Deepwater Horizon 
What Happened
Design Failures & System Life Cycle
Why It Happened
Nature of the System & System Parts
System Parts and Failures
Related Issues/ Elements
Operational Factors
Life Cycle
People
Workplace Environment
Management
Hydrocarbons escaped from the Mancondo well onto Transocean's Deepwater Horizon
Resulted in explosions and fire on the rig
Mechanical and Design failures contributed to the disaster
Eleven people lost their lives
17 people were injured
The fire fuelled hydrocarbons from the well which continued for 36 hours until the rig sank
Hydrocarbons continued to flow from the reservoir through the wellbore and the blowout preventor (BOP) for 87 days
A spill was created which was considered a national/ significant event
BP Exploration & Production were the lease operators of the Mississippi Canyon Block 252
BP formed an investigation team and charged with collecting the facts and sequence of events surrounding the disaster
On April 20, 2010 the incident involved a failure and loss of hydrostatic control of the well
Failure to control the flow from the well with the BOP equipment
allowed for the release and ignition of hydrocarbons
BOP functions failed to seal the well after the initial explosion
Fault Tree Analysis applied and found eight key causes of the accident
- Annulus cement barrier did not isolate the hydrocarbons
- The shoe track barriers did not isolate the hydrocarbons
- The negative pressure test was accepted although well integrity test had not been established
- Influx was not recognised until hydrocarbons were in the riser
- Well control response actions failed to regain control of the well
- Diversion to the mud gas separator resulted in gas venting onto the rig
- The fire and gas system did not prevent hydrocarbon ignition
- The BOP emergency mode did not seal the well
- Annulus cement barrier did not isolate the hydrocarbons
- The shoe track barriers did not isolate the hydrocarbons
- The negative pressure test was accepted although the well integrity test was not established
- Influx was not recognised until hydrocarbons were in the riser
- Well control response actions failed to regain control of the well
- Diversion to the mud gas separator resulted in gas venting onto the rig
- The fire and gas system did not prevent hydrocarbon ignition
- The BOP emergency mode did not seal the well
The day before the disaster, the cement was pumped down the production casing and up into the wellbore annulus to prevent hydrocarbons from entering the wellbore from the reservoir
The annulus cement placed across the main hydrocarbon zone was a light, nitrified foam cement slurry product
This product likely experience and contributed to nitrogen breakout and migration
This would allow hydrocarbons to enter the wellbore annulus
Weaknesses in the cement design, testing, and quality assurance/ risk assessment was determined
Hydrocarbons entered the wellbore annulus and passed down where they entered the production casing through the shoe track
The shoe rack is installed at the bottom of the production casing
This allowed flow to enter the production casing rather than the casing annulus
This occurs when both barriers in the shoe track fail to prevent hydrocarbon entry in the production casing
The first barrier (cement in shoe track)
The second barrier (float collar)- device that is located at the top of the shoe track, designed to prevent fluid ingress into the casing
Hydrocarbon ingress was through the shoe track rather than through a failure in the production casing or the wellbore annulus and going up through the casing hanger seal assembly
Negative pressure test was conducted to verify the integrity of mechanical barriers
The shoe track, production casing, and casing hanger seal assembly
The test involved replacing heavy drilling mud with lighter seawater to place the well in a controlled under-balanced condition
Pressure readings and volume bled at the same time of the negative pressure test
Indicated flow-path communication with the reservoir which signified the integrity of the barriers was not achieved
The crew and BP site leaders were of the incorrect view that the test was successful and well integrity was achieved
As the negative pressure test was accepted, the well was returned to an overbalanced condition, preventing influx into the wellbore
Normal operating conditions involved the temporary abandonment of the well whilst heavy drilling mud was replaced with seawater which under-balanced the well
This allowed hydrocarbons to flow up through the production casing and pass the BOP
Indication of influx as well as increase of drill pipe pressure was not noticed through 'real-time' data which resulted in the crew taking roughly 40mins to act on control measures of the rig
The first control measure by the crew occurred after hydrocarbons were rapidly flowing to the surface
The first well control measures were to close the BOP and diverter which routed the fluids to exit the riser to the mud gas separator (MGS) system rather than the overboard diverter line
Once diverted to the MGS, hydrocarbons were vented directly onto the rig through a goose-necked vent which exits the MGS where other flow lines are also directed onto the rig.
This increased the potential for gas to reach an ignition source
Hydrocarbons migrated beyond areas on the rig that were electrically classified to areas where potential for ignition was increased
Heating, ventilation, and air-con system likely transferred a gas mixture into engine rooms which caused one of the engines to over-speed and result in the source of ignition
- Explosion and fire likely disabled the emergency disconnect sequence and primary emergency method available to rig staff which is designed to seal wellbore and disconnect marine riser from the well
- Condition of critical components in the control pods likely prevented activation of another emergency method of well control (Automatic Mode Function- AMF) which is designed to seal well without human intervention during loss of hydraulic pressure
- Remotely operated vehicle intervention to initiate the auto-shear function likely resulted in closing the BOP's blind shear ram 33 hours after the explosions and fire but instead failed to seal the well
Planning
Construction
Commissioning
Maintenance
Concept (Detailed Design)
Operation
Infrastructure-led development
Engineering team and subsurface specialists estimate pore pressures and strengths of geologic formations
Shallow hazard assessment and peer reviewed designed completed
Multiple plan stages comprising technical and mechanical review and changes
Final design involved nine casing strings for drilling where plan included eight
Differing pore pressures and fracture gradients resulted from design basis
Mud weights and well casing setting depths changed from original design
Revised casing design was prepared to address high formation pressure that led to well control
Logging and evaluation was achieved to determine reservoir intervals which was followed by a clean-out trip to condition the wellbore and verify operating condition
April 16, 2010, MMS approved procedure for temporary abandonment of well
Sequence of Events
Events leading up to accident (prior to April 19, 2020)
Final Casing Run
Cement Job
Positive Pressure and Negative Presure Tests
Well Monitoring and Simultaneous Operations
Well Control Response
Explosion and Fire
BOP Emergency Operations
Investigation & Conclusions
Drill a well to tap into the reservoir on the Macondo Prospect
Oil is meant to be reached and once this is achieved, the plan is to cap the well column with three cement plugs so that another rig could return at a later time and remove the oil
Operations and design involved sealing the well at approx. 1500m deep in water before oil production commenced
Rig commissioned by R&B Falcon and registered in Majuro before being leased to BP in 2001
Testing
Stablising
Approval
Operating rights
Commenced in December 1998
The Keel was laid on 21 March 2000
Rig was delivered on 23 February 2001
Built by R&B Falcon which became part of Transocean by Hyundai Heavy Ind. in South Korea
Ultra deep-water dynamically positioned
Semi-submersible offshore drilling rig
Wight: 52,590 tons
Length: 112m
Risk Assessment
Well monitoring measures and control practices
Integrity testing practices
BOP system maintenance
Mechanical repairs
Regular equipment inspection
Pre-job inspection, testing and maintenance of blowout prventor
Ineffective Maintenance Management
Batteries in pod fully depleted
No indications that the AMF and ROV intervention systems were tested as required by policy
non-original equipment manufacturer (non-OEM) was found on solenoid valve during examination
History
Testing and modifications conducted since commissioning provides information regarding likely condition of BOP at time of incident
Summary
Surge of natural gas blasted through a concrete core that was recently installed to seal an oil well which is designed to be used for later oil productions/ retrieval purposes. The Blast occurred due to failures in maintenance, management, testing, and operation
Drill operates through a hole in the hull
Several wells drilled from one platform (rig)
Directional drilling is required to access several locations in the formation
Sonic equipment is used to determine drilling sites most likely to produce oil
Mobile Offshore Drilling Unit (MODU) used to dig a well
Guiding stands of drill pipe into fingers at top of derrick
Shifts (crews and operation)
Organisational structure
Hierarchical structure
Role responsibility
Crew assignments and allocations
Crew Members
Management
Regulator
Cooking and Cleaning Crew
Supervisors, Foreman, Leading Hands, Superintendents
Limited number of operational personnel per shift
Congested
Highly complex
Technological
Strictly operational
Small
Control Rooms
Small living/ resting quarters
Self-sufficient platform
Cost production
Mass production of oil per day (approx 100k+ barrels of oil
Comprises cranes for operational purposes (e.g. lift containers, pipelines etc.)
Staff handover/ transfer of information required by internal policy
Rig Design
Muster Station
Control Room
Kitchen
Laundry
Social/ Games
Helicopter Platform
Crane Area
Fire Room
Mandatory training
Training and qualifications required
Medical Staff
Engineers
Manual Laborours
Monitor viscosity and mud density while adding chemicals or oil-based fluids
Casing string were installed to drill well to a depth of 18k feet
Installation Manager
Monitor and ensure health/ well being of staff
Manage projects, tests, operations etc.
Safety performance, procedures, operations etc.
Rig
Drill Pipe
Personnel
Organisational Factors (Management)
Equipment conditions
Critical decision making
BP site leaders decided to continue production after negative pressure test
Job Design
Designed to drill in water depths of up to 10k feet
Cement used as a barrier to seal the wellbore from the reservoir
- Wellhead seal assembly was installed and tested
- The first integrity test of the well (positive pressure test) was conducted by closing the blind shear rams and applying 2700 psi of pressure
Test confirmed integrity of blind shear rams, casing, seal assembly, and top wiper plugs
The shoe track which plays a key role in isolating hydrocarbons was NOT tested
- Drill pipe was run to 8k feet in preparation for the second integrity test (negative pressure test)
Tests purpose was to place the well in a controlled under-balanced state to test all mechanical barriers
Test was conducting by displacing some mud in the well with a spacer, followed by seawater. After displacement the upper annular preventer was closed in attempt to bleed the system down to zero psi but fluid in the riser was leaking past the annular preventer
- Hydraulic closing pressure for annular preventer was increased to 1900 psi aimed to create a tighter seal against drill pipe
The riser was filled with up to 50 barrels of mud to replace the volume that had leaked past the annular
- The drill pipe valve was opened and the pressure reduced to zero, bleeding off 15-23 barrels of seawater
- Well site leader advised rig crew that negative test procedure needed to be conducted on the kill line to meet permeate requirements
Information Transfer
After second integrity test was conducted, site well leader informed rig crew that negative test procedure needed to be conducted on the kill line
Site well leader informed rig crew to conduct first integrity test
Drill pipe valve was closed and testing reconfigured for flow to be monitored on the kill line
Kill line valve was opened and seawater was bled off before it was closed again and then the drill pipe pressure gradually increased
- Seawater was pumped into the kill line to confirm it was full but the kill line was routed to the mini trip-tank and less than 1 barrel was bled from the kill line where the flow stopped
Drill pipe valve was to be closed, tested, and reconfigured for flow and monitored on the kill line
Kill line valve was opened then closed by rig crew and monitored for 30 minutes for flow but no flow showed
Signs of flow was monitored for 30mins but did not occur however the drill pipe pressure remained
Discussion around drill pipe pressure occurred and the source of the 1400 psi took place where it was explained as a phenomenon called the 'bladder effect;
No flow showed and test was deamed successful
Inadequate communication and understanding between rig manager and BP leader
Conversation between site well leader and rig crew regarding integrity testing was not communicated
As part of normal operations to temporarily abandon the well, the crew began to displace the remaining drilling fluid of seawater. The annular preventer was opened and the well returned to an overbalance position preventing further influx into the wellbore
Displacement continued as planned and the well went under-balanced resulting in pressure of the well dropping below the reservoir pressure
Well started to flow and crew emptied trip-tank which likely masked any flow indications on the flow meter
Failure
Constant pump rate pressure should have declined as the mud (heavier) was replaced with seawater (lighter). Instead pressure on drill pipe increased by 100 psi, indicating well problem
Sheen test on spacer is to check that no free fluid will be discharged to the sea. The pumps were shut down when the spacer reached the surface. A machine test was performed and the spacer was determined to be suitable for discharge.
The drill pipe pressure continued to increase by the minute
Fluid returned from the riser was routed to the overboard depth line
All mud pumps were shut down before an attempt was made to bleed the drill pipe
Rig crew discussed the differential pressure on the drill pipe
Mud shot up through the derrick and the diverter was closed so flow was diverted to the mud gas separator when the rig crew closed an annular preventor
First gas alarm sounded
Combustible gas cloud reached the aft starboard quadrant of main deck and entered air intakes for engine rooms. The main power generation engines went into over-speed, shutting off all electrical power and controls.
Two explosions ocurred
Rig crew attempt to shut in the well and disconnect the lower riser package from the BOP stack
Emergency disconnect sequence for the BOP was activated from the bridge. While lights changed on the control panel, no flow was observed on the flow meters
Emergency disconnect system did not function when activated and the lower marine riser package failed to unlatch from the BOP which did not seal the well
When disconnection from the well failed, order to abandon the rig was called
Riser
BOP
Casing
Reservoir
Environment
Sea Floor
Wellbore
Sea Pressure
Hydrocarbons
Energy/ Force
Failure to recognise hydrocarbons entered well
Shoe track barriers did not isolate hydrocarbons
Hydrocarbons entered well undetected and well control was lost
Negative pressure test was accepted although the well integrity was not established
Influx and hydrocarbons were not recognised until they were in the riser
Influx was not apparent until hydrocarbons were in the riser
Well control response actions failed to regain control of the well
Decision to divert mud gas separator resulted in gas venting onto the rig
Fire and gas system did not prevent hydrocarbon ignition
Blowout Preventor emergency modes did not seal the well
Annular cement barrier did not isolate hydrocarbons
Centralizer
BP rely on service provider to determine an appropriate cement slurry for the well
BP responsible for assuring cement slurry providers work and accepting proposal
Halliburton (service provider) did not conduct comprehensive lab tests that could have identified problems with cement product
BP decided to use six centralisers and a long string production casing in the well which is consistent design to others. This decision increased likelihood of channeling above the main hydrocarbon zone
BP and Halliburton could have improved technical assurance, risk management, and change management could have altered decision making on outcome
Shoe track has two types of mechanical barriers:
1- Cement in shoe track
2- Double check valves in float collar
Hydrocarbons bypassed float collar check valves as they were damaged
Negative test was conducted to confirm the integrity of the annulus cement, shoe track, casing, and wellhead seal assembly
Increase in pressure on drill pipe should have lead to further inquiry by personnel regarding integrity of well rather than test result assumed to be attributed to a phenomenon known as the 'bladder effect'
Negative test was deamed a success by BP and transocean rig personnel
3 drill pipe pressure increases/ indicators were recorded with no well control actions taken
Well must be shut in upon influx and if necessary, hydrocarbons diverted safely away from the vessel. Response by rig crew was not 'typical' in accordance with training and awareness of control events
Diverter was closed and routed flow to mud gas separator
Annular preventer was activated which did not seal the well
In a well control event, the riser converter can be closed and the fluids directed
Gas dispersed rapidly across the rig
Gas entered engine room through air intakes
Engines went into over-speed, resulting in loss of power
Emergency systems failed to seal the well after initial explosion
Initial explosions and fire damaged the control cables (MUX Cables) and hydraulic lines which caused emergency disconnect system failing to activate the blind shear ram which was triggered by personnel on the bridge
Diverted to mud gas separator
Communication was lost and resulted in various decisions (including unauthorized or trained) to occur
AMF did not complete due to to MUX cable damage
Weaknesses and testing/ maintenance of BOP was evident
Well site leader was aware something was wrong and did not wish to proceed with normal operations, instead wanted to wait until more testing could verify mechanical accuracy.
BP responsible for encouraging operations to continue and disregard pressure increase on drill pipe
Audit findings relating to maintenance found that the sub-sea personnel recorded well control equipment maintenance manually on separate spreadsheets and in a daily logbook instead of in the Maintenance Management System
The lower, middle, and upper BOP ram bonnets had not been re-certified since 2000. The OEM recommended re-certification period is 5 years
Maintenance records did not substantiate that it was compliant with 5-year replacement policy for high-pressure holes/ equipment
Maintenance records were not accurately reported in maintenance management system
BOP complete record tracking of specific individual components was not achieved
19 known modifications to the BOP and its control system were identified
19 known modifications occurred which changed the functionality of the BOP, but likely did not contribute to accident
Hydraulic system leaks, solenoid valve coil faults etc. should have been detected by BOP diagnostic capability that was available to rig crew and sub-sea personnel through routine testing/ maintenance requirements
Continuous psi pressure rise through tests and operation
High pressure BSR function is one of six emergency methods that may have reduced/ prevented the accident. This is crew-initiated but was not achieved.
EDS function is crew initiated (rig personnel) from a control panel which was designed to mitigate the risk of losing containment but was not activated
AMF is designed to to mitigate risk caused by a catastrophic failure of the riser which had to be manually armed by rig personnel from BOP control panel but did not function
Rig crew attempted normal mode of BOP system operation using an annular preventer prior to accident
Control room operators
Sub-sea personnel
Control room management
Ground floor senior manager
Maintenance records were not accurately reported where conditions of critical components were not discovered until after the accident
Six leaks were identified in the hydraulic system
Whilst testing requirements were in accordance with policy/ industry standards, intervention systems tests were not conducted at the surface as required by company policy
Diagnostic practices did not recover all critical components of the control system and were not utilised effectively to detect control system defects
Recommendations
Procedures and Engineering Technical practices
Update and clarify current practices to ensure clear and comprehensive cementing guidelines are available and controlled
Clearly defined mandatory practices
Recommended practices and operational guidance
Definitions of critical cement jobs
Description of technical authority's (TA's) role
Establish minimum requirements for ram types, numbers, capability, emergency well control activation systems
Update relevant technical practices
Testing and Review
Review and understand the purpose of the tests
Define barriers to be tested
Identify and evaluate consequences of failure
Develop contingency plan of action in failure events/ likelihood
Develop detailed procedure that requires comprehension
Clearly define success and failure criteria for tests
Apply authorisation instructions if results are outside defined success criteria
Management
Review/ assess effectiveness of risk management and change management processes
Develop/ implement action plan to address areas of improvement
Define minimum standard of functional teams to deliver quality performance
Assess high-consequence drilling activities
Provide regular training to all staff on Incident and Emergency Response (IERP) procedures
Develop and conduct Crisis Management Procedure where Crisis Management Team (CMT) are allocated roles and understand responsibilities
Competency
Review all critical zones of isolation engineering plans and procedures
Implement assurance and technical services including quality/ comprehension to industry standards
Implement competency programs to deepen capabilities of personnel in operational and management/ lead positions
Review current personnel level of knowledge, proficiency and determine necessary training for professional development (PD)
Schedule and conduct high-level audits for safety, quality, and system/ operational compliance and verify/ correct audit findings
Establish leading and lagging indicators for well integrity/ operational performance including well control and safety critical equipment
Solenoid valves/ pods were modified and miswired
Miswiring caused battery to drain
2 x coils of electrical wire designed to work together to generate a magnetic field to operate the valve
1 x coil failed