I’ve spent a bit of time trying to understand the drivers behind the oil spill in the Gulf of Mexico (see posts on ‘The ‘Worst case’ isn’t ever the worst’ and ‘Part deux – ‘worst case’ = self-delusion‘). The congressional investigation note on the early BP memo is published here. It is fairly brief, not a pretty picture, and well worth a read … I’m reproducing it here so I can intersperse my thoughts.
May 25, 2010
To: Members of the Subcommittee on Oversight and Investigations
Fr: Chairmen Henry A. Waxman and Bart Stupak
Re: Key Questions Arising from Inquiry into the Deepwater Horizon Gulf of Mexico Oil Spill
On Wednesday May 12, 2010, the Committee on Energy and Commerce’s Subcommittee on Oversight and Investigations held a hearing entitled, “Inquiry into the Deepwater Horizon Gulf of Mexico Oil Spill.” In preparation for that hearing, Committee staff reviewed over 105,000 pages of internal documents from BP, Transocean, Halliburton, and Cameron. Committee staff spoke with representatives from each of the companies, numerous federal regulators, independent scientists, academic experts, and members of communities affected by the oil spill. The Committee has continued its investigation following the hearing. Today, Committee staff was briefed on the progress of BP’s internal investigation of the causes of the blowout and the oil spill.
The interim report the Committee received from BP is preliminary and based only on incomplete evidence that BP knows at this time. It confirms many of the issues raised by the Committee at its hearing. The interim report also raises significant new questions.
The information from BP identifies several new warning signs of problems. According to BP there were three flow indicators from the well before the explosion. One was 51 minutes before the explosion when more fluid began flowing out of the well than was being pumped in. Another flow indicator was 41 minutes before the explosion when the pump was shut down for a “sheen” test, yet the well continued to flow instead of stopping and drill pipe pressure also unexpectedly increased. Then, 18 minutes before the explosion, abnormal pressures and mud returns were observed and the pump was abruptly shut down. The data suggests that the crew may have attempted mechanical interventions at that point to control the pressure, but soon after, the flow out and pressure increased dramatically and the explosion took place.
Further, BP’s preliminary findings indicate that there were other events in the 24 hours before the explosion that require further inquiry. As early as 5:05 p.m., almost 5 hours before the explosion, an unexpected loss of fluid was observed in the riser pipe, suggesting that there were leaks in the annular preventer in the BOP. Four hours before the explosion, during efforts to begin negative pressure testing, the system gained 15 barrels of liquid instead of the 5 barrels that were expected, leading to the possibility that there was an “influx from the well.” A cementer witness stated that the “well continued to flow and spurted.” Having received an unacceptable result from conducting the negative pressure test through the drill pipe, the pressure test was then moved to the kill line where a volume of fluid came out when the line was opened. The kill line was then closed and the procedure was discussed; during this time, pressure began to build in the system to 1400 psi. At this point, the line was opened and pressure on the kill line was bled to 0 psi, while pressure on the drill pipe remained at 1400 psi. BP’s investigator indicated that a “fundamental mistake” may have been made here because this was an “indicator of a very large abnormality.” The kill line then was monitored and by 7:55 p.m. the rig team was “satisfied that [the] test [was] successful.” At that time, the rig started displacing the remaining fluids with seawater, leading to the three flow indicators described above.
Classic error here. The process didn’t go along with the plan or expectations. The team had to consider whether it was meaningful or not … and they chose to rationalise it in some fashion as not an issue. And, it doesn’t sound like it is such a bizarre situation to review. The pressure test should drop to zero if the plug has been done properly, and it clearly didn’t, with multiple indicators. Given that the next step was to replace the heavy drill mud with lighter seawater, and that it is the weight of the mud that contains the well, this was a pretty key stage for safety.
Several concerns identified by BP relate to the cementing process. Cement work that was supposed to hold back hydrocarbons failed, allowing the hydrocarbons into the well bore. The float collar used in the cementing process did not initially operate as intended and required 9 attempts with higher than usual pressures to function properly. Moreover, the float test performed after cementing may not have been definitive, leading to concern that there may have been contamination of the cement due to density differences between the cement and the drilling mud.
And, this chunk is much the same. Multiple things didn’t go as planned, and yet the team rationalised that it was OK. It clearly wasn’t. And, worth remembering that this was a VERY deep well, so there wasn’t a wide set of experience to rely on – they were extrapolating what should happen, so should already have been careful in using previous experience as a guide.
In addition, key questions exist about whether proper procedures were followed for critical activities throughout the day. Negative pressure testing was initially done on the drill pipe rather than the kill line, even though the drill plan specified that it would be done on the kill line. After anomalous results, the negative pressure testing was conducted on the kill line and ultimately accepted. Evidence suggests that spacer fluid used during the displacement of drilling fluid with seawater did not rise above the BOP to the level required by the drilling plan; this increased pressure in the drill pipe and may have interfered with later pressure testing. In addition, the method of displacing the drilling mud with seawater may have interfered with the monitoring of the flow levels from the well because the mud was transferred to another boat instead of measured in the mud pits. Moreover, mudloggers were not informed when the offloading of drilling mud to the other boat was stopped.
So, it appears that it isn’t quite enough to say that the results weren’t as planned – the procedures used weren’t as planned either. Given that one aim in hazardous procedures is to take the time ahead of execution to map risks and controls against process steps, and have the right oversight on that, departing from the processes is a big deal.
Several concerns about the blowout preventer were identified by BP including the failure of its emergency disconnect system (EDS), the failure of its automated mode function or deadman switch, the failure of the BOP’s shearing functions, and the failure of the remote operated vehicle interventions. The BP investigation has also raised concerns about the maintenance history, modification, inspection, and testing of the BOP.
Struth. The shear failure doesn’t surprise me that much (see previous posts), but this is a stack of stuff.
My take-way from reading this memo is a whole lot less belief in the safety culture in the folks running this well. And the industry, given that some of the failure modes like shear ram limitations have been known for many years and been implicated in previous leaks.
And, a good lesson to me on checking my own mental biases/assumptions since I had made an assumption that the oil industry was good at risk analysis and management because they declared themselves to be, and because it was so clearly necessary.