1. Deepwater Horizon Investigation Deepwater Horizon Accident Investigation 1

2. Investigation Context Terms of Reference Investigation Team Data and Analysis Investigation Limitations Deepwater Horizon Accident Investigation 2 3. Eight Barriers Were BreachedWell integrity was not established or failed6 7 Annulus cement barrier did not isolate hydrocarbons13 5 Shoe track barriers did not isolate hydrocarbons2Hydrocarbons entered the well undetected andRiser4 well control was lost Negative pressure test was accepted although well38integrity had not been establishedBOPSea Floor Influx was not recognized until hydrocarbons were in4riser Well control response actions failed to regain control of5 CasingwellHydrocarbons ignited on the Deepwater Horizon Diversion to mud gas separator resulted in gas venting6onto rig Fire and gas system did not prevent hydrocarbon7ignitionBlowout preventer did not seal the well1 Reservoir Blowout preventer (BOP) emergency mode did not8seal well2Deepwater Horizon Accident Investigation 3 4. IntroductionTechnical PresentationDeepwater Horizon Accident Investigation 4 5. Well Integrity Was Not Establishedor FailedDeepwater Horizon Accident Investigation 5 6. Production Casing Installation After drilling to total depth, casing is run to bottom in preparation for the cement job. A Choke double valve float collar is used to preventKill Boostbackflow or ingress of fluids through theshoe track until the cement hardens and creates a permanent barrier. BOP April 18th 00:30 April 19th 19:30Sea Floor 17:30 19:30Long string design robust, consistent withCirculated prior Cement36 to cement job similar wells in the area Mud 9 attempts made to establish circulation28 Spacer to convert float valves 22 Circulate ~6 times open hole volume, 18 limited circulation due to concerns over16 creating losses and hole washout 13-5/8 No evidence that hydrocarbons entered 11-7/8 the wellbore prior to the cementing9-7/8 operation14.17 ppg SOBM Primary reservoir sands (12.6 ppg) Bottomsup Marker Deepwater Horizon Accident Investigation6 7. Cement Job Cement is pumped down casing throughthe float collar and up the annulus to isolate the primary reservoir sands. ChokePull out of holeKill April 19th 19:30 April 20th 07:00 Boost with running tool and drill Nitrogen cement slurry chosenpipe To achieve light weight slurry due to BOPSet and test limited pore pressure / fracture casing hanger seal assembly gradient windowSea Floor 00:35 02:50Possible risk 36Drill-Quip seal assembly installed Stability of foam Base Oil and successfully tested.Centralizer No lock down sleeve installed. Relatively small volume Spacer 28 02:50 07:00 Susceptible to contamination Cap Pull out hole with drill pipe. Cement 22 Mitigation of risk by Foamed18 Thorough testing of slurry design CementBottomsup16 Marker Precise placement Tail Cement Mud13-5/8 Centralization Primary Nitrogen11-7/8Reservoir 6 inline centralizers spaced across Breakout Sandsthe reservoir sands Shoe 17,168(12.6 ppg)Top of9-7/8 cement 17,260 Additional centralizers not run because incorrectly thought to be wrong type Primary reservoir Float Collar 18,115 6 centralizers sands Risk of channeling above reservoir (12.6 ppg) sands known and accepted Shoe 18,304 Deepwater Horizon Accident Investigation 7 8. Key Finding #1The annulus cement barrier did not isolate the reservoir hydrocarbons Cement is pumped down the Cement Slurry Placementlanding string and casing into theBase Oil ppg16.7ppg 6.7 annulus to isolate hydrocarbon bearing sands. Spacer14.3 ppgRiser 14.3 ppgCap Cement Mud Channeling 16.74 ppg Foam slurry recommended was a 14.17 ppg Cap Cement complex design16.74 ppgBOP Risk of contamination using smallSea FloorFoamvolume of cementCement Foam14.5 ppgCement No fluid loss additives14.5 ppg Incomplete pre-job cement labCasingCentralizers Spacertesting14.3 ppg Foam slurry was likely unstableFloat CollarTop Wiper PlugTop Wiper Plug and resulted in nitrogen breakoutBottom Wiper Plug Bottom Wiper Plug Shoe Tail Cement Track16.74 ppg12.6 ppgShoe TrackReservoirReamer Shoe Tail Cement Nitrogen Breakout Deepwater Horizon Accident Investigation 8 9. Cement Slurry Design Issues An independent lab completed over 500 tests on a representative cement slurry and reported the following: 50% quality foam at surface conditionsOriginal Height was not stable 18.5% quality foam (downhole quality) was not stable Yield point of the Halliburton slurry was too low for the foam cement (2 lb / 100 ft2 Final Heightyield point at 135 deg F) Fluid loss for the base slurry was excessive compared to industry recommendations (302 cc versus 50 cc per 30 min) Cement Note: QUALITY = Nitrogen Volume / (Nitrogen + Base Slurry Volume)Unstable Foam SampleDeepwater Horizon Accident Investigation 9 10. Flow Through Shoe Track - Supporting EvidenceCasingKey Observations for Flow Seal ShoeThrough Shoe vs. Seal AssemblyFailureAssembly Failure YMechanical BarrierFailure Mode Identified Y YRealistic Net PayAssumptionN Y1400 psi recorded ondrill pipe during negativeNtest at 18:30 YAbility to flow from20:58 N YPressure Increase from21:08 to 21:14N 16ppg SpacerYPressure Response from21:31 to 21:34N 14.17ppg SOBM (Mud) 8.6ppg Seawater Influx YTiming for Gas Arrival toSurface N SealNCasingStatic Kill ShoeFailure Y AssemblyFailure Deepwater Horizon Accident Investigation 10 11. Key Finding #2The shoe track mechanical barriers did not isolate the hydrocarbons Tail cement is displaced down the casing into the shoe track. The tail cement is designed to prevent flow from the annulus into the casing. The float collarvalves, which provide a second barrier, Risermust close and seal to prevent flow up Hydrocarbon Flowthe casing. Path Shoe track had two types of mechanical BOP Float Collar barriers: cement in the shoe track and theSea Floor double check valves in the float collar Shoe track cement failed to act as a Check Valves Casingbarrier due to contamination of the base slurry by break out of nitrogen from the foam slurry Shoe track cement Hydrocarbon influx was able to bypass the float collar check valves due to either: Valves failed to convert or Valves failed to sealCentralizers Flow through shoe confirmed by fluid modeling and Macondo static kill data ReservoirFlow PortsDeepwater Horizon Accident Investigation 11 12. Hydrocarbons Entered the WellUndetected and Well Control Was LostDeepwater Horizon Accident Investigation 12 13. Casing (Positive) Pressure Test 2700psiKill A positive pressure test verifies the integrity of the casing and sealassembly.April 20th 07:00 12:00 Sea Floor Casing was pressure tested to:Cement250 psi (low)Mud 2700 psi (high)Spacer Test successful Proved integrity of blind shear rams, seal assembly, casing and wiper plug Test does not test the shoe track due to presence of wiper plug Primary reservoir sandsDeepwater Horizon Accident Investigation 13 14. Negative Pressure TestThe negative-pressure test checks theintegrity of the shoe track, casing and wellhead seal assembly. This simulates Choke BoostKill15:04 15:56conditions during temporary Seawater pumped intoabandonment when a portion of the well Boost, Choke, and Kill lines is displaced to seawater. BOPApril 20th 15:04 19:55 16:54 - Close AnnularSea Floor Negative test simulates underbalanced 15:56 16:53424 bbls of 16 ppg condition spacer followed by 30 bbls Cementof freshwater and 352 bbls Spacer used between mud and seawater of seawater pumped into well Mud Leaking annular at start of test moved Spacer 16:54 16:59spacer across kill line inlet50 bbls bled off Seawater drill pipe due toNegative test started on drill pipe but Influx leaking annularchanged to kill line Bleed volumes higher than calculated Drill pipe built pressure to 1400 psi with no flow on the kill line Primary reservoir sands (12.6 ppg)Deepwater Horizon Accident Investigation 14 15. Negative Pressure Test The negative-pressure test checks the17:52 18:00integrity of the shoe track, casing andOpen killline to conduct wellhead seal assembly. This simulates Chokenegative test Killconditions during temporaryBoost 16:59 17:08abandonment when a portion of the wellBled 3 - 15 bblsinto kill lineAnnular seals withis displaced to seawater. increased hydraulicBOP closing pressure Flow did notApril 20th 15:04 19:55 stop andFill riser with 50 bbls of mudspurted Negative test simulates underbalanced Sea FloorKill line closed 17:08 17:27condition Monitored that theCementannular sealedSpacer used between mud and seawaterMud17:27Leaking annular at start of test movedBled 15 bbls of spacer across kill line inletSpacerseawater from drill pipeSeawaterNegative test started on drill pipe butDecision made toInfluxchange test to kill linechanged to kill lineBleed volumes higher than calculated CementTank TotalDrill pipe built pressure to 1400 psi withVolumeno flow on the kill line15 bblsPrimary reservoirsands(12.6 ppg) Deepwater Horizon Accident Investigation 15 16. Negative Pressure TestThe negative-pressure test checks the 1400 0 integrity of the shoe track, casing andpsipsi18:00 18:35wellhead seal assembly. This simulates Choke Drill pipe pressure gradually Boost increased to 1400 psi conditions during temporary abandonment when a portion of the well18:42 is displaced to seawater. BOPPumped into killline to confirm fullApril 20th 15:04 19:55 Kill line opened forSea Floormonitoring negative testNegative test simulates underbalanced condition Cement 18:42 19:55Spacer used between mud and seawaterMonitored kill line for 30 min Mud 1400 psi on drill pipe describedLeaking annular at start of test moved as a bladder effect spacer across kill line inlet Spacer Seawater 19:55Negative pressure test Negative test started on drill pipe but Influx was concluded andchanged to kill lineconsidered a good test Bleed volumes higher than calculatedCement Tank Total Drill pipe built pressure to 1400 psi with Volume no flow on the kill line 18 bblsAdditional 15 bbls3 bbl influx Primary reservoir sands (12.6 ppg)Deepwater Horizon Accident Investigation 16 17. Key Finding #3The negative pressure test was accepted although well integrity hadnot been established 14000PSI PSI RiserChokeKillBleed volumes not recognized as aBoost problem BOPSea FloorBOP Anomalous pressure on drill pipe with no Sea Floor flow from kill lineSpacer Casing SOBM Test incorrectly accepted as successfulSpacerSeawater Negative testing not standardizedInfluxShoe 17,168TOC 17,260FC 18,115 ReservoirShoe 18,304Deepwater Horizon Accident Investigation 17 18. Well Monitoring Drillers Console and Mudlogging unitWell monitoring is performed to understand ifthe well has losses or gainsDriller is responsible for monitoring andshutting in the wellThe mudlogger provides monitoring support tothe drillerDisplays and trending capability available inboth Drillers and Mudloggers cabinsFlow, pressure and pit sensors can indicateflowSimultaneous activities were taking place onApril 20th to prepare for rig moveStandards for monitoring do not specificallyaddress end-of-well activities Deepwater Horizon Accident Investigation 18 19. Undetected Flowing Conditions Mud in the riser is displaced with seawater in preparation for temporaryabandonment. Choke Kill Boost 21:08 Spacer arrived at surfaceApril 20th 19:55 21:14 Shut pumps downfor sheen test BOP 20:02 Resume displacement of mud with 20:02 seawaterSea Floor Annular openedafter negativetest 20:52 Well becomes underbalanced and starts to flow Cement 20:00 21:08 Resumed pumping MudDisplaced riser with seawaterAfter 20:58 gain being taken and pressure Spaceruntil spacer is at surface begins increasing Seawater20:52 Flow from well masked by emptying Mud + Seawater Well becomes underbalancedof trip tank Mix Influx21:08 Pumping stops for sheen test Pressure increases with pump off 20:58 - 21:0839 bbl gain21:14 Sheen test complete, displacement resumes Primary reservoir sands (12.6 ppg)Deepwater Horizon Accident Investigation 19 20. Key Finding #4The influx was not recognized until hydrocarbons were in the riser20003000 Flow Indications Based on Real-time Data Flow indications:Flow Out (calibrated)1800Flow In (rig pumps)DP Press (rig pumps)2500 #1: Drill pipe pressure1600 increased by 100 psi,Decreasing trend should1400 (expected decreased); Pump Pressure (psi)have continued2000 ~39 bbl gain from 20:58Flow Rate (gpm)1200 Indication #1 to 21:0810001500 8001000 600 40020:52-Flow starts 500 200Cumulative Gain 0 039300 0bbl bbl bbl 20:4520:5020:55 21:0021:0521:1021:1521:2021:2521:3021:351,017 psi SOBM (mud) Seawater Influx SOBM + seawater mix21:08 Deepwater Horizon Accident Investigation 20 21. Key Finding #4The influx was not recognized until hydrocarbons were in the riser20003000 Flow Indications Based on Real-time Data Flow indications:Flow Out (calibrated)1800Flow In (rig pumps)DP Press (rig pumps)2500 #1: Drill pipe pressure1600 increased by 100 psi,Decreasing trend should1400 (expected decreased); Pump Pressure (psi)have continued2000 ~39 bbl gain from 20:58Flow Rate (gpm)1200Indication #1to 21:0810001500 800 #2: Drill pipe pressureIndication #2increased by 246 psi with1000 600 Overboard line opened pumps off 40020:52-Flow startsFlow out available only500 to driller after 21:10 Flow out does not 200 immediately dropCumulative Gain039300 0bbl bbl bbl0after shutting down 20:4520:5020:55 21:0021:0521:1021:1521:2021:2521:3021:35 pump1,017 psi 1200 Normal Flow Back 1000 Flow OutFlow Rate (gpm)Flow In800 SOBM (mud) Seawater600 Influx SOBM + seawater mix40020021:08016:5016:5517:0017:05 Deepwater Horizon Accident Investigation 21 22. Key Finding #4The influx was not recognized until hydrocarbons were in the riser20003000 Flow Indications Based on Real-time Data Flow indications:Flow Out (calibrated)1800Flow In (rig pumps)DP Press (rig pumps)2500 #1: Drill pipe pressure1600 increased by 100 psi,1400Indication #3(expected decreased); Pump Pressure (psi)2000 ~39 bbl gain from 20:58Flow Rate (gpm)1200Indication #1to 21:0810001500 800 #2: Drill pipe pressure Indication #2 increased by 246 psi with1000 600 pumps off 40020:52-Flow starts 500 Flow out does not 200 immediately dropCumulative Gain039300 0bbl bbl bbl0after shutting down 20:4520:5020:55 21:0021:0521:1021:1521:2021:2521:3021:35 pump1,017 psi 1,200 psi #3: Drill pipe pressure increased by 556 psi with pumps off; ~300 bbl gain SOBM (mud) SeawaterNo well control actions taken Influx SOBM + seawater mix21:08 21:31 Deepwater Horizon Accident Investigation 22 23. Key Finding #5Well control response actions failed to regain control of the well Influx enters riser 3000 Based on Real-time Data First indication of well control response: 49 minutes and 1000 bbls after initial influx Drill Pipe Presssure (psi) 2500BOP Mud shoots up derrickAttempt to bleed -Diverter closedpressure-BOP activated 2000Explosion at 21:49Close Drill Pipe BOP Sealing 1500 AnnularDiscussion about leaking 1000 Differential Pressure- Mud and water raining onto deck Mud overflowingonto rig floor - TP calls WSL, getting mud back,500diverted to MGS, closed or wasPumps shut downclosing annularPressure increase due- AD calls Senior TP, Well blowing0 to annular activationout, TP is shutting it in now21:3021:32 21:3421:3621:38 21:40 21:42 21:44 21:4621:48 21:50Deepwater Horizon Accident Investigation 23 24. Hydrocarbons Ignited on theDeepwater HorizonDeepwater Horizon Accident Investigation 24 25. Diverting to the Mud Gas Separator at about 21:42 12 VentWhen responding to a well control eventthe riser diverter is closed and fluids6 Vacuum Breaker sent to either the mud gas separator orBursting Diskto the overboard diverter lines. Diversion to the MGSMGS Rated to 60 psiworking pressureRig crew has the option to divert flow toRotaryHose Mudport/starboard overboard lines or theSystem IBOPMGS StarboardDiverter OverboardDiverting to port or starboard will result in Starboardfluids venting overboard PortOverboard14 Diverter Line14 Diverter LineOverboard Slip Joint Rated to 100 or 500 psi Liquid outlet from MGS goes to the MudOverboard CaissonBoost KillSystem under the main deckChoke BOP Seawater Seawater/Mud Mix InfluxDeepwater Horizon Accident Investigation 25 26. Gas flow to Surface at high rate: 21:46 to 22:00 12 Vent When responding to a well control event the riser diverter is closed and fluids6 Vacuum Breakersent to either the mud gas separator orBursting Disk to the overboard diverter lines.Hydrocarbon flow from surfaceMGS equipmentRotaryHose Mud Instantaneous gas rates reachedSystem IBOP 165 mmscfdStarboardDiverterOverboardPressures exceeded operating ratings (above 100 psi) Port StarboardOverboard14 Diverter Line14 Diverter Line Overboard Gas would probably have vented from: Slip JointOverboard CaissonBoost KillSlip joint packer into the moon poolChoke 12 MGS gooseneck vent BOP6 MGS vacuum breaker vent6 overboard line through burst disk Seawater10 mud line under the main deck Seawater/Mud Mix Influx Deepwater Horizon Accident Investigation 26 27. Gas Dispersion across the Deepwater Horizon 21:46 to 21:50 hrsAnimation of Gas Dispersion Upper Explosive Limit Lower Explosive Limit3D ViewCut Section Through Derrick Towards Aft Deepwater Horizon Accident Investigation 27 28. Secondary protective systems did not prevent ignitionSecondary protective systems are designed to reduce the potentialconsequence of an event once the 3D view primary protective systems have failed. FwdAftSecondary Protective Systems Gas cloud reached the supply air intakes for engine rooms 3, 4, 5 & 6 The Fire and Gas system did not automatically trigger a shutdown of the HVAC system for the engine rooms Limited areas of the rig are designated as electrically classified zones Deepwater Horizon Accident Investigation 28 29. Key Finding #6Diversion to the mud gas separator resulted in gas venting onto the12 Ventrig6 Vacuum Breaker When responding to a well control eventBursting Diskthe riser diverter is closed and fluids aresent to either the mud gas separator orto the overboard diverter lines. MGS Rotary Hose Hydrocarbons were routed to the mud gas MudSystemIBOPseparator instead of diverting overboard StarboardResulted in rapid gas dispersion across DiverterOverboardthe rig through the MGS vents and mudsystem PortStarboardOverboard14 Diverter Line 14 Diverter Line OverboardSlip JointOverboard Caisson Boost KillChoke BOP BOP Sealed at Seawater 21:47 Seawater/Mud Mix InfluxDeepwater Horizon Accident Investigation 29 30. Key Finding #7The fire and gas system did not prevent hydrocarbon ignition Gas Dispersion at 4 minutesSecondary protective systems are designed to reduce the potential (Upper Explosive Limit)consequence of an event once the primary protective systems haveAft failed.Gas dispersion beyond electricallyclassified areasSection through derrick3D view Gas ingress into engine rooms via main(Lower Explosive Limit)Fwddeck air intakesThe on-line engines were one potentialsource of ignitionFwd 3D viewAftAftDeepwater Horizon Accident Investigation 30 31. Emergency Well Control SystemDid Not Seal the Well Deepwater Horizon Accident Investigation 31 32. Blowout Preventer (BOP) BOP Control Panel Surface HPU & AccumulatorsFlex JointLMRP Upper AnnularLower AnnularStripping Element Mux Cable Hydraulic Conduit LMRPAccumulatorsBlind Shear RamBlue Yellow Control Control Casing Shear RamPod Pod (Non Sealing)Upper VBRLower StackMiddle VBRAccumulatorsLower (Test) VBR BOP StackEmergency Methods of BOP Operation Available on DW Horizon Wellhead Connector ManualAutomatic ROV Intervention Wellhead HOT Stab EDS AMFAMFSea Bed HP BSR Close Auto-shear Deepwater Horizon Accident Investigation 32 33. BOP Response (Before the Explosions)BOP is designed to seal the wellbore and 20th April shear casing or drill pipe if necessary. 21:38 Hydrocarbons enter the riserApril 20th21:41 annular BOP closed but appears Activation of Upper AnnularLower Annular BOP not to have sealed the annulusLower Annular21:47 a VBR likely closed and sealed theStripping Elementannulus Blind Shear RamCasing Shear Ram Activation of VBR (Non Sealing) Upper VBRMiddle VBRLower (Test) VBRWellhead ConnectorWellhead Sea Bed Deepwater Horizon Accident Investigation 33 34. BOP Response (Impact of Explosions) MUX cables provide electroniccommunication and electrical power tothe BOP control pods. April 20th Damage to MUX cables and hydraulic lineUpper Annular Opening of annular BOP Lower AnnularAnnular BOP Stripping Element gradually opens Rig drifted off location Upward movement of the drill pipe inthe BOP Blind Shear RamCasing Shear Ram (Non Sealing) Upper VBRMiddle VBR Lower (Test) VBRWellhead ConnectorWellhead Sea BedDeepwater Horizon Accident Investigation 34 35. BOP Response (After the Explosions)There are several emergency methods ofactivating the BSR to seal the well.April 20thEDS attempts failed to activate BSRUpper AnnularAMF sequence likely failed to activate BSR Lower AnnularApril 21st 22nd Stripping Element BSR activated by ROV hot stab attempts to close BOP were Auto-shearineffectiveROV simulated AMF function likely failed to Blind Shear Ramactivate BSRCasing Shear Ram (Non Sealing)ROV activated auto-shear appears to have Upper VBRactivated but did not seal the wellMiddle VBRApril 25th May 5th Lower (Test) VBRFurther ROV attempts using seabeddeployed accumulators were unsuccessfulWellhead ConnectorWellhead Sea Bed Deepwater Horizon Accident Investigation 35 36. Key Finding #8The BOP emergency mode did not seal the wellExplosions & Fire: The AMF provides an automaticLoss of communication means of closing the BSR withoutLoss of electrical power crew intervention.Loss of hydraulicsEDS function was inoperable due toDamaged Hydraulic Conduitdamage to MUX cablesDamaged MUX Cable AMF could not activate the BSR due todefects in both control podsAuto-shear appears to have activated Blue Yellowthe BSR but did not seal the wellControl Control Pod PodPotential weaknesses found in theBOP testing regime and maintenancemanagement systemsEmergency Methods of BOP Operation Available on DW HorizonManualAutomatic ROV InterventionHOT StabEDSAMFAMFHP BSR CloseAuto-shearDeepwater Horizon Accident Investigation 36 37. Summary of Findings andRecommendationsDeepwater Horizon Accident Investigation 37 38. Recommendations 25 Recommendations Specific to the 8 Key Findings BP Drilling Operating Practice and Management SystemsEngineering Technical Practices and ProceduresFurther Enhance Deepwater Capability and ProficiencyStrengthen Rig Audit Action Closeout and VerificationIntroduce Integrity Performance Management for Drilling and Wells Activities Contractor and Service Provider Oversight and AssuranceCementing ServicesDrilling Contractor Well Control Practices and ProficiencyOversight of Rig Safety Critical EquipmentBOP Configuration and CapabilityBOP Minimum Criteria for Testing, Maintenance, System Modifications and PerformanceReliability BP has accepted all the recommendations and is reviewing how best to implement across its world wide operations Deepwater Horizon Accident Investigation 38 39. Summary of Key Findings Well integrity was not established or failed6 7 Annulus cement barrier did not isolate hydrocarbons 13 5 Shoe track barriers did not isolate hydrocarbons 2 Hydrocarbons entered the well undetected andRiser4well control was lost Negative pressure test was accepted although well 38 integrity had not been establishedBOPSea Floor Influx was not recognized until hydrocarbons were in 4 riser Well control response actions failed to regain control of 5 Casing well Hydrocarbons ignited on the Deepwater Horizon Diversion to mud gas separator resulted in gas venting 6 onto rig Fire and gas system did not prevent hydrocarbon 7 ignition Blowout preventer did not seal the well1 Reservoir Blowout preventer (BOP) emergency modes did not 8 seal well2 Deepwater Horizon Accident Investigation 39