing with Anderson’s explanation. According to Harrell, after a lengthy discussion, BP Well Site Leader Vidrine then insisted on running a second negative-pressure test, this time monitoring pressure and flow on the kill line rather than the drill pipe. (The kill line is one of three pipes, each approximately 3 inches in diameter, that run from the rig to the BOP to allow the crew to circulate fluids into and out of the well at the sea floor.) The pressure on the kill line during the negative pressure test should have been identical to the pressure on the drill pipe, as both flow paths went to the same place (and both should have been filled with seawater). Vidrine apparently insisted the negative test be repeated on the kill line because BP had specified that the test would be performed on the kill line in a permit application it submitted earlier to MMS. Displacing Mud from the Riser—and Mounting Signs of a Kick At 8:02 p.m., the crew opened the annular preventer and began displacing mud and spacer from the riser. Halliburton cementer Chris Haire went to the drill shack to check on the status of the upcoming surface cement plug job. Revette and Anderson told him the negative-pressure test had been successful and that Haire should prepare to set the surface cement plug. At 9:39 p.m., drill-pipe pressure shifted direction and started decreasing. In retrospect, this was a very bad sign. It likely meant that lighter-weight hydrocarbons were now pushing heavy drilling mud out of the way up the casing past the drill pipe. Diversion and Explosion Sometime between 9:40 and 9:43 p.m., drilling mud began spewing from the rotary onto the rig floor. This appears to have been the first moment Revette or others realized that a kick had occurred. At about that time, Anderson and assistant driller Stephen Curtis returned to the rig floor. The men took immediate action but their efforts were futile. By the time the rig crew acted, gas was already above the BOP, rocketing up the riser, and expanding rapidly. At the Commission’s November 8, 2010, hearing, a representative from Transocean likened it to “a 550-ton freight train hitting the rig floor,” followed by what he described as “a jet engine’s worth of gas coming out of the rotary.” The flow from the well quickly overwhelmed the mud-gas separator system. Ignition and explosion were all but inevitable. The first explosion occurred at approximately 9:49 p.m. On the drilling floor, the Macondo disaster claimed its first victims. The Well is Not Sealed by the Blowout Preventer The BOP is designed to contain pressure within the wellbore and halt an uncontrolled flow of hydrocarbons to the rig. The Deepwater Horizon’s BOP did not succeed in containing the Macondo well. After the first explosion, crewmembers on the bridge attempted to engage the rig’s emergency disconnect system (EDS). The EDS should have closed the blind shear ram, severed the drill pipe, sealed the well, and disconnected the rig from the BOP. But none of that happened. Amid confusion on the bridge, and initial hesitancy from Captain Kuchta, subsea supervisor Chris Pleasant rushed to the main control panel and pushed the EDS button. Although the panel indicators lit up, the rig never disconnected. It is possible that the first explosion had already damaged the cables to the BOP, preventing the disconnect sequence from starting. Even so, the BOP’s automatic mode function (the “deadman” system) should have triggered the blind shear ram after the power, communication, and hydraulics connections between the rig and the BOP were cut. But the deadman failed too. Although it is too early to tell at this point, this failure may have been due to poor maintenance. Post-incident testing of the two redundant “pods” that control the deadman revealed low battery charges in one pod and defective solenoid valves in the other. If those problems existed at the time of the blowout, they would have prevented the deadman system from working. The Immediate Causes of the Macondo Well Blowout As this narrative suggests, the Macondo blowout was the product of several individual missteps and oversights by BP, Halliburton, and Transocean, which government regulators lacked the authority, the necessary resources, and the technical expertise to prevent. We may never know the precise extent to which each of these missteps and oversights in fact caused the accident to occur. Certainly we will never know what motivated the final decisions of those on the rig who died that night. What we nonetheless do know is considerable and significant: (1) each of the mistakes made on the rig and onshore by industry and government increased the risk of a well blowout; (2) the cumulative risk that resulted from these decisions and actions was both unreasonably large and avoidable; and (3) the risk of a catastrophic blowout was ultimately realized on April 20 and several of the mistakes were contributing causes of the blowout. The immediate cause of the Macondo blowout was a failure to contain hydrocarbon pressures in the well. Three things could have contained those pressures: the cement at the bottom of the well, the mud in the well and in the riser, and the blowout preventer. But mistakes and failures to appreciate risk compromised each of those potential barriers, steadily depriving the rig crew of safeguards until the blowout was inevitable and, at the very end, uncontrollable. Cementing Long string casing vs. liner. BP’s decision to employ a long string was not unprecedented. Long strings are used with some frequency by other operators in the Gulf of Mexico, although not very often at wells like Macondo—a deepwater well in an unfamiliar geology requiring a finesse cement job. It is not clear whether the decision to use a long string well design contributed directly to the blowout: But it did increase the difficulty of obtaining a reliable primary cement job in several respects, and primary cement failure was a direct cause of the blowout. The long string decision should have led BP and Halliburton to be on heightened alert for any signs of primary cement failure. Number of centralizers. The evidence to date does not unequivocally establish whether the failure to use 15 additional centralizers was a direct cause of the blowout. But the process by which BP arrived at the decision to use only six centralizers at Macondo illuminates the flaws in BP’s management and design procedures, as well as poor communication between BP and Halliburton. Float-valve conversion and circulating pressure. Whether the float valves converted, let alone whether “unconverted” float valves contributed to the eventual blowout, has not yet been, and may never be, established with certainty. But, what is certain is that BP’s team again failed to take time to consider whether and to what extent the anomalous pressure readings may have indicated other problems or increased the risk of the upcoming cement job. Cement evaluation log decision. The BP team erred by focusing on full returns as the sole criterion for deciding whether to run a cement evaluation log. Receiving full returns was a good indication that cement or other fluids had not been lost to the weakened formation. But full returns provided, at best, limited or no information about: (1) the precise location where the cement had ended up; (2) whether channeling had occurred; (3) whether the cement had been contaminated; or (4) whether the foam cement had remained stable. Although other indicators—such as on-time arrival of the cement plugs and observation of expected lift pressure—were reassuring, they too provided limited information. Other cement evaluation tools could have provided more direct information about cementing success. Foam cement testing. As explained in an October letter written by the Commission’s Chief Counsel, independent cement testing conducted by Chevron strongly suggests the foam cement slurry used at Macondo was unstable.135 As it turned out, Chevron’s tests were consistent with several of Halliburton’s own internal test results, some of which appear never to have been reported to BP. Risk evaluation of Macondo cementing decisions and procedures. BP’s fundamental mistake was its failure—notwithstanding the inherent uncertainty of cementing and the many specific risk factors surrounding the cement job at Macondo—to exercise special caution (and, accordingly, to direct its contractors to be especially vigilant) before relying on the primary cement as a barrier to hydrocarbon flow. Those decisions and risk factors included, among other things: ⦁ Difficult drilling conditions, including serious lost returns in the cementing zone; ⦁ Difficulty converting float equipment and low circulating pressure after purported conversion; ⦁ No bottoms up circulation; ⦁ Less than recommended number of centralizers; ⦁ Low rate of cement flow; and ⦁ Low cement volume. Based on evidence currently available, there is nothing to suggest that BP’s engineering team conducted a formal, disciplined analysis of the combined impact of these risk factors on the prospects for a successful cement job. There is nothing to suggest that BP communicated a need for elevated vigilance after the job. And there is nothing to indicate that Halliburton highlighted to BP or others the relative difficulty of BP’s cementing plan before, during, or after the job, or that it recommended any post-cementing measures to confirm that the primary cement had in fact isolated the high-pressure hydrocarbons in the pay zone. Negative-Pressure Test Even when there is no reason for concern about a cement job, a negative-pressure test is “very important.”139 By sending Schlumberger’s cement evaluation team back to shore, BP chose to rely entirely on the negative-pressure test to directly evaluate the integrity of the primary cement at Macondo. The Commission has identified a number of potential factors that may have contributed to the failure to properly conduct and interpret the negative pressure test that night: ⦁ First, there was no standard procedure for running or interpreting the test in either MMS regulations or written industry protocols. Indeed, the regulations and standards did not require BP to run a negative-pressure test at all. ⦁ Second, BP and Transocean had no internal procedures for running or interpreting negative-pressure tests, and had not formally trained their personnel in how to do so. ⦁ Third, the BP Macondo team did not provide the Well Site Leaders or rig crew with specific procedures for performing the negative-pressure test at Macondo. ⦁ Fourth, BP did not have in place (or did not enforce) any policy that would have required personnel to call back to shore for a second opinion about confusing data. ⦁ Finally, due to poor communication, it does not appear that the men performing and interpreting the test had a full appreciation of the context in which they were performing it. Such an appreciation might have increased their willingness to believe the well was flowing. Context aside, however, individuals conducting and interpreting the negative-pressure test should always do so with an expectation that the well might lack integrity. Temporary Abandonment Procedures Another factor that may have contributed to the blowout was BP’s temporary abandonment procedure. The most troubling aspect of BP’s temporary abandonment procedure was BP’s decision to displace mud from the riser before setting the surface cement plug or other barrier in the production casing. During displacement of the riser, the BOP would be open, leaving the cement at the bottom of the well (in the annulus and shoe track) as the only physical barrier to flow up the production casing between the pay zone and the rig. Relying so heavily on primary cement integrity put a significant premium on the negative-pressure test and well monitoring during displacement, both of which are subject to human error. BP’s decision under these circumstances to displace mud from the riser before setting another barrier unnecessarily and substantially increased the risk of a blowout. BP could have set the surface cement plug, or a mechanical plug, before displacing the riser. BP could have replaced the mud in the wellbore with heavier mud sufficient to overbalance the well. It is not apparent why BP chose not to do any of these things. Kick Detection The drilling crew and other individuals on the rig also missed critical signs that a kick was occurring. The crew could have prevented the blowout—or at least significantly reduced its impact—if they had reacted in a timely and appropriate manner. What is not now clear is precisely why the crew missed these signals. Diversion and Blowout Preventer Activation The crew should have diverted the flow overboard when mud started spewing from the rig floor. While that ultimately may not have prevented an explosion, diverting overboard would have reduced the risk of ignition of the rising gas. Considering the circumstances, the crew also should have activated the blind shear ram to close in the well. Diverting the flow overboard and/or activating the blind shear ram may not have prevented the explosion, but likely could have given the crew more time and perhaps limited the impact of the explosion. There are a few possible explanations for why the crew did neither: ⦁ First, they may not have recognized the severity of the situation, though that seems unlikely given the amount of mud that spewed from the rig floor. ⦁ Second, they did not have much time to act. The explosion occurred roughly six to eight minutes after mud first emerged onto the rig floor. ⦁ Finally, and perhaps most significantly, the rig crew had not been trained adequately how to respond to such an emergency situation. In the future, well-control training should include simulations and drills for such emergencies—including the momentous decision to engage the blind shear rams or trigger the EDS. The Root Causes: Failures in Industry and Government Overarching Management Failures by Industry Whatever irreducible uncertainty may persist regarding the precise contribution to the blowout of each of several potentially immediate causes, no such uncertainty exists about the blowout’s root causes. The blowout was not the product of a series of aberrational decisions made by rogue industry or government officials that could not have been anticipated or expected to occur again. Rather, the root causes are systemic and, absent significant reform in both industry practices and government policies, might well recur. The missteps were rooted in systemic failures by industry management (extending beyond BP to contractors that serve many in the industry), and also by failures of government to provide effective regulatory oversight of offshore drilling. The most significant failure at Macondo—and the clear root cause of the blowout—was a failure of industry management. Most, if not all, of the failures at Macondo can be traced back to underlying failures of management and communication. Better management of decision making processes within BP and other companies, better communication within and between BP and its contractors, and effective training of key engineering and rig personnel would have prevented the Macondo incident. BP and other operators must have effective systems in place for integrating the various corporate cultures, internal procedures, and decision-making protocols of the many different contractors involved in drilling a deepwater well. BP’s management process did not adequately identify or address risks created by late changes to well design and procedures. BP did not have adequate controls in place to ensure that key decisions in the months leading up to the blowout were safe or sound from an engineering perspective. While initial well design decisions undergo a serious peer review process and changes to well design are subsequently subject to a management of change (MOC) process, changes to drilling procedures in the weeks and days before implementation are typically not subject to any such peer-review or MOC process. At Macondo, such decisions appear to have been made by the BP Macondo team in ad hoc fashion without any formal risk analysis or internal expert review. This appears to have been a key causal factor of the blowout. There is no readily discernible reason why these temporary abandonment procedures could not have been more thoroughly and rigorously vetted earlier in the design process. It does not appear that the changes to the temporary abandonment procedures went through any sort of formal review at all. Halliburton and BP’s management processes did not ensure that cement was adequately tested. Halliburton had insufficient controls in place to ensure that laboratory testing was performed in a timely fashion or that test results were vetted rigorously in-house or with the client. In fact, it appears that Halliburton did not even have testing results in its possession showing the Macondo slurry was stable until after the job had been pumped. It is difficult to imagine a clearer failure of management or communication. The story of the foam stability tests may illuminate management problems within BP as well. By early April, BP team members had recognized the importance of timely cement testing. And by mid-April, BP’s team had identified concerns regarding the timeliness of Halliburton’s testing process. But despite their recognition that final changes to the cement design (made to accommodate their concerns about lost returns) might increase the risks of foam instability, BP personnel do not appear to have insisted that Halliburton complete its foam stability tests let alone report the results to BP for review—before ordering primary cementing to begin. BP, Transocean, and Halliburton failed to communicate adequately. Information appears to have been excessively compartmentalized at Macondo as a result of poor communication. BP did not share important information with its contractors, or sometimes internally even with members of its own team. Contractors did not share important information with BP or each other. As a result, individuals often found themselves making critical decisions without a full appreciation for the context in which they were being made (or even without recognition that the decisions were critical). For example, many BP and Halliburton employees were aware of the difficulty of the primary cement job. But those issues were for the most part not communicated to the rig crew that conducted the negative-pressure test and monitored the well. It appears that BP did not even communicate many of those issues to its own personnel on the rig—in particular to Bob Kaluza, who was on his first hitch as a Well Site Leader on the Deepwater Horizon. Similarly, it appears at this time that the BP Well Site Leaders did not consult anyone on shore about the anomalous data observed during the negative-pressure test. Had they done so, the Macondo blowout may not have happened. Transocean failed to adequately communicate lessons from an earlier near-miss to its crew. Transocean failed to adequately communicate to its crew lessons learned from an eerily similar near-miss on one of its rigs in the North Sea four months prior to the Macondo blowout. On December 23, 2009, gas entered the riser on that rig while the crew was displacing a well with seawater during a completion operation. As at Macondo, the rig’s crew had already run a negative-pressure test on the lone physical barrier between the pay zone and the rig, and had declared the test a success. The tested barrier nevertheless failed during displacement, resulting in an influx of hydrocarbons. Mud spewed onto the rig floor—but fortunately the crew was able to shut in the well before a blowout occurred. Nearly one metric ton of oil-based mud ended up in the ocean. The incident cost Transocean 11.2 days of additional work and more than 5 million British pounds in expenses. Transocean subsequently created an internal PowerPoint presentation warning that “[t]ested barriers can fail” and that “risk perception of barrier failure was blinkered by the positive inflow test [negative test].” The presentation noted that “[f]luid displacements for inflow test [negative test] and well clean up operations are not adequately covered in our well control manual or adequately cover displacements in under balanced operations.” It concluded with a slide titled “Are we ready?” and “WHAT IF?” containing the bullet points: “[h]igh vigilance when reduced to one barrier underbalanced,” “[r]ecognise when going underbalanced—heightened vigilance,” and “[h]ighlight what the kick indicators are when not drilling.” Transocean eventually sent out an “operations advisory” to some of its fleet (in the North Sea) on April 14, 2010, reiterating many of the lessons learned and warnings from the presentation. It set out “mandatory” actions to take, acknowledging a “Lack of Well Control preparedness during completion phase,” requiring that “[s]tandard well control practices must be maintained through the life span of the well” and stating that “[w]ell programs must specify operations where a single mechanical barrier . . . is in effect and a warning must be included to raise awareness. . . .”. The language in this “advisory” is less pointed and vivid than the language in the earlier PowerPoint. Moreover, according to Transocean, neither the PowerPoint nor this advisory ever made it to the Deepwater Horizon crew. Transocean has suggested that the North Sea incident and advisory were irrelevant to what happened in the Gulf of Mexico. The December incident in the North Sea occurred during the completion phase and involved failure of a different tested barrier. Those are largely cosmetic differences. The basic facts of both incidents are the same. Had the rig crew been adequately informed of the prior event and trained on its lessons, events at Macondo may have unfolded very differently. FIGURE 4.10: Examples of Decisions That Increased Risk At Macondo While Potentially Saving Time Decision-making processes at Macondo did not adequately ensure that personnel fully considered the risks created by time- and money-saving decisions. Whether purposeful or not, many of the decisions that BP, Halliburton, and Transocean made that increased the risk of the Macondo blowout clearly saved those companies significant time (and money). There is nothing inherently wrong with choosing a less-costly or less-time-consuming alternative—as long as it is proven to be equally safe. The problem is that, at least in regard to BP’s Macondo team, there appears to have been no formal system for ensuring that alternative procedures were in fact equally safe. None of BP’s (or the other companies’) decisions in Figure 4.10 appear to have been subject to a comprehensive and systematic risk-analysis, peer-review, or management of change process. The evidence now available does not show that the BP team members (or other companies’ personnel) responsible for these decisions conducted any sort of formal analysis to assess the relative riskiness of available alternatives. Corporations understandably encourage cost-saving and efficiency. But given the dangers of deepwater drilling, companies involved must have in place strict policies requiring rigorous analysis and proof that less-costly alternatives are in fact equally safe. If BP had any such policies in place, it does not appear that its Macondo team adhered to them. Unless companies create and enforce such policies, there is simply too great a risk that financial pressures will systematically bias decision-making in favor of time- and cost savings. It is also critical (as described in greater length in Chapter 8) that companies implement and maintain a pervasive top-down safety culture (such as the ones described by the ExxonMobil and Shell CEOs at the Commission’s hearing on November 9, 2010) that reward employees and contractors who take action when there is a safety concern even though such action costs the company time and money. Of course, some decisions will have shorter timelines than others, and a full-blown peer reviewed risk analysis is not always practicable. But even where decisions need to be made in relatively short order, there must be systems in place to ensure that some sort of formal risk analysis takes place when procedures are changed, and that the analysis considers the impact of the decision in the context of all system risks. If it turns out there is insufficient time to perform such an analysis, only proven alternatives should be considered. Regulatory Failures Government also failed to provide the oversight necessary to prevent these lapses in judgment and management by private industry. As discussed in Chapter 3, MMS regulations were inadequate to address the risks of deepwater drilling. Many critical aspects of drilling operations were left to industry to decide without agency review. For instance, there was no requirement, let alone protocol, for a negative-pressure test, the misreading of which was a major contributor to the Macondo blowout. Nor were there detailed requirements related to the testing of the cement essential for well stability. Responsibilities for these shortfalls are best not assigned to MMS alone. The root cause can be better found by considering how, as described in Chapter 3, efforts to expand regulatory oversight, tighten safety requirements, and provide funding to equip regulators with the resources, personnel, and training needed to be effective were either overtly resisted or not supported by industry, members of Congress, and several administrations. As a result, neither the regulations nor the regulators were asking the tough questions or requiring the demonstration of preparedness that could have avoided the Macondo disaster. But even if MMS had the resources and political support needed to promulgate the kinds of regulations necessary to reduce risk, it would still have lacked personnel with the kinds of expertise and training needed to enforce those regulations effectively. The significance of inadequate training is underscored by MMS’s approval of BP’s request to set its temporary abandonment plug 3,300 feet below the mud line. At least in this instance, there was a MMS regulation that potentially applied. MMS regulations state that cement plugs for temporary abandonment should normally be installed “no more than 1,000 feet below the mud line,” but also allow the agency to approve “alternate requirements for subsea wells case-by-case.” Crucially, alternate procedures “must provide a level of safety and environmental protection that equals or surpasses current MMS requirements.” BP asked for permission to set its unusually deep cement plug in an April 16 permit application to MMS. BP stated that it needed to set the plug deep in the well to minimize potential damage to the lockdown sleeve, and said it would increase the length of the cement plug to compensate for the added depth. An MMS official approved the request in less than 90 minutes. The official did so because, after speaking with BP, he was persuaded that 3,000 feet was needed to accommodate setting the lockdown sleeve, which he thought was important to do. It is not clear what, if any, steps the official took to determine whether BP’s proposed procedure would “provide a level of safety . . . that equal[ed] or surpass[ed]” a procedure in which the plug would have been set much higher up in the well. MMS’s cursory review of the temporary abandonment procedure mirrors BP’s apparent lack of controls governing certain key engineering decisions. Like BP, MMS focused its engineering review on the initial well design, and paid far less attention to key decisions regarding procedures during the drilling of the well. Also like BP, MMS did not assess the full set of risks presented by the temporary abandonment procedure. The limited scope of the regulations is partly to blame. But MMS did not supplement the regulations with the training or the processes that would have provided its permitting official with the guidance and knowledge to make an adequate determination of the procedure’s safety. Conclusion Deepwater drilling provides the nation with essential supplies of oil and gas. At the same time, it is an inherently risky business given the enormous pressures and geologic uncertainties present in the formations where oil and gas are found—thousands of feet below the ocean floor. Notwithstanding those inherent risks, the accident of April 20 was avoidable. It resulted from clear mistakes made in the first instance by BP, Halliburton, and Transocean, and by government officials who, relying too much on industry’s assertions of the safety of their operations, failed to create and apply a program of regulatory oversight that would have properly minimized the risks of deepwater drilling. It is now clear that both industry and government need to reassess and change business practices to minimize the risks of such drilling. The tragic results of that accident included the immediate deaths of 11 men who worked on the rig, and serious injury to many others on the rig at the time of the explosion. During the next few hours, days, weeks, and ultimately months, BP and the federal government struggled with their next great challenge: containing the spill and coordinating a massive response effort to mitigate the threatened harm to the Gulf of Mexico and to the Gulf coast. They faced the largest offshore oil spill in the nation’s history—and the first from a subsea well located a mile beneath the ocean’s surface.