Deepwater Horizon

Description of facility

Deepwater Horizon was a fifth generation, dynamically-positioned semi-submersible drilling unit built in 2001. The unit employed an automated drilling system and a 15,000 psi-rated BOP system and had operated in water depths (WD) greater than 9,000 ft. The rig had drilled wells up to 35,055 ft in the nine years it had been owned and operated by Transocean under contract to BP in the deepwater Gulf of Mexico.

The Macondo well was an exploration well in Mississippi Canyon Block: 252 in 4,992 ft WO. The well had been drilled to 18,360 ft from its last casing Point at 17,168 ft. The well penetrated a hydrocarbon-bearing Miocene reservoir and was deemed a commercial discovery. The decision was made to temporarily abandon the Macondo well and complete it as a production well in the future.

At the time of the accident, the final string of casing had been run into the well, and the cement barrier had been put in place to isolate the hydrocarbon zones. Integrity tests had been conducted, and the top 8,367 ft of mud was being circulated out using seawater in preparation for temporary abandonment of the well. The remaining steps were to set a cement plug in the casing and to install a lockdown sleeve on the casing hanger seal assembly prior to disconnecting the BOP and suspending the well.

Description of accident

On the evening of the 20^th of April 2010, a well control event allowed hydrocarbons to escape from the Macondo well onto Transocean's Deepwater Horizon, resulting in explosions and fire on the rig. Eleven people lost their lives and 17 others were injured. The fire, which was fed by hydrocarbons from the well, continued for 36 hours until the rig sank. Hydrocarbons continued to flow from the reservoir through the wellbore and the blowout preventer (BOP) for 87 days, causing a spill of national significance.

The internal investigation carried out by BP concluded that the accident involved a well integrity failure, followed by a loss of hydrostatic control of the well. This was followed by a failure to control the flow from the well with the BOP equipment, which allowed the release and subsequent ignition of hydrocarbons Ultimately, the BOP emergency functions failed to seal the well after the initial explosions. Eight key findings regarding the cause of the accident emerged from the investigation and these are as follows:

1.       The annulus cement barrier did not isolate the hydrocarbons. The day before the accident, cement had been pumped down the production casing and up into the wellbore annulus to prevent hydrocarbons from entering the well bore from the reservoir. The annulus cement that was placed across the main hydrocarbon zone was a light, nitrified foam cement slurry. This annulus cement probably experienced nitrogen breakout and migration, allowing hydrocarbons to enter the wellbore annulus. The investigation team concluded that there were weaknesses in cement design and testing, quality assurance and risk assessment.

2.       The shoe track barriers did not isolate the hydrocarbons. Having entered the wellbore annulus, hydrocarbons passed down the wellbore and entered the 9 7/8 in x 7 in production casing through the shoe track, installed in the bottom of the casing. Flow entered into the casing rather than the casing annulus. For this to happen, both barriers in the shoe track must have failed to prevent hydrocarbon entry into the production casing. The first barrier was the cement in the shoe track, and the second was the float collar, a device at the top of the shoe track designed to prevent fluid ingress into the casing. The investigation team concluded that hydrocarbon ingress was through the shoe track, rather than through a failure in the production casing itself or up the wellbore annulus and through the casing hanger seal assembly The investigation team has identified potential failure modes that could explain how the shoe track cement and the float collar allowed hydrocarbon ingress into the production casing.

3.       The negative-pressure test was accepted although well integrity had not been established. Prior to temporarily abandoning the well, a negative-pressure test was conducted to verify the integrity of the mechanical barriers (the shoe track, production casing and casing hanger seal assembly). The test involved replacing heavy drilling mud with lighter seawater to place the well in a controlled underbalanced condition. In retrospect, pressure readings and volume bled at the time of the negative-pressure test were indications of flow-path communication with the reservoir, signifying that the integrity of these barriers had not been achieved. The Transocean rig crew and BP well site leaders reached the incorrect view that the test was successful and that well integrity had been established.

4.       Influx was not recognized until hydrocarbons were in the riser. With the negative-pressure test having been accepted, the well was returned to an overbalanced condition, preventing further influx into the wellbore. Later, as part of normal operations to temporarily abandon the well, heavy drilling mud was again replaced with seawater, under-balancing the well. Over time, this allowed hydrocarbons to flow up through the production casing and passed the BOP. Indications of influx with an increase in drill pipe pressure are discernable in real-time data from approximately 40 minutes before the rig crew took action to control the well. The rig crew's first apparent well control actions occurred after hydrocarbons were rapidly flowing to the surface. The rig crew did not recognize the influx and did not act to control the well until hydrocarbons had passed through the BOP and into the riser.

5.       Well control response actions failed to regain control of the well. The first well control actions were to close the BOP and diverter, routing the fluids exiting the riser to the Deepwater Horizon mud gas separator (MGS) system rather than to the overboard diverter line. If fluids had been diverted overboard, rather than to the MGS, there may have been more time to respond, and the consequences of the accident may have been reduced.

6.       Diversion to the mud gas separator resulted in gas venting onto the rig. Once diverted to the MGS, hydrocarbons were vented directly onto the rig through the 12 in goosenecked vent exiting the MGS, and other flow-lines also directed gas onto the rig. This increased the potential for the gas to reach an ignition source. The design of the MGS system allowed diversion of the riser contents to the MGS vessel although the well was in a high flow condition. This overwhelmed the MGS system.

7.       The fire and gas system did not prevent hydrocarbon ignition. Hydrocarbons migrated beyond areas on Deepwater Horizon that were electrically classified to areas where the potential for ignition was higher. The heating, ventilation and air conditioning system probably transferred a gas-rich mixture into the engine rooms, causing at least one engine to over-speed, creating a potential source of ignition.

8.       The BOP emergency mode did not seal the well. Three methods for operating the BOP in the emergency mode were unsuccessful in sealing the well.

·         The explosions and fire very likely disabled the emergency disconnect sequence, the primary emergency method available to the rig personnel, which was designed to seal the wellbore and disconnect the marine riser from the well.

·         The condition of critical components in the control pods on the BOP very likely prevented activation of another emergency method of well control, the automatic mode function (AMF), which was designed to seal the well without rig personnel intervention upon loss of hydraulic pressure, electric power and communications from the rig to the BOP control pods. An examination of the BOP control pods following the accident revealed that there was a fault in a critical solenoid valve in a control pod and that AMF batteries in the other control pod had insufficient charge; these faults likely existed at the time of the accident.

·         Remotely operated vehicle intervention to initiate the autoshear function, another emergency method of operating the BOP likely resulted in closing the BOP's blind shear ram (BSR) 33 hours after the explosions, but the BSR failed to seal the well.