Deepwater Horizon: Not managing danger, not learning from 'near misses'

"Important decisions made to proceed toward well abandonment despite several indications of potential hazard suggest an insufficient consideration of risks," said Donald Winter, former secretary of the Navy, professor of engineering practice at the University of Michigan, and chair of the study committee. "It's also important to note that these flawed decisions were not identified or corrected by BP and its service contractors, or by the oversight process employed by the U.S. Minerals Management Service and other regulatory agencies."

It may not be possible to definitively establish which mechanisms caused the blowout and explosion, given the deaths of 11 witnesses on board, the loss of the oil rig and important records, and the difficulty in obtaining reliable forensics information from the Macondo well, the report says. Nevertheless, the committee believes it has been able to develop a good understanding of a number of key factors and decisions that may have contributed to the blowout of the well.

The report cites numerous decisions that apparently contributed to the accident, beginning with continuing abandonment operations at the Macondo site despite several tests that indicated that the cement put in place after the installation of a long-string production casing was not an effective barrier to prevent gases from entering the well. The decision to accept the test results as satisfactory without review by adequately trained shore-based engineering or management personnel suggests a lack of discipline and clearly defined responsibilities. In addition, several clear failures in monitoring of the well appear to have contributed to its blowout; available data show hydrocarbons entered the well undetected for almost an hour before the first explosion. Timely and aggressive action to control the well was not taken, and for unknown reasons, hydrocarbons were funneled through equipment that vented them directly above the rig floor rather than overboard. These conditions made ignition "most likely," the report says. Finally, the blowout preventer did not seal the well once activated.

Of particular concern is the lack of a systems approach to integrate the multiple factors impacting well safety, to monitor the overall margins of safety, and to assess various decisions from a well integrity and safety perspective. The report also notes that a previous loss of hydrocarbon circulation in the Macondo well more than a month before the accident presented an opportunity to take actions to mitigate future risks.

Several questionable decisions also were made about the cementing process prior to the accident, including attempting to cement across multiple hydrocarbon and brine zones in the deepest part of the well in a single operational step, making a hydraulic fracture in a low-pressure zone more likely; using a long-string production casing instead of a liner over the uncased section of the well; and deciding that only six centralizers were needed to ensure an even spacing between the formation rock and the casing, even though modeling results suggested that more centralizers would have been necessary. The type and volume of cement used to prepare for well abandonment and the time provided for the cement to cure may also have impacted the well's integrity.

For its final report, due in the summer of 2011, the committee will examine ways to establish practices and standards to foster a culture of safety and methods to ensure that schedule and cost decisions do not compromise safety. The committee will assess the extent to which there are gaps, redundancies, and uncertainties in responsibilities of multiple agencies and professional societies overseeing deepwater drilling operations, and it will consider the merits of an independent technical review to provide operation checks and balances by enforcing standards and reviewing deviations.

The Macondo well's blowout preventer was only recently recovered and is undergoing forensic analyses. The committee will evaluate possible causes for the failure of the blowout preventer once key data are made available. Data on maintenance, testing, operating procedures, and reliability of alarms and other safety systems on the Deepwater Horizon rig will also be examined; testimony at other hearings indicate that various alarms and safety systems failed to operate as intended.

The study is being sponsored by the U.S. Department of the Interior. The National Academy of Sciences, National Academy of Engineering, Institute of Medicine, and National Research Council make up the National Academies.

Interim Report on Causes of the Deepwater Horizon Oil Rig Blowout and Ways to Prevent Such Events

http://download.nap.edu/cart/deliver.cgi?record_id=13047