MACONDO: BLOWOUT IN DEEPSEA

In February 2009, BP filed an exploration plan with the then United States Minerals Management Service (MMS) indicating its intention to drill two exploration wells in Mississippi Canyon Block 252 (MC 252). Both wells were located 48 miles from shore in 4,992 feet of water, and both would be drilled to a total depth of 20,600 feet below sea level. BP planned to drill both using a semi-submersible drilling rig. BP stated that it would take 100 days to drill each well and that it would begin the first well on April 15, 2009, and the second well one year later on April 15, 2010.

The name “‘Macondo” was the result of a charitable donation. BP had donated naming rights to the United Way, which in turn auctioned the rights to a Colombian-American group. That group chose the name of the fictional Colombian village in Gabriel García Márquez’s novel One Hundred Years of Solitude.

The decision to drill at Macondo came after examining 3-D seismic data, offset well data, and other information about the area. The 3-D data had included a prominent “amplitude anomaly” that suggested the presence of hydrocarbon (oil and gas)-bearing sands. This information, combined with offset well data and knowledge of the overall geological structure of the area, strongly suggested to BP that it might find hydrocarbon-bearing sands. BP defined its primary geologic objectives as mid-Miocene age turbidite sands buried 13,000 to 15,000 feet beneath the seafloor—18,000 to 20,000 feet below sea level. Transocean’s Marianas was to drill the entire Macondo well. The Marianas spudded the Macondo well on October 6, 2009, but the crew was forced to leave after the rig sustained damage from Hurricane Ida on November 9, 2009. The Deepwater Horizon took over and resumed drilling operations at Macondo in February 2010.

The Deepwater Horizon entered service in 2001. It was built by Hyundai Heavy Industries and owned by Transocean. Deepwater Horizon, built for $350 million, and was seen as the outstanding rig in Transocean’s fleet; leasing its services reportedly cost as much as $1 million per day. It initially sailed under the flag of Panama and later the Marshall Islands. In 1998, BP signed a contract with Transocean securing the services of Deepwater Horizon from the time it first left the shipyard for a period of three years. After the initial three years, BP extended the contract in annual increments. Deepwater Horizon had arrived at the Macondo lease site on January 31, at 2:15 p.m.

BP is a large oil and gas company headquartered in the United Kingdom. With annual revenues of approximately $246 billion as in 2010, BP was the world’s fourth-largest company of any kind. It was the world’s third-largest energy company and the largest producer of oil and gas in the Gulf of Mexico. BP had two well site leaders on the Deepwater Horizon at any given time. In Houston, BP had a wells team leader, an engineering team leader, an operations engineer, and two drilling engineers. Like most operators, however, BP neither owned the rigs that drilled Macondo nor “operated” them in the normal sense of the word. Instead, the company’s shore-based engineering team designed the well and specified in detail how it was to be drilled. BP employed a number of contractors to perform the physical work of actually drilling and constructing the well. Anadarko and MOEX were BP’s partners at Macondo. Anadarko Petroleum is an independent oil exploration company and owned a 25% share of the Macondo well. MOEX Offshore 2007, an American subsidiary of the Japanese oil company Mitsui Oil Exploration, owned a 10% share of the well. The partners shared the costs to drill the well and expected to share profits from production.

BP also operated the Macondo prospect through a number of contractors and subcontractors. As such BP was to direct the activities of contractors and would by right, provide oversight responsibility of drilling the well. Important contractors and suppliers for the Macondo prospect included:

Halliburton: one of the world’s largest oil field services providers and owns several other oil field services companies, including Baroid and Sperry Drilling. Halliburton designed and pumped the cement for all of the casing strings in the Macondo well. Jesse Gagliano was Halliburton’s lead cementing specialist for the project.

Cameron: A Houston-based company that manufactures well drilling equipment and well construction components. Cameron manufactured the Deepwater Horizon’s blowout preventer (BOP). BOPs comprised up to a maximum of five set - vertically stacked rams and two vertically stacked annular preventers for closing in the well during routine well activities and emergency situations.

Dril-Quip: A Houston-based manufacturer of components used in the construction of oil wells. Dril-Quip manufactured the wellhead assembly used at Macondo, including the casing hanger, seal assembly, and lockdown sleeve components.

Schlumberger: A multinational company that delivers a variety of oil field services through its own employees and through subsidiaries including M-I SWACO. BP hired Schlumberger to run cement evaluation logs for the primary cement job on the final Macondo production casing. Schlumberger also provided well logging services used in the evaluation of the Macondo well.

M-I SWACO: A Schlumberger subsidiary, and a Houston-based company that provides drilling fluids and drilling fluid services. M-I SWACO provided drilling mud and spacer used at Macondo, and its personnel operated the Deepwater Horizon’s mud system.

Sperry Drilling: A Halliburton subsidiary, delivers oil field services. At Macondo, BP employed Sperry Drilling to collect data from sensors mounted on the rig and to provide trained personnel to monitor and interpret the data, including monitoring the well for kicks.

Weatherford: A Houston-based manufacturer of well construction components. It manufactured float valves and centralizers used at Macondo

In addition, remotely operated vehicle technicians from Oceaneering, and tank cleaners with technicians from the OCS Group were contracted by Transocean to work on the Deepwater Horizon’s Macondo drilling project.

On April 20, 2010 as the Deepwater Horizon drilling rig crew completed drilling the exploratory Macondo well deep under the waters of the Gulf of Mexico, an explosion tore through the drill floor. Synthetic Oil Based Mud (SOBM) rose up through the gigantic 250 feet derrick, shortly after, an explosion ripped through the Engine Control Room (ECR). The Macondo well was blowing out uncontrollably with hydrocarbons. Roughly 36 hours after the first explosion, Deepwater Horizon sank to the bottom of the Gulf of Mexico (GoM). It was April 22—Earth Day.

As of April 20, BP and the Macondo well were almost six weeks behind schedule and more than $58 million over budget. By the time the Halliburton engineer had arrived at the rig four days earlier to help cement in the two-and-a-half-mile-deep Macondo well, some crew members had dubbed it “the well from hell”. Macondo was not the first well to earn that nickname; like many deepwater wells, it had proved complicated and challenging. As they drilled, the engineers had to modify plans in response to their increasing knowledge of the precise features of the geologic formations thousands of feet below. Deepwater drilling is an unavoidably tough, demanding job, requiring tremendous engineering expertise.

BP drilling engineer Brian Morel and senior engineer Mark Hafle had the primary responsibility for the Macondo well design work. In designing the Macondo well, BP kept several key issues in mind:

1.      Pore Pressure and Fracture Gradients: Specifically, they must develop drilling programs that will manage and reflect the pore pressure and fracture gradients at a given drilling location (The pore pressure is the pressure exerted by fluids (such as hydrocarbons) in the pore space of rock. The fracture pressure is the pressure at which the geologic formation will break down or “fracture.”)[1]

2.     Barriers to Flow: One important barrier in any well is the mud ( a mixture of clay and other additives to provide a hydrostatic pressure against influxes/kick into the well) and drilling fluid system in the wellbore. When properly designed and operated, the drilling fluid system should balance the pressure of any hydrocarbons in the well formation. Engineers can also use other kinds of barriers during drilling and completion. Those barriers include cemented casing, mechanical and cement plugs, and the blowout preventer (BOP). Sound industry practice—and BP’s own policy—generally requires an operator to maintain two verified barriers along any potential flow path.

3.     Annular Pressure Buildup: In deepwater production wells, engineers pay special attention to a phenomenon called Annular Pressure Buildup (APB). During hydrocarbon production activities, high-temperature hydrocarbons travel up from the pay sands through production tubing installed inside the production casing. The flow of hydrocarbons heats up the well. As a result, fluids and gases in the annular spaces of the well expand. If the well design creates annular spaces that are enclosed, the fluids and gases trapped within those spaces will exert increasing pressure on the well components as they heat up. In some cases, the pressure can become high enough to collapse casing strings in the well and to force the operator to abandon the well. Finally, they can design wells in ways that avoid creating trapped annular spaces at all.

BP encountered a series of complications while drilling the Macondo well. This included two previous kicks, a ballooning event, lost circulation events, and trouble determining pore pressures. Together, these issues made Macondo “a difficult well”.

Kicks and Ballooning: Twice prior to April 20, the Macondo well experienced an unwanted influx into the wellbore, or a “kick.” On October 26, 2009, the well kicked at 8,970 feet. The rig crew detected the kick and shut in the well. They were able to resolve the situation by raising the mud weight and circulating the kick out of the wellbore. On March 8, 2010, the well kicked again, at 13,305 feet. The crew once again detected the kick and shut in the well. But this time, the pipe was stuck in the wellbore. BP severed the pipe and sidetracked the well. On March 25 the Macondo well also had a ballooning, or “loss/gain,” event. The rig lost fluids into the formation. When the crew decreased the pressure of the mud in the wellbore, the rig then received an influx of fluids from the formation.

Lost Circulation during Drilling: A major risk at Macondo was the loss of drilling fluid into the formation, called lost circulation or lost returns. At various points in February, March, and April, the pressure of drilling fluid exceeded the strength of the formation, and drilling fluid began flowing into the rock instead of returning to the rig. Lost circulation events are common in offshore drilling. The Horizon rig crew generally responded with a standard industry tactic: It pumped thick, viscous fluid known as lost circulation material into the well and thereby plugged the fractures in the formation. The Horizon crew successfully addressed repeated lost circulation events while drilling the Macondo well. The events occurred frequently and at various depths, and sometimes lasted several days: once in mid-February, four times in March, and three times in April. In total, BP lost approximately 16,000 barrels of mud while drilling the well, which cost the company more than $13 million in rig time and materials.

Pore Pressures Affect the Well Design: The kicks, ballooning, and lost circulation events at Macondo occurred in part because Macondo was a “well with limited offset well information and preplanning pressure data [were] different than the expected case.” Given BP’s initial uncertainty about the pore pressures of the rock, the company had to adjust its well design as it drilled the well and gained better pore pressure information.

Rig Crew Calls Total Depth Early Due to Narrow Drilling Margin: The last of the lost circulation events occurred on April 9, after the rig had begun to penetrate the pay zone. At 18,193 feet below sea level, the drilling mud pressure exceeded the strength of the formation, and the rig crew observed lost returns. The point at which the formation gave way—when ESD was approximately 14.5 pounds per gallon (ppg)—came as a surprise to the Macondo team. The crew had to stop drilling operations until they could seal the fracture and restore mud circulation. They pumped 172 barrels of lost circulation material down the drill string, hoping to plug the fracture. The approach worked, but BP’s onshore engineering team realized the situation had become delicate. In order to continue drilling; they had to maintain the weight of the mud at approximately 14.0 ppg in order to balance the pressure of hydrocarbons pushing out from the formation. But drilling deeper would exert even more pressure on the formation. Engineers calculated that drilling with 14.0 ppg mud would yield an ECD of nearly 14.5 ppg—presenting the risk of once again fracturing the rock and losing returns. At that point, “it became a well integrity and safety issue.” The engineers had “run out of drilling margin.” The well would have to stop short of its original objective of 20,600 feet. Rig personnel were able to carefully drill ahead an additional 167 feet and called total depth at 18,360 feet. In that sense, drilling was successful: BP reached the targeted reservoir zone and was able to run a comprehensive suite of evaluation tools[2].

In drilling and casing a well, a drill crew performs cement jobs. Cement performs several important functions in an oil well. It fills the annular space between the outside of the casing and the formation. In doing so, it structurally reinforces the casing, protects the casing against corrosion, and seals off the annular space, preventing gases or liquids from flowing up or down through that space. A cement job that properly seals the annular space around the casing is said to have achieved zonal isolation.

The cementing process involves pumping cement down the inside of a casing string until it flows out the bottom and back up into the annular space around the casing string. Although each cement job presents unique challenges, the principal steps involved in pumping cement at Macondo were the same as those for most deepwater wells. Achieving zonal isolation requires several things.

1.      First, the cement should fill the annular space in the zone to be isolated and also a specified space above and below that zone.

2.     Second, cement flowing into the annular space should displace all of the drilling mud from that space so that no gaps or uncleared channels of mud remain behind. If mud channels remain after the cement is pumped, they can become a flow path for gases or liquids from the formation. Good mud removal is critical for a successful cement job.

3.     Third, the cement should be formulated so that it sets properly under wellbore conditions.

During the Macondo cement job for the production zone the primary cement failed to isolate hydrocarbons in the formation from the wellbore—that is, it did not accomplish zonal isolation. Several events may have contributed to cement failure, either alone or in combination:

1.      Cement in the annular space may have flowed back into the production casing due to u-tube pressure and failure to convert the float valves[3];

2.     Drilling mud may have contaminated the cement in the shoe track and/or annular space badly enough to significantly slow cement setting time;

3.     Cement in the annular space may not have displaced mud from the annular space properly, leaving channels of mud behind;

4.     Cement in the shoe track may have flowed down into the rathole (the open section of wellbore below the reamer shoe), “swapping” places with drilling mud and increasing the potential for flow through the shoe track;

5.     Cement slurry characteristics (such as retarder concentration, base slurry stability/rheology, or foam instability) may have compromised the sealing characteristics of the cement; and

6.     Severe foam instability may have allowed nitrogen bubbles to break out of the slurry, with unpredictable consequences

Some other factors also contributed to the failure of the Macondo cement job. Decision Not to Run Additional Slip-On Centralizers[4] which ideally would have centered the casing to minimum 70% standoff as required by MMS and BP. BP also pumped the foamed cement at slower rates with the fear of potential ECD that could result in lost circulation. Lost circulation was frequent in the drilling of the Macondo; as such BP did not want to have repeat episodes of loss circulation which could potentially complicate risks of losing the well.

After finishing cementing the production casing, the rig crew began temporary abandonment procedures that would have allowed the Deepwater Horizon to remove its riser and BOP from the well and move on to another job. The blowout occurred before the rig crew set the cement plug and lockdown sleeve

Temporary Abandonment Process

BP’s Temporary Abandonment (TA) procedure for the Macondo well had the following basic sequence:

1.      Run the drill pipe into the well to 8,367 feet below sea level (3,300 feet below the mudline);

2.     Displace 3,300 feet of mud in the well with seawater, lifting the mud above the BOP and into the riser;

3.     Perform a negative pressure test to assess the integrity of the well (including the bottomhole cement) and ensure that outside fluids (such as hydrocarbons) are not leaking into the well;

4.     Displace the mud in the riser with seawater;

5.     Set the surface cement plug at 8,367 feet below sea level; and

6.     Set the lockdown sleeve (LDS) in the wellhead to lock the production casing in place.

Key of the procedure for TA was the Negative Pressure Test or Positive Inflow Test. The negative pressure test performed at Macondo showed repeatedly over a three-hour period that the well lacked integrity and that the cement had failed to seal off the hydrocarbons in the pay zone. BP well site leaders, in consultation with Transocean rig personnel, nevertheless mistakenly concluded that the test had demonstrated well integrity and then proceeded to the next phase of temporary abandonment.

After cementing the production casing, BP was nearly ready to complete the Macondo well and turn it into a producing well. (Completion refers to the process of preparing the well for production and installing equipment to collect oil from the well.) However, BP only planned to use Deepwater Horizon to drill the well, not to complete it. After installing the production casing, BP planned to have the Deepwater Horizon leave Macondo for a different drilling job elsewhere in the Gulf of Mexico. Another rig would perform the completion work at some undetermined time in the future. As part of the temporary abandonment procedure, the rig crew conducted tests to check the well’s integrity. If there were a leak in the system of cement, casing strings, and mechanical seals that comprised the well, these tests should have revealed it. The rig crew conducted three different tests:

A seal assembly test, A positive pressure test, and A negative pressure test. The tests each checked different parts of the well’s integrity.

Seal Assembly Test

The seal assembly test, as its name implies, tests the casing hanger seal assembly. A long string production casing hangs from a casing hanger inside the wellhead. The casing hanger[5] both supports the casing and seals off the annular space outside the top of the casing. After installing the casing, rig personnel conduct a test to determine that the casing hanger seal does not leak. To do so, the crew installs a plug, or packer, on the bottom of the drill pipe and lowers it beneath the seal assembly. The crew closed a variable bore ram of the blowout preventer (BOP) (above the seal assembly) around the drill pipe. This creates a small enclosed space inside the casing at the mudline. The rig crew then pumps additional fluid into this space, increasing the pressure. They then monitor the pressure for a predetermined time period. If the pressure remains constant, it means that the casing hanger seal is capable of containing high internal pressure. If the pressure drops, fluid is escaping through a leak. In the early morning hours of April 20, the rig crew performed two separate pressure tests on the seal assembly, both of which passed.

A positive pressure test is like a seal assembly test, but over a larger area of the well. With the drill pipe pulled out of the well, the rig crew shuts the blind shear rams on the BOP to isolate the well from the riser. The crew then pumps additional fluid into the well below the BOP and monitors the pressure. If the pressure remains constant with the pumps shut off, that means that the casing, wellhead seal assembly, and BOP are containing internal pressure and are not leaking. Between 10:30 a.m. and noon, the crew conducted a positive pressure test to 250 pounds per square inch (psi) for five minutes and then a second to 2,700 psi for 30 minutes. In both instances, pressure inside the well remained constant over the test period and fluid did not leak out of the casing, the pressure again remains constant. The test was a success.

Negative Pressure Test

The negative pressure test is essentially the inverse of a positive pressure test. Rig personnel reduce the pressure inside the well below the pressure outside the well and then monitor the well to determine whether any hydrocarbons from the pay zones leak into the well from the formation outside it. Whereas rig personnel identify a failed positive pressure test by observing diminishing internal pressure, they identify a failed negative pressure test when they observe increasing internal pressure while the well is shut in or flow from the well while it is open. In a successful negative pressure test, there should be no pressure increase inside the well and no flow from the well for a sustained period of time. Increased pressure during this period indicates that the primary cement job at the bottom of the well has failed and hydrocarbons from the pay zone are entering the well. The negative pressure test simulates the conditions rig personnel will create inside the well once they remove drilling mud from the riser (and from some portion of the well below the mudline) in order to temporarily abandon the well. Removing that mud removes pressure from inside the well.

The purpose of the negative pressure test is to make sure that when that pressure is removed, the casing, cement, and mechanical seals in the well will prevent high-pressure hydrocarbons or other fluids in the pay zone outside the well from leaking in. The test thus evaluates the integrity of the wellhead assembly, the casing, and the mechanical and cement seals in the well—indeed, it is the only pressure test that checks the integrity of the primary cement. For these reasons, both BP and Transocean have described the negative pressure test as critically important.

The Negative Pressure Test Showed That the Cement Failed

The pressure readings and flow indications during the negative pressure test were not ambiguous. In retrospect, BP, Transocean, independent experts, and other investigations all agree that this critical test showed that the cement had failed and there was a leak in the well. There were three instances in which pressure built up after being bled off, including the buildup experts have deemed a “conclusive failure” wherein pressure inside the drill pipe rose from 0 to 1,400 psi. On at least one occasion, bleed-off procedures produced more flow than should have been expected. And while the rig crew observed no flow from the kill line during the second negative pressure test, the drill pipe pressure remained at 1,400 psi. The test failure should have been clear even though the well site leaders and rig crew had complicated matters by using an untested spacer and by allowing the spacer to leak below the BOP during the test. The well site leaders and rig crew never should have accepted the test as a success or continued with displacement operations.

The Deepwater Horizon‘s crew did not respond to the April 20 kick before hydrocarbons had entered the riser, and perhaps not until mud began spewing from the rig floor. If the rig crew had recognized the influx earlier, they might have been able to shut in the well. But the crew still had response options even at the point that they eventually did recognize the kick.

THE LAST PIECE OF DEFENCE FAILED

The blowout preventer (BOP) is a routine drilling tool. It is also designed to shut in a well in case of a kick, thereby ―preventing a blowout. The rig crew attempted to close elements of the BOP and to activate the Emergency Disconnect System (EDS)[6] in response to the Macondo blowout. Automatic and Emergency activation systems should have also closed the BOP‘s blind shear ram[7] and shut in the well. Though preliminary evidence suggests one of these systems may have activated and closed the blind shear ram, the blind shear ram never sealed the well.

There are five ways the blind Shear Ram on the Deepwater Horizon blowout preventer could have been activated:

1.      Direct activation of the ram by pressing a button on a control panel on the rig;

2.     Activation of the EDS by rig personnel;

3.     Direct subsea activation of the ram by an ROV (remotely operated vehicle) ―hot stab intervention;

4.     activation by the automatic mode function (AMF) or ―deadman system due to emergency

5.     Conditions or initiation by ROV; and

6.     Activation by the ―Autoshear function if the rig moves off location without initiating the

7.     Proper disconnect sequence or if initiated by ROV.

Potential Reasons the Blind Shear Ram Failed to Seal

1.      Flow Conditions inside the Blowout Preventer: Even if the blind shear ram activated, it failed to seal the well. One possible explanation is that the high flow rate of hydrocarbons may have prevented the ram from sealing. Initial photos from the recovered BOP show erosion in the side of the blowout preventer around the ram, which was a possible flow path for hydrocarbons. Therefore even if the ram closed, the hydrocarbons may have simply flowed around the closed ram.

2.     Presence of Non-shareable Tool Joint or Multiple Pieces: Drill Pipe in the ram may not have closed because of the presence of a tool joint across the blind shear ram. If a tool joint or more than one piece of drill pipe was across the blind shear ram when it was activated, the ram would not have been able to shear and seal the well. Though preliminary evidence suggests these factors may not have impacted the blind shear ram‘s ability to close, the Chief Counsel‘s team cannot rule out the possibility of such interference.

3.     Accumulators Must Have Sufficient Hydraulic Power: The Deepwater Horizon blowout preventer had subsea accumulator bottles that provided pressurized hydraulic fluid used to operate different BOP elements. If the hydraulic line between the rig and BOP is severed, these accumulators must have a sufficient charge to power the blind shear ram. The lower marine riser package had four 60-gallon accumulator bottles were on. On the BOP stack, eight 80-gallon accumulator bottles capable of delivering 4,000 psi of pressure provided hydraulic fluid for the deadman, autoshear, and EDS systems. These tanks were continuously charged through a hydraulic rigid conduit line running from the rig to the blowout preventer. Should the hydraulic line disconnect, the tanks contained compressed gas that could energize hydraulic fluid to activate the blind shear ram. The rig crew checked the amount of pre-charge pressure in the accumulators prior to deploying the BOP in February. However, the available amount of usable hydraulic fluid in the accumulators at the time of autoshear and AMF activation is unknown. If the charge levels were too low, the accumulators would not have been able to successfully power the blind shear ram.

4.     Leaks: It is relatively common for BOP control systems to develop hydraulic fluid leaks on the many hoses, valves, and other hydraulic conduits in the control system. Not all control system leaks affect the ability of the BOP to function: Because BOP elements are designed to close quickly; a minor leak may slow, but not likely prevent, the closing of the BOP. Even if a leak is minor, rig personnel must first identify the cause of a leak to ensure that more severe system failures do not occur. Constant maintenance, inspections, and testing are required to prevent and detect such leaks. Leaks discovered during surface testing should be repaired before deployment. If rig personnel discover a leak after deployment, they must decide whether the leak merits immediate repair. Raising and lowering a BOP stack is a complicated operation with risks of its own; taking this action to repair a minor control system leak may actually increase rather than reduce overall risk.

Complex Systems Almost Always Fail in Complex Ways

The most significant failure at Macondo—and the clear root cause of the blowout—was a failure of industry management.

How could a well fail when so many “stop gates” were available?

Deepwater operators employ exceedingly sophisticated technology to drill wells. But BP and its contractors had neither developed nor installed similarly sophisticated technology to guard against a blowout.

The well monitoring equipment on the Deepwater Horizon was inadequate. For example, the data displayed on computers and instruments depended not only on the right person looking at the right data at the right time, but also that the person understood and interpreted the data correctly.

BP and the other companies did not adequately use the data displays and monitoring equipment they did have. For instance, BP paid Sperry Drilling to gather and send real-time drilling and other data from the rig back to shore. Prior to the blowout, BP maintained large conference rooms in its Houston headquarters dedicated to each of its Gulf of Mexico wells. The room for the Macondo well had numerous monitors displaying the Sperry-Sun real-time data. The onshore team also could access the data remotely over the internet. But BP had no policy requiring full-time, or even part-time, monitoring from shore.

The companies involved at Macondo failed to rigorously analyze the risks created by key decisions or to develop plans for mitigating those risks. This appears to have biased decisions in the last month at Macondo in favor of cost and time savings while increasing the risk of a blowout.

On any drilling rig—no matter who is the operator—―time is money. BP leased the Deepwater Horizon at a rate of about $533,000 per day. The high daily cost made the rig the single greatest expense for drilling the Macondo well. It also gave BP a strong incentive to improve drilling efficiency but did not step back to consider what the safety implications of those decisions were when taken together.

What the men and women who worked on Macondo lacked—and what every drilling operation requires—was a culture of leadership responsibility. In hostile offshore environments, individuals must take personal ownership of safety issues with a single-minded determination to ask questions and pursue advice until they are certain they get it right.

[1] They work constantly to keep two factors within tolerable limits: equivalent static density (ESD) and equivalent circulating density (ECD). ESD refers to the pressure that a column of fluid in the wellbore exerts when it is static (that is, not circulating). ECD refers to the total pressure that the same fluid column exerts when it is circulating. When drillers circulate fluids through a well, ECD exceeds ESD because the force required to circulate the fluids exerts additional pressure on the wellbore.

[2] After drilling, BP directed Schlumberger to run a series of logs to collect data from the well. Between April 10 and 15, 2010, Schlumberger technicians evaluated the formation to determine its porosity and permeability, and gathered fluid and core samples from the well. The logging data led BP to conclude that it had drilled into a hydrocarbon reservoir of sufficient size (at least 50 million barrels) and pressure that it was economically worthwhile to install a production casing. Schlumberger also ran a caliper log to determine the exact diameter of the wellbore

[3] Float valves are check valves fitted in a short length of casing. They can be converted to a one way valve line.

[4] Centralizers are casing accessories that can be attached to the casing at specific joints to create a minimum required standoff (a spacing between the casing and the well side). Selection of Centralizers for Primary Cementing Operations is critical. Poor centralization can also lead to gas flow during the cement job. Gas flow may occur as the cement begins to set. As the cement gels, it no longer transmits the full amount of hydrostatic pressure from the fluids above it in the well. This can allow gas to flow into the cement, weakening it.

[5] A casing hanger or liner hanger mechanically holds the casing in place by fitting in a polished inside profile of the high pressure wellhead assembly. The casing hanger has flow passages that facilitate the flow of fluids during normal drilling operations. The seal assembly is fitted atop the casing hanger to halt annular flow after the primary cement job is complete. Together, the two bind the casing to the wellhead.

[6]The crew can activate the emergency disconnect system (EDS) from the driller’s control panel, the toolpusher’s control panel, or the bridge. Power and communication signals are sent from the rig to the BOP through multiplex (MUX) cables. The signals initiate a sequence in which pod receptacles de-energize and retract, choke and kill line connectors unlatch, the blind shear ram closes, and the lower marine riser package unlatches from the BOP stack,6 separating the rig and riser from the well. Once initiated, this sequence typically takes about a minute. Emergency disconnect is not generally considered a well control response. Rather, it is used in emergency dynamic positioning scenarios to separate the rig from the well. The rig may begin to “drift off” from its station if the rig loses power, or the rig may “drive off” if the dynamic positioning system mistakenly directs the rig to move away. The riser would likely be damaged if the rig drifted or drove off, potentially resulting in an uncontrolled release of hydrocarbons into the water.

[7] Blind Shear Ram is a high pressured hydraulic ram, when activated, cuts through tubular in the BOP permanently sealing in the well. The blind shear ram can be activated directly by the rig crew from the control panels.

---