The Macondo Incident JEB

8/6/2019 The Macondo Incident JEB

1/60

Worldwide DrillingNorthern Bus iness Uni t ,

Conventional Gas Exploi t at ion

The Macondo Inciden

Findings and Conclusions Prior to

Published Inspection of the Subsea BOP

12 October, 2010


2/60

Tracking Info Here2

CONFIDENTIAL

FOR MARATHON OIL COMPANY USE

ONLY

The material contained in this

presentation is for internal trainingpurposes and is not to be further

distributed


3/60

Tracking Info Here3

The Event

On the evening of April 20, 2010, control

of the BP operated Macondo Well, located

in approximately 5,000 of water inMississippi Canyon Block 252, was lost.

This loss of well control resulted in

explosions and fire on board

Transoceans rig Deepwater Horizon.

Eleven people lost their lives and 17

others were injured.

The blowout fed the fire for another 36

hours until the rig sank. Hydrocarbons

continued to flow uncontrolled from the

wellbore for 87 days, resulting in a spillof national significance.

A response effort of unprecedented size,

technical complexity, political pressure,

media coverage and cost continues

today.


4/60

Tracking Info Here4

The First 36 Hours

At the time of theincident we had two rigs

operating in the GOM, the

Noble Paul Romano at

Innsbruck (MC 993) and

the Diamond Ocean

Monarch at Flying

Dutchman (GC 511).

Our supply vessels

were directed to the scene

for SAR operations and

fire fighting.

The Ocean Monarch

was contacted for use of

their BOP ROV

intervention stab, but the

Ocean Endeavor had the

same model and was

closer.


5/60

Tracking Info Here5

An Unprecedented Response Effort

As an Industry we watched as

hours turned into days, days

became weeks, and weeks

grew into months. In contrast

to the failures which led to the

blowout, the response effort

was nothing short of

phenomenal.


6/60

Tracking Info Here6


7/60

Tracking Info Here7


8/60

Tracking Info Here8


9/60

Tracking Info Here9


10/60

Tracking Info Here10

The Flow Path


11/60Tracking Info Here

11

The Flow PathIn the early days of the incident we, along with most of the industry, identified the three potential

flow paths for the blowout: Annular flow thru a failed or off-seated casing hanger pack-off,

annular flow thru parted or leaking production casing, or flow thru the float equipment.

The majority of the industry, including us in the early days, became convinced that the flow pathwas thru the casing hanger pack-off. We reached this conclusion for two major reasons:

1. Reports confirmed that the lock-down sleeve had not been installed before the blow-out

occurred. Quick calculations indicated that if hydrocarbons had been allowed to migrate

during and after the cement job, forces due to probable differential pressures could have off-

seated the hanger and pack-off.

2. More importantly, the feeling was that whatever happened occurred so fast that the rig crew

had no time to react appropriately. The thought of an influx coming all the way from TD to

surface without being detected and secured was considered next to impossible and

dismissed.

As days turned into weeks, several of us began to question why the exposed formations had not

failed, collapsed and bridged over the flow path. There are several hundred feet of open

formation between the productive interval and the 9-7/8 liner shoe. Despite the implications(well unloaded from the bottom, up the production casing, undetected), some of us reached

the conclusion that flow through the float equipment was the only path that could explain the

sustained flow without bridging.

Unfortunately BPs investigation team, which had access to much more information than the

majority of the industry, reached the same conclusion based on multiple pieces of evidence. They

go so far as to state that well control efforts were not initiated until 49 minutes had elapsed and

approximately 1,000 bbls of influx had occurred.



12

Evidence of Flow Path from BPs

Accident Investigation



13

Well Design Information

The discussion regarding the flow path is important because BP was heavily criticized

for running the final production casing as a long string. The assumption was that

annular flow thru poor cement and a damaged or off-seated casing hanger pack-off

was the failure mode.

The investigation team included a diagram that suggested the original Macondo well

plan called for a long string of production casing (9-7/8). According to mutual

partners, this design is not uncommon for BP. While it eliminates at least one annular

barrier (liner-top packer), it also eliminates leak paths associated with liner hangersand tie-back seals. In some cases this design provides mitigation for annular pressure

build-up, and this appears to play heavily in BPs decision to install long strings.

Although we have not utilized a long string in our deepwater completions for a variety

of reasons, it is not appropriate to say the use of a long string across a productive

interval is negligent. Multiple risks and hazards must be addressed on a case-by-case

basis, and there may be times that a long string provides the best solution.

It is the design, installation and proper verification of barriers that is critical



14

Original Well Design and Actual


15/60

Findings From BPs Investigation Team




16

Investigation Teams Representation of

the Physical or Operational Barriers

Breached

Disasters of this nature and magnitude are almost always the result of multiple failures. These

failures often involve decisions made, actions taken (or not taken), and barriers. The Macondo

Incident is no exception.


17/60Tracking Info Here17

Well Integrity Was Not Established or

Failed

The cement did not isolate the

hydrocarbons from within the

annular space behind the

production casing

The shoe track (cement and float

equipment) failed to provide an

effective barrier



Cementing Operation

The Investigation Team determined the annular cement failed

to isolate the hydrocarbon bearing zones for one or more of

the following reasons:

Foamed slurry was likely unstable and allowed nitrogen to

break out

No fluid loss additives were included in the slurry

Complete lab testing of the slurry was not performed

Contamination of the slurry due to the small volumepumped

Channeling due to insufficient mud removal was briefly

discussed, with a base oil spacer and only 6 centralizers

mentioned. The main focus, however, was on foam instability

and possible contamination

This complex slurry and spacer program was apparently

designed to minimize ECD and maximize the chance of having

returns. Having returns at surface during a cement job on a

long string at this depth should very seldom be a primary

objective, and actions taken to achieve this performance

indicator can jeopardize the critical requirements for

complete mud removal and minimal contamination of the

slurry.



Cementing Operation

The Investigation Report fails to state the slurry volume, the pump

rate used to place it, and the results of the lab testing that was

completed. They do state that full returns were achieved during the

placement of the slurry.

In a draft report from May, BP states that a 60 bbl slurry was

pumped. Based on the wellbore details provided in the final

report, the volume required to reach their planned TOC would

have been slightly more than 50 bbls assuming a gauge hole

The slurry and spacer densities were very close to the mud

density. There would have been very little to no benefit fromdensity differences when displacing the mud.

Although not stated (or at least not found by me), the pump

rate while placing the slurry was probably on the low end if

fracture margins were tight yet full returns were acheived.

Rate (annular velocity) plays a very critical role in effective

mud removal, minimizing contamination and eliminatingchannels.

Time to develop compressive strength was not stated in the

report. A Transocean investigation stated Test on 4/12 of

7casing slurry : 0 psi compressive strength after 24 hours .

Attempts to perform a negative test commenced

approximately 16-1/2 hours after bumping the plug.



Cementing OperationBased on the information presented, the cement slurry design and implementation had a very low

probability of ever providing an effective barrier.

Apparently in an effort to maintain an exposed shoe (9-7/8 liner, for future annular pressure buildup

mitigation), the overall slurry volume was maintained very close to a calculated gauge hole capacity.

Therefore, a 16.74 ppg cap, followed by a nitrified 14.5 ppg lead, chased with a 16.74 ppg tailwas

crammed into an overall volume of 60 bbls, preceded by a 6.7 ppg base oil and 14.3 ppg spacerto

displace 14.2 ppg mud, all pumped at a rate slow enough to allow full returns in an environment

with little fracture gradient margin through a tapered string of casing at over 18,000 deep.

While there are many factors that must be considered in the planning of a cement job, often times rateand volume can overcome many deficiencies. Rate can help reduce the effects of poor centralization,

inability to move the pipe, and reduced density differentials to name a few. Increased volumes

compensate for enlarged hole conditions and contamination that occurs during the placement and mud

removal process.

If cement is going to be relied upon as a barrier, then achieving this becomes the primary objective in the

design and execution. Had a significantly larger volume of non-nitrified cement with proper fluid

loss additives and LCM material been pumped at a rate that ensured mud displacement anddiversion (if losses were experienced below the highest HC bearing zone), it is quite possible this

disaster would have been avoided. At these depths and objectives, our practice has and continues to be

non-nitrified slurries with tightly controlled fluid loss with LCM additives (if warranted), well centralized

casing whenever possible, and rates that ensure proper mud displacement (despite no returns at

surface the majority of the time). Ironically, had BP followed our general practice, their concern

about maintaining an exposed shoe at the 9-7/8 liner would have been addressed automatically

no returns equals no cement above the next shoe.

h h k d l



The Shoe Track Cement and Float

Equipment Failed to Provide an Effective

Barrier

The investigation team identified the following possible failure

modes that may have contributed to the shoe track cements

inability to prevent hydrocarbon ingress:

1. Contamination of the shoe track cement by nitrogen breakout

from the nitrified foam cement.

2. Contamination of the shoe track cement by the mud in thewellbore.

3. Inadequate design of the shoe track cement(reference to the

set time of the cement in relation to the attempted negative

test?)

4. Swapping of the shoe track cement with the mud in the rat

hole (bottom of the hole).

5. A combination of these factors.

Three possible failure modes for the float collar were identified:

1. Damage caused by the high load conditions required to

establish circulation

2. Failure of the float collar to convert due to insufficient flow

rate (reference to a low cement placement rate?)

3. Failure of the check valves to seal.

h Sh k C d l



The Shoe Track Cement and Float

Equipment Failed to Provide an Effective

BarrierWe have experienced more than one failure of this type of float

equipment. While it is run as a double valved installation, an

effective seal cannot be taken for granted.

Typically, there is enough displacement pressure (differential pressure

due to a heavier column of cement in the annulus) following a cement

job to immediately determine if the float valves (check valves in the

adjacent schematic) are holding.

Due to the spacers, nitrified slurry, and very probable channeling and

contamination, the differential pressure following the cement job on

the 9-7/8 by 7 production casing would have been very little to none.

Like we have witnessed more than once in our operations, the check

valves may never have been holding. The difference here is there was

probably insufficient differential pressure to make this determination.

The investigation team pointed out multiple potential failure modes

for the cement inside the shoe track. Exposing the cement to a

negative differential before it was capable of providing a seal is a

possibility as well.

A more conventional, higher volume cement job may have provided the

differential necessary to determine the integrity of the check valves.

H d b E d h W ll



Hydrocarbons Entered the Well

Undetected and Well Control was Lost

Negative pressure test was accepted despite obvious signs that well

integrity did not exist

Influx was not recognized until hydrocarbons were above the subsea BOP

Well control response actions failed to regain control of the well

P i i T



Positive Test

The Positive Test (2,700 psi) of the production

casing was successful.

Although from the opposite direction as the

pressure differential experienced after displacing

the riser to seawater, the casing and casing hanger

seal assembly tested.

Since the wiper plug had landed during the cementjob, the positive test pressure was unlikely to be

transmitted to the shoe track.

The positive test commenced approximately 10-1/2

hours after the plug was bumped.

At this point a sigh of relief was probably breathed.

A very difficult, significantly over-budget well had

just been cased, cemented and tested.

It was also at this point that a False Sense of

Security probably set in.

I l I d N i T



25

Incorrectly Interpreted Negative Test

Attempts were being made to

accomplish more than one

objective with the negative testing

operation.

The spacer referenced in the

Deepwater Horizon Investigation

was more accurately described as

unused Form-a-Set and Form-a-

Squeeze LCM pills in theDeepwater Horizon Interim

Incident Investigation dated May

24th 2010 (cant be discharged

directly from rig, but if it goes into

the well, then the returns can be

discharged, so this was pumped

ahead of the seawater with the

intention of dumping after it

returned to surface)

Introducing this additional

operation into a very safety-

critical test may have added to

the difficulty personnel

experienced interpreting theresults.

I tl I t t d N ti T t



26


When conducted in thismanner, the subsea BOP

element utilized (ram or

annular preventer) must hold

a pressure differential from the

top, opposite from what it is

designed to accomplish.

Ironically, the only ram in the

stack designed to hold a

differential from above was

the test ram, the one heavily

criticized as a useless ram

in early media reports.

The amount of fluid thatreportedly leaked by the

annular preventer during the

attempted negative test did not

help the interpretation of the

results (16.0 ppg LCM pill

likely entered into and gained

height in the kill line).




27

Incorrectly Interpreted Negative Test At some point it was decided to

switch from the drill pipe to the kill

line for monitoring.

The kill line reportedly stayed at 0 psifor 30 minutes, while the drill pipe

reportedly built to 1,400 psi over a

period of time.

The drill pipe pressure was explained

as a bladder effect and the kill line

observations were considered

accurate. The negative test was

considered successful and

displacement of the mud and 16.0 ppg

spacer with seawater continued.

If two lines are connected directly

to the same compartment, similar

pressure responses (variances mayexist due to fluid density

differences) should be observed. If

one reads 0 psi and one builds to

1,400 psi,you STOP and determine

why such a discrepancy exists. You

dont blame it on some mythical

bladder effect.




28


I fl t i d til



29

Influx was not recognized until

hydrocarbons were above the subsea BOP

I fl t i d til


30/60




Unrecognized Flow Indications

In this case the drill pipe had already

been completely displaced with

seawater. The expectation should be

that at a given flow rate, the drill pipe

pressure should decline as mud is

displaced from the annulus, then

remain constant once seawater

reaches the surface.

During this displacement, influx nearthe bottom of the well displaced mud

above the bottom of the drill pipe,

causing a pressure increase. This

unexpected response, even with the

pumps off, apparently was not

recognized.

1. Drill pipe pressure increased by

100 psi when it should have been

decreasing (~ 39 bbl gain from

20:58 to 21:08


246 psi with the pumps off, and

flow does not immediately drop off

when shutting down the pumps


556 psi with the pumps off, ~ 300

bbl gain by now.



31/60




Influx continues to displace mud

above the end of the drill pipe,

causing the drill pipe pressure to

increase with the pumps off.

As hydrocarbons pass the end of

the drill pipe and the displaced

mud and mud-seawater mixture

enters the riser (less height for agiven volume), the drill pipe

pressure starts to decline, rapidly.

It wasnt until the last pressure

increase with the pumps off that

someone decided something was

not right, but the action taken

was to apparently bleed off the

drill pipe pressure.

At this point the well must have

been flowing at a very

substantial rate for over 10

minutes with the pumps off



32/60






33/60






34/60



hydrocarbons were above the subsea BOPThere have been several discussions regarding the factors that may have contributed to the failure to recognize the influx

until it was well above the subsea BOP. The most significant of these, in my opinion, are listed below. I list these, and

discount the others on the next slide, because of the following belief:

As long as the BOPs and Marine Riser are attached to the wellhead, a conduit directly to the rig exists. As long as a

direct conduit to the to rig exists, constant monitoring to ensure well control is maintained is required. The Driller is

ultimately responsible, regardless of the other operations going on, for ensuring well control is maintained at all

times.

1. False sense of security prevailed since the wellbore had been tested positively, and the negative test had been

mistakenly accepted as successful.

2. When preparing to perform an operation, often times the responses can be predicted and should be expected. If the

expected responses are not observed, then the operation should be stopped and the reason for the discrepancy

should be determined and remedied. The pressure responses shown on the previous slides certainly deviated from

what should have been expected. The Driller either did not observe these responses, did not comprehend that these

responses should not be expected, or both. Since action was not taken until the last significant pressure increase

(with the pumps off , 556 psi), one might conclude that he did not observe. The action, however, (bleed off the drill

pipe pressure) indicates he had no comprehension of what should be expected and what was actually happening.

3. It was not uncommon for us to displace the riser with no accurate pit monitoring, but when those cases existed, no-

flows were obtained at scheduled intervals and someone was assigned to monitor the flow and confirm no-flow

when the pumps were shut down. This was obviously not done on the Macondo well. Flow was not recognized for

at least 49 minutes and after 1,000 bbls of influx. New regulations will likely prohibit displacements like this in the

future. From now on, displacements will be done with a closed BOP in multiple steps.

Almost 20 years ago I stood on the rig floor of a semisubmersible with the Senior Offshore Supervisor I was working

nights for. He had worked his way up through the contractor ranks on semisubmersibles, and then hired on with

Marathon. He retired not long ago. Pointing at the Driller on the brake, he said Incase you dont know, that is themost important person on this rig. He can sink this thing faster than anyone else onboard



35/60




Several other contributing factors have been stated or discussed. Some of these are listed below, but

while these often receive significant discussion, they are not critical and should have had no impact onensuring well control was maintained.

VIPs were on board to congratulate the crews for an achieved safety performance milestone. It

doesnt matter who is onboard, ensuring constant monitoring occurs and well control is

maintained should not be negatively impacted by visitors.

Multiple operations were going on simultaneously, so attention to critical tasks was divided. There

are always simultaneous operations taking place on a facility of this magnitude. Well control,however, must always be someones top priority; and that someone better understand this very

clearly.

Transfers of mud to a supply vessel were taking place prior to the displacement, making it difficult to

monitor volumes. It was stated in the investigation report that the mudloggers were not

notified when transfers ceased and apparently did not monitor the pit volumes. While often

used for this task, mudloggers are not the ones ultimately responsible for continuouslymonitoring the well during all operations.

The mudloggers flow meter was bypassed and pit monitoring was not possible once returns were

routed overboard. Same as above, and other means of verifying the well is stable should have

been employed (frequent no-flow checks, having someone dedicated to monitoring the returns

and verifying no-flow each time the pumps are shut down)

Well Control Response Actions Failed to


36/60



Regain Control of the Well

Well control response actions were not taken

until water and mud started overflowing ontothe rig floor. At this point over 1,000 bbls had

entered the well undetected and hydrocarbons

were above the subsea BOP.

Mud was expelled through the rotary table

up through the derrick towards the crown

block before the diverter was closed

Pressure responses indicate an annular

preventer was closed, but did not seal

immediately. Transoceans protocol was to

close the annular, then close a VBR.

Eventually the pressure responses indicated

a seal was obtained. The annular was only

rated to 5,000 psi, and modeling indicatedan 8,000 psi differential could be expected

at that point. The investigation team

concluded that it was very likely that a VBR

produced the seal.



37/60




Flow from the diverter was routed to the mud gas separator (MGS), not directly overboard.

This action, regardless of whether someone intentionally lined it up this way or if it was lined

up to the MGS as SOP, ultimately eliminated any further human intervention to secure the well

and perform emergency disconnect actions.

This routing of a major gas event to the MGS resulted in component failures and the rapid

dispersion of gas across large areas of the rig. Failure of the fire and gas systems to prevent

ignition was listed as another failed barrier, but this is a weak statement. An event of this

magnitude would quickly go beyond electrically classified areas, and multiple sources of

ignition, including sparks generated by failed components, would have existed.

The subsequent explosion likely took out both MUX cables in the moon pool, thereby

eliminating any further actions by the crew to shear the pipe or initiate an emergency

disconnect sequence.



38/60




Instantaneous gas rates reached an estimated 165 mmscfd with pressures in excess of 100 psi

Gas would have likely vented from: Slip joint packer, 12 MGS vent, 6 MGS vacuum degasser vent, 6

overboard relief line (burst disk), 10 mud line under the main deck



39/60






40/60






41/60




It is likely the explosion took out both MUX

cables, preventing communication to the

subsea BOPs

Manual activation of either the High-

Pressure Blind Shear Rams or the EDS

would have been prevented. Testimony

indicated that the EDS was pushed and the

panel reacted like it should, but it never left

the panel

At this point, only the AMF (Automatic

Mode Function) and ROV intervention

remained



42/60




Although the pressure responses indicated

the subsea BOP sealed eventually, flowcontinued after the initial explosion based

on the intensity of the fire.

This flow may have come from several

sources, including:

Rig drifting or traveling equipment

movement moved pipe enough todamage the VBR and allow flow again

Damage to the drill pipe allowed flow

into riser or onto rig floor area

Surface equipment failures (swivel

packing, kelly hose)

Pressure relief valves on mud pumps

allowed flow into pit area



43/60




Had the 14 overboard line been utilized,

as it should have been for any significant

gas event, the outcome may have been

different.

The slip joint packer may still have been

at risk, but a significant portion of the gaswould have been vented safely away,

reducing the chance for ignition.

Manual activation of the high-pressure

BSR or the EDS would have been much

more likely

Emergency BOP Functions Failed to


44/60



Secure the Well



45/60



Secure the Well Manual emergency functions had beenrendered inoperable by the explosion

and fire

The AMF (Automatic Mode Function,more commonly called the Deadman

System) then became the second to last

line of defense. At a minimum this

function would have activated the high

pressure BSR.

The Deadman System requires a loss ofcommunication, electrical power and

hydraulics (all three) at both pods to

activate.

Communication and electrical power

would have been lost with the MUX

cable damage

Although more protected, the hydraulic

supply conduit and surface system

would have been destroyed as well, if

not by the explosion, then by the fire.

The Deadman System failed to

function



46/60



Secure the Well

On this model BOP Stack, the Deadman System relies

on lithium battery packs in the subsea control pods to

operate the solenoid valves.

When these pods were recovered to the surface

during the response effort, the Deadman System

functions in both were found inoperable.

In the Blue Pod, the battery power remaining was

significantly below that required to operate thesolenoid valve.

In the Yellow Pod, there was probably sufficient

battery power, but the solenoid valve was inoperable.

How much attention is given to the lines of

defense that are considered last or next to

last, especially when there are several

barriers before these are needed?



47/60



Secure the Well

ROV Intervention also failed to secure the well

The shuttle valves on the Cameron BOP Stack require a minimum flow

rate to fully shift and direct fluid to the intended function.

ROV Intervention capability is routinely tested at surface, but it is

typically done with a hot line pulling fluid directly from the rigs

accumulator system. It is seldom done with or at a rate equivalent to

what the ROV pump can generate.

The rate the ROV could generate was insufficient to shift the shuttle

valves on this stack. This was due to the design of the shuttle valves

and hydraulic leaks subsequently discovered in the system.

The ROV successfully activated the autoshear function (if armed, this

function activates the high pressure BSR when the LMRP is

disconnected) by cutting the indicator rod. This was done 07:40, 21

April 2010.

The high pressure BSR failed to secure the well, and this was the last

line of defense. Additional attempts were made to actuate

components with the ROV intervention panel. It was assumed that

attempts to close the pipe rams meant the middle VBR, but it was

discovered that the bottom, inverted test ram was the one actually

plumbed to the ROV intervention panel.



48/60



Secure the Well

Failure of the autoshear function, which closes the high-pressure BSR, to secure the wellmay have been due to:

1. Insufficient hydraulic power to shear the 5-1/2 21.9 ppf, S-135 which was across the

stack at the time of the incident

2. Seal failure due to prevailing flow conditions in the BOP

3. Presence of non-shearable components across the BSR



49/60



Secure the Well

1. Insufficient hydraulic power to shear the 5-1/2 21.9 ppf, S-135 which was across the

stack at the time of the incident

Period of approximately 30 hours existed where the subsea accumulators were

not being charged from surface (explosion to ROV autoshear activation)

During subsequent control efforts, a control system leak of no greater than 0.32gph was determined between pod retrieval and reinstallation.

The investigation team stated that a leak of approximately 3 gph for 30 hours

would have been required to drop the subsea accumulator pressure below that

required to shear the drill pipe.



50/60



Secure the Well

2. BSR seal failure due to prevailing flow conditions in the BOP at the time of actuation.

BSR successfully tested during the positive pressure test on the morning of the

incident

The exact flowrate at the time of actuation is not known, but the effect of closing

the BSR under what may have been high flowrates is unknown. Much later in theresponse a rate of 53,000 BOPD was observed, but this was under different

conditions at surface (and probably TD).

The investigation team stated that with the leak observed in the hydraulic circuit,

the shearing operation would have taken 17 seconds to complete. Without the

leak, it should have taken 14 seconds.



51/60



Secure the Well

3. Non-shearable components were across the BSR at the time of actuation

Pictures from later in the response effort showed two distinct drill pipe stubs in

the riser section that was cut. This immediately raised questions regarding what

exactly was across the stack when the BSR were activated.

Through examination of the recovered stubs, the investigation team concludedonly one string was across the stack at the time of the BSR activation. Erosion, rig

drift and hoisting equipment movement likely resulted in pipe movement and

parting of the string above the BOP.

The location of tool joints relative to the BSR at the time of actuation is not known

exactly.

Results from the physical inspection of the subsea BOP have not yet been

released, but may shed more light on this subject.



52/60



Secure the Well



53/60



Secure the Well

Recommendations


54/60


BPs Investigation team published 25 recommendations, specific to 8 key findings, in the Deepwater

Horizon Incident Investigation Report. I would encourage you to read these and determine if and

how these may apply to your operations.

Since BPs recommendations are, in some cases, specific to their structure and culture (and maybe

influenced by other objectives), lets cover some broader and a few deeper recommendations

Recommendations


55/60


In the weeks and months following the Macondo Incident, the industry focused on Prevention. The

government then demanded similar focus onSpill ContainmentandSpill Response.

The immediate focus on Prevention is both understandable and warranted. We have all heard that Anounce of prevention is worth a pound of cure. An ounce of prevention would have been worth at least

62 lbs of cure in the case of the Macondo incident.

The same philosophy holds true when focused entirely on the multiple layers ofPrevention that we

rely upon. The earlier in the layers of defense that an issue is recognized and aggressively addressed,

the more efficient and reliable the response will be.

Recommendations


56/60


Barrier Philosophy

Maintaining control of fluids, both produced and injected, throughout the life-cycle of a well is of

primary concern and is a basic expectation.

The design, installation or use, and proper verification of barriers is critical to meeting this expectation.

Examples:

If cement is going to be relied upon as a barrier, then achieving this becomes the primary objective

in the design and execution. If trying to meet other needs that may jeopardize the barrier

objective, the ability of the cement to perform as an effective barrier should be rigorously verified,or another barrier should be installed and tested.

Safety-critical tests should be as simple and straight forward as practical, not encumbered by steps

that could contribute to the misinterpretation of deviations from the expected. The reasons for

deviations from the expected should be adequately investigated, the risks assessed if needed, and

mitigation efforts implemented before proceeding.

Recommendations


57/60


Secondary and Emergency Control systems should be understood and tested.

Deficiencies or failures in these systems should be either remedied or risk assessed. If the risk

assessment concludes it prudent to proceed, the implications should be well understood by those

potentially relying on the system.

If another use or configuration exists for a safety-critical system, but this use or configuration may

create additional hazards, the circumstances under which the alternate use can be employed must be

well defined and understood.

Examples:

How much attention is given to the lines of defense that are considered last or next to last,

especially when there are several barriers before these are needed (Deadman, autoshear and ROV

intervention)? At least in the GOM, this is soon to be mandated.

A diverter system is designed to divert flow safely away from personnel and the facility while

minimizing the pressure on components with low pressure ratings. With the prevalence of SBM

usage in the deepwater environment, the ability to route the diverter to a MGS became common.

The diverter should direct flow directly overboard through a large ID line to avoid over pressuringthe slip joint packer, diverter element and marine riser components. Since SBM cant be discharged,

and gas has the ability to go into solution (oil phase of the mud) and then be liberated near surface,

the use of the MGS to control relatively minor solution-gas events (bottoms up after a trip, extensive

sampling operations, or controlling a kick) has been widely accepted. Routing returns to the MGS

during a major event, however, poses significant hazards. In the case of the Macondo incident,

this action may have resulted in the death of 11 people and the elimination of some critical

barriers that are typically relied upon.

Recommendations


58/60


Culture

In the days following the Macondo incident, most

companies immediately searched for assurances that this

could not happen to them. I wont speculate on how manyassurances were made.

The established processes that BP had in place

(documented reviews, management of change, basis of

design) are impressive. Unfortunately, these failed to

prevent 11 deaths and a spill of national significance.

Although harder to define and measure, and even more

difficult to regulate, we pointed to our culture as the

single most important differentiating attribute when

comparing us to BP.

In a recent meeting with an individual who has numerous

dealings with BP, he observed that regardless of the

purpose of the gathering (planning session to morning rigcall), it is almost impossible to determine who is ultimately

responsible and accountable for the operation being

discussed. Evidence of this exists in the very report this

presentation was derived from.

Recommendations


59/60


In a White Paper presented to the BOEM, we presented what Marathon considered appropriate

safeguards to have in place in order to resume operations in the GOM. The language below comes

directly from that letter and was drafted by Greg Sills (VP Upstream Developments). Additional

comments are shown in blue:

The BP incident serves as a stark reminder, however, that systems and expectations are not enough nomatter how well presented a culture that encourages the appropriate leadership and individual

behaviors is perhaps even more important. We intend to continue to reinforce the culture of a highly

reliable organization that sustains attributes such as the following:

A preoccupation with deviations, lapses, errors responding quickly and rigorously to anything

which falls outside expectations, and refusing to recalibrate expectations in order to avoid

normalization of deviance. (Opposite responses during the negative test, yet rationalizedand dismissed; continued warning signs during the displacement that well integrity did

not exist)

A listening environment where leaders listen to the front line and defer to expertise, faint signals

are heard, and the front line reports confidently - even (especially) when the report is troublesome.

(Our established culture of brutally honest reporting)

Certainty is created where possible standard procedures are followed, not circumvented -creating excess capacity for dealing with the truly unexpected. (One of the reasons that drove

the creation of our Design and Operating Guidelines unless you have obtained proper

approval for a deviation, the established standards will be followed so attention can be

focused on other areas)

These are examples of a responsive and agile organization that detects small misjudgments early,

notices the unexpected while it is still forming, arrests it before it expands, and safely returns to normaloperation.

Recommendations


60/60

.

Final Thoughts:

Responsibility and Accountability. Focus and awareness increase when you know that you are bothresponsible and accountable. Take the earlier points made when discussing well monitoring:

As long as the BOPs and Marine Riser are attached to the wellhead, a conduit directly to the rig

exists. As long as a direct conduit to the to rig exists, constant monitoring to ensure well control is

maintained is required. The Driller is ultimately responsible, regardless of the other operations

going on, for ensuring well control is maintained at all times.

Would an influx of 1,000 bbls over 49 minutes occur undetected if the Driller truly understood and

believed this?

False Sense of Security. We must always guard against complacency in the absence of recent

consequences. For years the industry bragged that there had never been a deepwater blowout of any

significance. Last line of defense safety systems went years without ever being needed. Guards were

lowered. We must maintain a sense of vulnerability.

The Macondo Incident JEB

Documents

Transcript of The Macondo Incident JEB