 | A Review of the Citigroup Prediction on US Energy | The Oil Drum | Does the U.S. Really Have More Oil than Saudi Arabia? |  |
From SEMP to SEMS: Industry’s Response to the Deepwater Horizon / Macondo disaster
Posted by Jonathan Callahan on April 2, 2012 - 10:15am
The following guest post is by Ian Sutton, a Risk Management Engineer in the Process Industries – both onshore and offshore. Ian publishes books and articles on safety management at Sutton Technical Books and suttonbooks.wordpress.com.
Introduction
Almost two years have passed since the explosion and fire on Deepwater Horizon drilling rig. But most of us still vividly remember the tragedy in which eleven men died and almost a billion dollar’s worth of equipment went to the bottom of the ocean. The ruptured well then leaked around 6 million barrels of oil into the Gulf of Mexico for a period of about two months, leading to extensive environmental damage and economic loss. (The event also further established the authority of The Oil Drum; the timeliness and quality of its postings and comments were unrivaled.)
Incidents of the magnitude of Deepwater Horizon (DWH) often lead to a fundamental rethink in the affected industry as to how such an event could have happened and what needs to be done to prevent a recurrence. The manner in which such a rethink is organized is often along the following lines.
- What happened? What was the timeline of events that led to the catastrophe? This phase of the investigation requires deductive analysis (think Sherlock Holmes or Hercule Poirot) and is generally much more difficult than it sounds, not least because most people jump to an early conclusion and then fixate on that conclusion regardless of what later facts tell them.
- What were the immediate causes of failure? These can include equipment failure, instrument malfunction and operating error. (The phrase operating error is used in preference to operator error in order to minimize the tendency to blame the supervisors and front-line technicians; the event probably was caused by a series of failures along the way — the front-line personnel were simply the last people on the bus.)
- How did the management systems fail? For example, in the case of DWH what led to the failure of the Blowout Preventor (BOP)? Specifically:
- Were the proper standards for the design of BOPs followed, and are those standards good enough for current and future conditions given that we are working in ever more challenging environments?
- Was the procedure for selecting the BOP for this service properly followed?
- Was the BOP properly manufactured and installed?
- Were the technicians and supervisors properly trained to operate and maintain the BOP?
- Were management and supervisors trained in what to do should the BOP or any other equipment fail to operate properly?
- If any of the answers to Question 3 are “no” then how should we update our management systems to make sure that this accidents such as this do not recur?
- Are the government regulations sufficiently stringent and up to date, and are the regulatory agencies doing their work properly?
With regard to DWH/Macondo the answers to the first two questions can be found in various reports that analyze the incident in detail. Before discussing the response to Questions 3 through 5 it is first useful to consider the question of risk and risk analysis in an industrial context.
The Nature of Risk
Risk has three components: a hazard, the consequences of that hazard, and the frequency with which it is expected to occur. The relationship between these three elements is shown in Equation (1).
Equation 1) RiskHazard = Consequence × Predicted Frequency
This equation can be illustrated using a simple domestic example. For those who live in a two storey home the hazard of falling down the stairs is always present. The consequences of such a fall range from minor bumps to serious injury, and even death. The frequency of such an event may be say once in five years, and there will generally be a negative correlation between consequence and frequency, i.e., the more serious the consequence the less likely it is to happen.
With regard to offshore drilling a major hazard (probably the major hazard) is the blowout of the well. The consequences can be very serious — as we saw with DWH/Macondo — but the frequency is low, say once every ten to twenty years.
An important conclusion to be drawn from Equation (1) is that that risk can never be zero; hazards always exist, those hazards have consequences and the likelihood of their occurrence is greater than zero. This means that those who apply phrases such as “risk-free” to industrial activities such as the production of oil from subsea wells have not really grasped the true nature of risk. The only way of eliminating risk entirely is to remove the hazard. In the case of falling down the stairs the risk can be eliminated by building a single-storey house, then a person cannot fall down the stairs: guaranteed. With regard to offshore oil production, the only way to totally eliminate risk is to stop drilling and production. While this conclusion may be appealing to many in the Peak Oil community, it is not likely to have a broader acceptance by society in general, particularly with gasoline prices pushing $4 per gallon.
Although Equation (1) provides a useful start to understanding risk, it does not take into account the subjective nature of risk perception; its linearity gives equivalence to the consequence and frequency terms. For example, according to Equation (1), a hazard resulting in one fatality every hundred years has the same risk value as a hazard resulting in ten fatalities every thousand years. In both cases the fatality rate is one in a hundred years, or 0.01 fatalities yr-1.
But the two risks are not perceived to be the same. In general, people feel that high-consequence events that occur only rarely are less acceptable than more frequent, low consequence accidents. Hence, the second option — ten fatalities every thousand years — is considered to be worse. This point can be illustrated as follows.
In a typical large American city around 500 people die each year in road accidents. Although many efforts are made to reduce this fatality rate the fact remains that this loss of life is generally accepted as being a necessary component of modern life, hence there is little outrage on the part of the public. Yet, were an airplane carrying 500 people to crash at that same city’s airport every year, there would be an outcry. Yet the fatality rate is the same in each case: 500 deaths per city per year. The difference in perception is fundamentally subjective. (Other subjective factors come into play. For example, many people would consider that the life of a child is worth more than that of an old person, or someone who goes bungee jumping at weekends will not tolerate the risk associated with having a coal-fired power plant in his neighborhood.)
Given that high consequence events have a higher level of perceived risk, Equation (1) should therefore be modified as shown in Equation (2).
Equation 2) RiskHazard = Consequence n × Predicted Frequency
It can be seen that the consequence term has been raised by the exponent n, where n > 1. Since the variable ‘n’ represents subjective feelings it is impossible to assign it an objective value.
If a value of say 1.5 is arbitrarily given to ‘n’ then Equation (2) for the two scenarios just discussed — the airplane crash and the highway fatalities — becomes Equations (3) and (4) respectively.
Equation 3) Riskairplane = 500 1.5 × 1 = 11180
Equation 4) Riskauto = 1 1.5 × 500 = 500
The 500 airplane fatalities are perceived as being equivalent to over 11,000 auto fatalities, i.e., the apparent risk associated with the airplane crash is 17.3 times greater than apparent risk for the multiple automobile fatalities.
The above discussion may seem rather abstract and rather on the lines of “How many angels can dance on the head of a pin?” But it explains, for example, why the nuclear power industry faces such bitter opposition. The consequences of the worst-case event — core meltdown — are so bad that the perceived risk goes off the charts. For forty years the nuclear power industry has largely focused on reducing the likelihood of a major event through measures such as the use of sophisticated instrumentation. But, based on Equation (2), nuclear power will never be fully accepted by the general public until the worst-case scenario becomes not all that bad.
SEMP
Offshore drilling rigs and production platforms are extremely sophisticated and involve the use of the most advanced technology — something that the general public got a taste of during the drilling the Macondo relief well. For example, in the year 1996 the Shell Oil Company started production from its “Mars” platform in the Gulf of Mexico. Just three years later NASA landed its Mars Polar Lander on the planet Mars. Anecdotally, many people in the offshore oil business believe that it was the platform that embodied the higher level of technology. And that was in the “old days” of 1996 when platforms were operating in depths of “only” 3000 ft. Now we are drilling and producing at four times that depth.
The use of such sophisticated technology and the high consequences of a major event means that managers in the offshore energy industry need to develop Safety Management Systems (SMS) that are equally sophisticated. Generally such as systems have three components, as shown in the simple Venn diagram below.
The sketch shows three types of safety (with a large amount of overlap between them). A very brief overview of these types of safety is provided below, recognizing that each of them could be the subject of a lengthy blog post in and of itself.
Occupational Safety is what most people think of when they hear the word “safety”. It covers items such as trips, falls and vehicle collisions. Occupational safety incidents generally do not involve more than one or two people, and the consequences are generally not too serious (as shown above with the example of falling down the stairs).
The process industries have made enormous progress in occupational safety over the last twenty years or so, both onshore and offshore. Incident rates have fallen by factors as great as ten in that time period. The DWH event did not directly involve occupational safety issues — although there is a concern that a company that has a good record in this area may not recognize deficiencies in the other two types of safety.
Technical Safety addresses design issues. Just as the best way to reduce domestic energy costs is to build a well-insulated home, so the best way to ensure that events such as DWH do not occur is to design the rigs and platforms to be inherently safe and to ensure that any events that do occur are properly controlled without harm to people or the environment. (It would appear as if the Fukushima-Daiichi incident was to do with technical safety: the 3 meter protective wall did not stop a 12 meter tsunami.)
Process Safety is concerned with the management of the equipment and the persons operating that equipment. It is the area of safety that received the most attention following the DWH/Macondo event.
Companies working offshore generally base their Safety Management Systems on the American Petroleum Institute’s Recommended Practice 75, introduced in the early 1990s. RP 75 states, “The objective of this recommended practice is to form the basis for a Safety and Environmental Management Program (SEMP)”. Many of the larger oil companies have their own SMS, but they tend to be similar to RP 75’s SEMP — they are like dialects of the same language.
At the heart of a SEMP, and of most other SMS, lie the following twelve management and technical elements.
- Safety and Environmental Information
- Hazards Analysis
- Operating Procedures
- Training
- Pre-Startup Review
- Assurance of Quality and Mechanical Integrity of Equipment
- Safe Work Practices
- Management of Change
- Investigation of Incidents
- Emergency Response and Control
- Audit of Safety and Environmental Management Program Elements
- Records and Documentation
In a blog such as this there is not enough space to discuss these twelve elements. Whole books have been written about them including two by this author. But the importance of each should be self-evident, and, even at a first glance, their relationship to DWH can be seen. For example, the failure of the BOP most likely involved Element 6: Mechanical Integrity.
Not only is each of these elements important in its own right but they are also part of an integrated system. To take a simple example, it is necessary provide the technicians with Operating Procedures (Element 3), but just having procedures is not enough; the technicians have to be Trained (Element 4) in the use of those procedures. Procedures and training are two sides of the same coin.
SEMS
RP 75 and its associated SEMP had been in use for 20 years at the time of the DWH explosion and fire. However RP 75 is a recommended practice — companies were not required by law to implement its requirements (although certain sections of the standard had been incorporated into regulations).
Offshore safety on the Outer Continental Shelf (basically federally controlled waters) had, prior to DWH, been under the jurisdiction of the Minerals Management Service (MMS). For some years this agency had been developing a SEMS (Safety and Environmental Management System) based on SEMP. However, at the time of the DWH event they had not finalized a rule. This approach changed in a hurry in the second and third quarters of 2010. The following events took place in this time period:
- The MMS renamed itself. Having gone through various iterations the agency which now has authority over offshore safety is known as The Bureau of Safety and Environmental Enforcement (BSEE, generally pronounced “Bessie”).
- They quickly issued a rule that SEMP was now a legal requirement, with an implementation date of November 15th 2011.
- They drafted a new rule that is informally known as SEMS II. This proposed rule, which is still under review, adds many new features to the old SEMP/SEMS.
- They have stated that they intend to beef up their audit capabilities and enforcement actions.
With these changes the BSEE can claim to have responded vigorously and thoroughly to the DWH / Macondo incident. By moving from SEMP to SEMS and then adding SEMS II they now have a regulatory standard that addresses the world of offshore safety, particularly deepwater drilling and production.
Regulators and Risk-Based Standards
It has already been pointed out that the offshore oil and gas industry is very high tech, and that moves to ultra-deepwater operations push technical boundaries even further. These changes present the regulatory agencies with serious challenges, including the following:
- How does the agency keep up with new technology, then write rules to cover the changed situation? By the time they have figured out how to regulate one level of technology, industry has already moved on. The agency is in a perpetual catch-up mode.
- How does an agency write rules for, and then audit, abstract management elements such as Management of Change? With the older prescriptive standards this was not a problem. For example, a pressure vessel had to have two independent pressure control devices. Such a requirement is fairly easy to write and then to audit. Modern management systems are much more difficult to regulate.
- Regulatory agencies often face a manpower problem — they have trouble recruiting highly qualified people in such a competitive industry as offshore oil and gas, not least because their pay scales tend to be quite a bit lower than their industry counterparts (this also appears to be a problem with those charged with regulating the financial industry).
In response to these difficulties regulatory agencies throughout the world have developed a risk-based approach to managing safety. Such an approach works as follows:
- The company operating the offshore facility develops a program for managing safety and environmental performance at that facility.
- Management presents the program to the regulators for acceptance (which is why it is referred to as a Safety Case in Europe and other parts of the world).
- If the program is accepted the company implements the program.
- The regulator audits the facility against that specific program.
- Success is measured not by conformance to prescriptive standards, but by achieving a high level of safety and environmental performance. The only measure of success is success.
Some of the more skeptical readers of The Oil Drum may have reservations about this approach (comments to do with foxes and hen houses come to mind). All that can be said is that this risk-based approach is used successfully in other parts of the world, and that BSEE themselves believe that SEMS + SEMS II moves the United States toward a risk-based approach.
Conclusions
This essay has attempted to provide some background to the manner in which safety is managed offshore, and what changes have been made following the Deepwater Horizon / Macondo incident. Based on what has been written here two conclusions are reached.
The first is that the safety and environmental issues raised by Deepwater Horizon / Macondo are not going to go away. Indeed, as the oil and gas industry moves into deeper waters the technical challenges will become ever greater. These challenges will include the maintenance of high standards of safety and environmental performance.
The second conclusion is about people. The discussion in this essay has inevitably been somewhat dry, legalistic, rational and theoretical. But the issues that it addresses are all too human, as can be seen from the following list.
- Jason Anderson
- Aaron Dale Burkeen
- Donald Clark
- Stephen Curtis
- Gordon Jones
- Roy Wyatt Kemp
- Karl Dale Kleppinger, Jr.
- Blair Manuel
- Dewey Revette
- Shane Roshto
- Adam Weise
These are the names of the eleven men who died on that fateful day, April 20, 2010. The challenge that we all face is to make sure that we never need to publish such a list again.
From SEMP to SEMS: Industry’s Response to the Deepwater Horizon / Macondo disaster
PDF version
69 comments
From SEMP to SEMS: Industry’s Response to the Deepwater Horizon / Macondo disaster
PDF version
69 comments
Contact
- Content: editors at theoildrum dot com
- Tech support: support at theoildrum dot com
License
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.
There are TODsters who know about the mechanical side of ops, such as BOP design, then I’ll ever know. Ditto for cement specs and their testing procedures. But I do understand the basic method for preventing a well from blowing out. This may sound stupidly simple to many and they may think I’m leaving something out. I’m not.
Reservoirs, regardless of where they are and at what depth, exist at a certain pressure. The column of fluid in the well bore, whether cased or open hole, has to exert a pressure greater than the reservoir pressure. Basic and undeniable physics: fluid will flow from high pressure to low pressure. It didn’t matter if Halliburton had pumped the best/worst cement on the planet. It didn’t matter if BP had the best/worst cmt testing procedures in the industry. It wouldn’t even matter if BP had pumped no cmt at all. It would not have mattered if BP had the best designed BOP one can imagine or none at all. If BP had left a mud column in the well of sufficient weight to prevent the reservoir from flowing the blowout would not have happened.
Last week I began completing a well I drilled and cased a month ago. Cement was pumped and the drilling rig moved off. I didn’t run a cmt bond log or test neither the cement nor any of the potential annular failures before doing so. There was no need to: I left the mud in the casing that I drilled the reservoir with…the mud weight that prevented the reservoir from blowing out in the first place. I could have left the well with no casing, no cement, no BOP, etc. etc, etc for a 100 years and it would not have blown out.
With the more expensive drilling rig gone I move in a small completion rig. The cement has now had weeks to cure unlike the mere hours the Macondo cmt had. Not only do I run a cmt bond log I test all the cement (in the annulus as well as the bottom cmt plug) to a level exceeding the reservoir pressure. I install a BOP that exceeds the reservoir pressure and actually pressure up on it to make sure it holds that pressure. Then, and only then, do I displace the heavier drilling mud with a lighter weight completion fluid. Then I shoot holes in the casing through the reservoir and since its pressure is now greater than the back pressure exerted by the completion fluid the well begins to flow.
That, boys and girls, is how I’ve completed every well in the last 36 years. Not once have I ever seen an operator temporarily abandon a well without leaving a sufficient mud weight in the hole to prevent a blow out. And that includes offshore wells. I haven’t focused on the offshore for a while, especially Deep Water. I was shocked to discover that the feds allowed this procedure on the Macondo well. I can understand why BP did it. There are no cheap DW completion rigs: they use the same very expensive rig used to drill the well. BP wanted to leave the Macondo well ready to perforate and flow before they moved the rig off location. And that’s exactly what happened…the well flowed. Just a little sooner than they had planned.
Folks can discuss all the things that went wrong in the process: bad cmt, bad testing procedures, management pressure, malfunctioning BOP, drilling hands not monitoring the well properly, etc. But it doesn’t change the fact that had BP left the heavier mud in the hole or had placed packers in the hole isolating the reservoir from the surface before displacing with a lighter fluid the well would not have blown out. Never.
So how do you prevent another Macondo well from blowing out? Just as the doctor said when you told him it hurts when you do this: “Don’t do that”. LOL. There could be a blow out develop during the original drilling phase. That’s a different scenario we can discuss later. But a Macondo type failure need never happen again: just take 15 minutes to rewrite the regs regarding how a well is left temporarily abandoned.
It really is that stupidly simple IMHO.
Interesting. It would appear that actual risk, as opposed to theoretical risk, arises from the driller's appetite for and ability to carry the costs of risky procedure - which is heavily influenced by the financial pressures bearing on the completion of the job.
What I am groping after is something like the idea that at least in the case of Macondo 252, the risk was generated largely by the finance mechanism - not so much the geology. This is an entirely different class of risk, which is not well addressed in the current model, I think. It's like a cross product between the difficulty of the Drilling and the cost (and time limits!) of the Money.
Sort of like the 'fog of war' idea. The map, as they say, is not the terrain. The drilling Plan, therefore, should not be confused with the well.
Yes? No?
The feature of DWH that strikes me most strongly is that the run-up to the event lasted two days. If someone, anyone, had said during that time, "Let's stop work, secure the well and then find out what's going wrong", this article would never have been written. But they went ahead anyway.
Tomorrow I am presenting a paper entitled Taking a Risk for Safety at the 8th Global Congress on Process Safety in Houston, Texas. The idea is that front-line stop work programs are well established, but maybe not so much for managers. Sponia's comments are right in line with what I will be speaking about.
Sponia – You’re exactly correct IMHO. There was no mechanical advantage for BP to displace the heavier drilling mud when they did. In fact by doing it when they did greatly shortened the amount of time the cement had to set. One might expect a good cmt set in 24 hours but I’ve seen cmt jobs take days to set. This isn’t my area of expertise but it appears to have been strictly motivated by financial considerations. But that’s not a rare motivation especially when the burn rate on a Deep Well may be $1 million per day. If a manager saves 5 days on an 80 day well he can show his boss he saved the company $5 million. Likewise take an extra few days over safety concerns and you just pissed away maybe 10X your salary of the company’s money. When your ops are running $40,000 per hour everyone is watching the clock.
You know the odds of pulling the ace of spades is 1 in 52. What are the odds that Mr. Smith's decisions on the rig are influenced by thoughts of his next year end bonus?
Rockman, I love to be a contrairian but on this one I simply think your overlooking one aspect of cementing. I for one think removing the mud prior to setting the T&A plug was done for one good reason, even though I disagree with removing the mud in that particular well and situation. The thought process for removing the mud at that point may have been one of the only things that they actually thought out a little.
The reason you displace synthetic mud with seawater prior to setting your T&A plug is because you want to give yourself a better "cleaner" environment for cement to bond in the casing. Synthetic or diesel based mud is a horrible environment for achieving good cement bond and poor mud removal is the number one cause of cement job failures in the oil field, so they thought they should prep the casing by putting seawater. The practice is not uncommon in shallow water wells and many times people bring practices from shallow water and land drilling with them to deepwater. It turned out to be a big mistake.
The fact that they didn't get a proper negative test didn't help.
wildman - "Synthetic or diesel based mud is a horrible environment for achieving good cement bond". I know that problem all to well. So why not set a drillable CIBP in the casing to isolate the resevoir before displacing the mud? Granted that might have taken an extra couple of days to drill in out during the completion. Might hve cost an extra couple of million. But compare that to the many $billions BP lost as a result of the blow out.
The only time I'll leave a well in an underbalanced condition is when I'm ready to perforate it. A long as you don't do somethng stupid like swabbing it in, how can you take a kick when you're overbalanced?
I agree set a CIBP or even a retrievable bridge plug if you don't want to drill it out. All I was saying is that they had a logical reason for displacing to sea water. I think it was wrong headed, but they were thinking about getting a good plug.
I guess what I'm trying to say is that even when you think your are doing the right thing for the right reason, sometimes you aren't.
Had they completed the well with the Horizon they would have probably done a direct displacment to brine and never found the problem, or found the problem after a CBL. We in the public wouldn't be talking about it, because it would have never been a major problem.
Something as common as completing the well with the rig that drilled it could have saved 11 lives and billions.
wildman - I figured we were both looking at it the same way. My comment was mostly for others. "...when you think you are doing the right thing for the right reason, sometimes you aren't." LOL. How many hundreds (if not thousands of times) have both of us had to make those decisions...fortunately seldom life threatening. Make the same decision about a very similar situation 10 times and you're correct 9 times. The 10th time you lose a $800,000 bottom hole assembly or logging tool...and then maybe have to drill a $2 million side track. As a geologist I've always been very conservative about not jeopardizing a hole…unlike most geologists who only care about getting their data. So I’ll offer my warning and bump the decision up the chain of command. If there’s no problem then I get tagged for being a worry wart. If I’m right? We both know a good way to end a contract is to do the ole “I told you so” smirk. LOL.
In the case of the DWH I’m sure you remember the argument they had about the test. So let’s say you still think it’s OK to displace. But knowing you I bet you would have had at least 2 or 3 hands watching your returns for a kick every second of the displacement. That’s the part I’ll never understand. How many thousands of times have you checked for flow just while making a connection? For the rest of you folks you should understand that this safety procedure (checking for flow) costs nearly nothing to do. Had they been watching the returns closely on the DWH they would have seen the well coming in and could have prevented the blow out.
As wildman said there are mistakes you can’t avoid making. Not monitoring the mud returns is a mistake that is 100% avoidable.
wildman - BTW I found one cementer. Superior, that does a great job cementing in OBM. Saved my butt with a leaky window last year.
One thing that's different on these ultra deepwater rigs is that they mostly all use computer touch screen monitors for everything. They watch for flow, move mud around, and maybe even scratch their collective arses with a touch screen. I'm used to trying to decide if the flow back coming from the well has went from a three finger flow to a four finger flow. To me ultra deepwater has too many people doing too many separate task. You have many people on the rig now days that think they work on a cruise ship. Even the people working on the well are so specialized that they don't connect the dots to whats going on. We have OIM's that come from the shipping industry. They're truck drivers on the water for God sakes. Drilling a well and having downhole vision has to be learned over time. Maybe you can explain that for me to our fellow TOD folks. I thnk it's important to understand.
On small jack-up rigs I remember that even the catering crew would question us about why we were doing certain things with the well as opposed to other things. These big deepwater rigs with 170 out of 200 people that aren't "oilfield" has dangers that other rigs just don't!
Basically there should be a big meter measuring the well flow clerly visible for all people working on the rig.
Rock - I guess you could say that one of the biggest problems for safety is that intelligence 'obviously' rises with salary. The people who know what they're doing and actually do the work get over-ruled by the people who think that because they tell people what to do they also know how to do the jobs of their subordinates better than their subordinates. This problem is likely compounded by the fact that the people whom actually say 'wait a minute' don't make as much money for the company as people whom are lucky with their 99.X% success rate gambles even if the flipside is something like the Fukushima nuclear disaster. I am pretty sure the geniuses responsible got some pretty fat bonuses along the way.
Alternatively I could have just said: "Business defies physics because higher density invariably rises to the top."
Rockman I think your comment shows how in the end it all comes down to people knowing practically and theoretically what they are working with.
I think the article is very interesting and it shows how the subject of managing organizations is complicated and easier sad then done.
I work with maintenance and aging management and issues regarding how to run Swedish nuclear plants longer then the designed life.
The Swedish industry and has historically relied on skilled professionals. Like in the old days when you had guilds people started learning a profession as an apprentice and then worked there whole life in that profession. They also identified with their profession and where proud of it.
Now a lot of the old engineers and technicians are retiring. In the same time the trend among young people is that they don’t want to work there whole life in one profession and they want to make a career fast.
Compared to the American Nuclear industry and the Aircraft industry where everything is more regulated in detail, the Swedish Nuclear Industry relies more on a diminishing amount of skilled professionals. To counter this problem the industry tries to structure and manage the organization not to rely on individuals to much. I don’t think there is one way to organize an organization better than the other as long you achieve the desired results and people are happy.
But in the end I think it all runs down to having good people at the right place, being down to earth and well connected to the tasks at hand.
A retiring engineer who worked in the nuclear industry all his life told me: “It’s all about having the right people at the right place. You can’t have a blacksmith doing a watchmakers work or the opposite way around.”
I think peak oil will reverse the trend I see of people wanting to make fast careers and hopefully we as a civilization will stop to procrastinate so much.
I don’t know maybe my comment does not make much sense. But it was a little of my thoughts at least. =)
Just a minor remark, but I think people want "fast" careers because lifetime employment is dead, and advancement from the bottom is an endangered species. If you know that in ten years you will be sitting pretty, chugging along at one skill sounds great. Especially if they'll train you and promote you. But if you could be laid off tomorrow and you will only advance by changing companies or going to school, why stay still? If you do, you'll just end up stuck in a dead end.
I also think that smart people have been pushed away from blue-collar work (trades and such), as it is seen as "lower class", dirty, and not the "right fit" for someone who could be doing white collar work. That's not a very good long term strategy... but there you have it.
Hi Rockman,
It's comments like these from folks like yourself that keep me coming back. Thank you. Sincerely.
As your average punter "simply" worried about unchecked growth on a finite planet who has never set foot on an oil rig, nor ever seen first hand any part of the well-to-bowser process, I'm fascinated by all this - though hopefully not obsessed! :) Though you may have stated your opinion on PO already - I'm only an occasional visitor - I'm most interested to know where you believe the next few decades may unfold (re general oil supply). It appears to me the "ultra-deep" reservoirs/tar sands/shale/etc will be economically viable for at least that time, in there own time. And for my fellow Joes/Janes and I, I guess that means BAU (in a treading water, holding-out-for-hope kind of way) for the foreseeable future.
I guess what I'm asking, do you believe the term "Peak Oil" will EVER be used in mainstream?
Cheers, Matt
PS. How do you "shoot holes" in the casing?
Matt - Predictions are difficult…especially about the future. LOL. So I try to avoid doing so. I’m not so much a PO guy as a peak plateau advocate. I think we’ve been plateaued for a few years and will remain so for quite a few more. Of course, folks have different views on the amount of variation in a plateau level that allow you to call it plateau and not a new trend…up or down. As long as oil prices hold at current levels I suspect we’ll see the upward trend, at least in the US, hold for a while. But let prices fall, say as the result of another global recession, and we’ll probably slide to the lower level of the plateau eventually. I don’t really see any cliffs in the future. Just a plateau that over the long haul trends downward.
The MSM will one day become the champion of PO rants IMHO. They will always follow the “if it bleeds it leads” protocol. When the pain of the energy situation becomes great enough they’ll start condemning PO deniers with the same enthusiasm as they are going after PO supporters today IMHO.
Perforating casing: a tool that may be 20' long is run down the well. It varies but typically ever 2 inches there is a shaped charge. Often the charges turn in a spiral so you don't weaking the casing by having them in a line. A signal is sent down the cable and the charges go off. The hot plasma of the charge literally melts a hole in the casing...about a 1/4 to 1/2 inch in diameter.
Thanks for that; appreciate the reply.
Yep, agree with the long, declining plateau (wrote it here myself about 3 years ago). Stunned at the use of explosives for the final perforation! You oil folk certainly like a challenge!! :)
Cheers
I suggest a search on YouTube. I got curious and found some good videos there. The guys don't seem to heed Rockman's cautions though ;)
NAOM
Interesting piece.
A couple of thoughts:
As you mentioned earlier, there is no way to reduce risk to zero unless you eliminate the activity that generates the risk in the first place - so, unfortunately, at some point we will likely have to publish another list like that one.
I sometimes wonder at the value of attempting to understand risk in this way...
As the activities we participate in become more complex, "predicted frequency" seems to imply a greater ability to understand what variables will be of consequence than is actualy the case - a sort of risk management hubris that fails to account for perceived "randomness" in complex systems.
Shouldn't risk management strategies for activities with the potential for high consequence events employ wider margins that attempt to encompass the unknown or unknowable?
Thanks for the comments.
1. Yes, sooner or later we will have to publish another list like that one. Risk is always finite, which is why goals such as "no injuries" or "no defects" always bother me. But management seems to like that approach to goal-setting.
2. The risk equation is indeed of limited value for very low likelihood events. One reason is the existence of "common cause" effects in which a single failure causes two or more supposedly independent systems to fail simultaneously. These effects can be very, very difficult to identify.
The second reason for concern with the equation is what is currently referred to as "Black Swan" events - those events that come totally out of left field. Therefore, the response to "Shouldn't risk management strategies for activities with the potential for high consequence events employ wider margins that attempt to encompass the unknown or unknowable?" is a definite "yes". Specifically, the strategy should include a robust emergency response capability.
Thanks for the reply.
Not being a professional in the oil industry, I am not so familiar with how that industry accomplishes its risk management programs.
With the future of oil extraction in deeper and more difficult to access regions, I am concerned about how/if the industry will be addressing the increased complexity of their operations with correspondingly greater risk management strategies.
To what extent will expanded/enhanced risk management strategies become an opportunity cost to the greater levels of financial investment required for operations?
Theoretically, is there a point after which investment in risk management becomes stagnant or decreases relative to increasing operational complexity?
Your concern raises an important issue; in some ways the near-sinking of ThunderHorse (2005) had as big an impact as DWH. No one was injured, but $2.5 billion of equipment nearly went down. Risk management is consequently becoming a more integrated activity (safety, environment, production, capital loss) than it used to be. And it is likely that investors and insurance companies will take an ever greater interest in risk management plans.
Regarding the specifics, BSEE has released a draft version of SEMS II, which will probably go into force 4Q 2013 (after the first wave of SEMS audits is completed). Also, philosophically the GoM seems to be moving toward a European-style Safety Case culture (This topic probably needs another post. There is not really one offshore oil industry. The manner in which safety is managed in the North Sea is quite different from the Gulf of Mexico).
Will there be a point at which risk management investment becomes stagnant? I don't think so. In spite of their costs these huge platforms generate enormous revenues.
Mr. Sutton,
Thanks for the post. I actually read through a tiny bit of one of your books back when I was researching post-Deepwater Horizon safety regulations, and how (/whether) they have changed offshore drilling safety. (I work at an environmental non-profit.)
I just wanted to make a couple notes about the track record of SEMS/SEMP - any thoughts would be welcome.
1) BP had in place a lot of internal policies that mirror aspects of SEMS/RP75 you list above. Clearly, those internal policies were not followed. Which begs the question - will offshore drilling companies in the GOM follow SEMS regulations? Considering that the number of inspectors in the GOM hasn't changed much (from 58 to 86, 25% of the increase BSEE has as its goal) and that the size and issuance of penalties hasn't changed, I don't think mandating SEMS/SEMP via regulations will fundamentally change how offshore operators actually use it.
2) In 1998, 98% of operators in the GOM said they had a voluntarily implemented SEMS program in place. By 2006, that number was down to ~60%. But over that time, spills and violations still occurred at rates comparable to recent years.
3) As you point out, "acceptable risk" varies from person to person. Even in the North Sea, you still have major spills occurring on a regular basis, which is an "unacceptable" risk to me. And then there's the new information about Total ignoring warnings from its workers about the gas well that's now leaking, which suggests the offshore drilling industry's safety culture isn't what it's often touted as in that area.
I guess I see SEMS/SEMP as a useful tool in improving offshore safety, but not enough to make offshore drilling significantly safer, especially in light of the ongoing problems in other aspects of offshore drilling regulation - insufficient prescriptive regulations, insufficient inspectors/penalties, etc.
In my view, the DWH incident was not really to do with RP 75 or SEMS. It was about continuing to work when they knew something was wrong (see my comments above on tomorrow's Taking a Risk for Safety paper) and on not following simple standards (see the first comment to do with mud weight).
Regarding regulations, it is my understanding that people are deterred not so much by the size of the punishment as by the chance of getting caught. If you are driving over the speed limit it is not likely that an increase in the size of fines will slow you down, but knowing that an office is around the corner certainly will. BSEE has issued its first audit letters and they have certainly perked up interest in SEMS.
I agree that SEMS/SEMP are useful tools; they are the foundation of a management system. But, these days, I would estimate that as many as a quarter of the papers at process safety conferences are to do with "culture" (whatever that is).
ChE: MY father's career (after WWII, during which he worked on the Manhattan Project), was spent at the DuPont Nylon Plant in Chattanooga. I worked there during summers while I was in college. Then I married a guy who took a job as a ChE researcher and product developer with DuPont's orchem R & D lab up in N.Jersey. My brain has a special place for doing all the little (and sometimes big) risk assessments, and weighing and evaluating the risk-to-benefit ratios -- in a matter of split seconds sometimes. I am not a perpetual scardy-cat. Just "pay attention." And I do not ALWAYS make the best decisions -- just most of the time. I could write a book about "safety culture." I am almost 70 now, and it lives inside me. :)
e - I've never had any training is risk assessment. And at 61 yo I doubt I ever will. What I've learned has been on the job observing the process for 36 years. When I taught young geologists I gave them a simple rule to follow. Consider that the decision you're about to make goes wrong. Then after the fact you need to explain why taking that risk made sense in light of the loss. What would you say? Granted a geologist's mistake would more likely result in the loss of a few hundred thousands of $'s and not human life or environmental nightmare. But imagine you'll be compelled to say that you lost that $800,000 logging tool in an effort to save $30,000. Or even worse not to save money but to acquire some additional data the value of which wasn't completely certain. If you're not comfortable with your explanation in the theoretical exercise imagine how you would feel doing it in front of management after TSHTF. You will make decisions with poor outcomes in your career...they are unavoidable. But you should always be able to make the case for your decision after the fact when it goes wrong. If you can't do that in advance then perhaps you should re-evaluate the situation.a
One of my joys of leaving the chemical industry was not having to worry about risk and employees. I had been through one disaster in NJ when a dust explosion killed 14 people. Another engineer and I were the corporate "death team" that investigated plant fatalities following that...of which there were only a couple while we were doing it.
In the case of the dust explosion, I was at a management meeting in another state when word came toward the end of the meeting that "my" facility had blown up. I spent 4 hours driving back with my boss thinking that somehow my training of my employees resulted in a disaster that destroyed a plant and killed people. When we were about 5 miles from the site, we could see the smoke plume. It was psychologically overwhelming! It turned out that it wasn't my problem but I'll never forget how I felt.
I eventually became the plant manager of a similar facility that had the dust explosion. It was never ending stress hoping I'd done made the correct moves at this plant to prevent a similar occurence.
Risk is the pits!
Todd
Maybe because risk management tends to leave out choice. You can only assume the less safe choice will always be chosen and design your systems accordingly. Idiot proofing as it is sometimes called. If I keep my child away from the stove, am I really reducing his risks over the long run? Therein lies the rub, identifying the real risks and the true level of those risks, in the long term as well as the short. A proposition that can be as difficult as the original task. Did risk finally ground the space shuttle or was it cost?
I do some idiot proofing for my dog.
I don't use a leash as she obeys commands very well. So when we need to cross the road, I tell her to sit, to ensure she is under control, I check the traffic, and then say OK, she and I cross the road. Now to me this a safe and controlled action.
The problem is she never looks, and never seems aware of any traffic. I don't feel she has learnt any road sense, but with me, she always crosses the road safely.
My problem is, I feel I go through the same practice at work, with the same result. We all follow a strict prescriptive set of rules, if you don't, you don't hang around for long, but we also loose contact with the world that lies outside that set of rules.
At one time in the oilfield you were rewarded for out of the box thinking and being adaptable, these days unless it is written down and signed off by the crowd, then even if the job is carried out safely and successfully you are still likely to have your head cut off.
In my opinion the industry is quickly being de-skilled, by allowing the idiots time to survive in the industry.
In my opinion the industry is quickly being de-skilled, by allowing the idiots time to survive in the industry.
Take it from a former IT guy, there are reasons beyond safety to simplify systems. To save labor costs. Companies do not act out of safety. They act out of economic survival and safety liability happens to be one culprit. It is the capitalist model. That is why we need socialist government to assign value to choices beyond the profit motive. If a few lives are saved in the interim, so be it. Such is our current system.
CC
FWIW - Per Reuters http://www.reuters.com/article/2012/04/02/us-total-elgin-helicopter-idUS...
There is an example of political correctness run amok!
The last person on the bus ought to be the driver. The driver has the most responsiblity. Sully Sullenberger checked to make sure everyone was off the plane. In contrast, Francesco Schettino abandoned his post.
With all the questionable decisons, errors and bad luck, the Deepwater Horizon would still be afloat if those in the drill shack responsible for the operations that were taking place had simply shut in the well BEFORE the gas bubble was past the BOP. They had a good hour of indications of abnormal flow.
At least the Fukushima 50 had the guts to go back into the plant to pump water into the spent fuel pools!
How can you expect anyone to stop work if you never hold anyone personally responsible for his own actions? You let them blame the collective operating environment and not the operators? That well would not have blown out if someone had not displaced the mud in the riser with sea water!
The people in a position to control the events on the Deepwater Horizon paid the ultimate price for their inattention. If there is anything that will concentrate the minds of those involved, it will be a clear understanding of the price of personal negligence. The NTSB has no qualms using the term "pilot error".
From what I've read of the disaster the bigwigs from BP, in their zeal for quicker results (profits), basically overrode the on site engineers' assessment to slow down and not remove the drilling 'mud' too quickly. This certainly rings true with my own firsthand dealings with arrogant, power hungry bigwigs in a large corporate setting. Profits and personal glory first, employee safety a distant second. "The people in a position to control the events" are very rarely the little people on the front line. They are the corporate Masters of the Universe calling the shots from their air conditioned penthouses and private jets --safely far away from any danger when their decisions literally blow up in other peoples' faces.
Regardless of what the NTSB "discovers", it's pretty clear that executives at BP would like to sweep their own role in the disaster under the rug and pin the blame on (conveniently dead) low-ranking scapegoats. Personally, I would take NTSB or BP conclusions with a grain of salt and instead consider the first hand testimony and evidence uncovered by independent investigative reporting.
Don't beat up on the puppets, blame the puppeteers.
I'm sure there was push from above to go faster that's not uncommon, but you really don't have a clue how a drilling operation works. Many of these decisions are made at the wellsite and the others are made one level up from there by low level managers not by jet setting executives. Many high level executives don't have a clue how to drill a well. So Executives pushing for big picture speed and results yes, but not detailed well based decision making.
In a typical large American city around 500 people die each year in road accidents. Although many efforts are made to reduce this fatality rate the fact remains that this loss of life is generally accepted as being a necessary component of modern life, hence there is little outrage on the part of the public. Yet, were an airplane carrying 500 people to crash at that same city’s airport every year, there would be an outcry. Yet the fatality rate is the same in each case: 500 deaths per city per year
The oversimplification here jumps off the page. Relative man-hours spent in and around roads as opposed to relative man-hours spent in and around airplanes can't even be close to the same in such city--the death rate needs to be applied to the populations engaged in the activities being rated to be meaningful does it not. I'd say this item alone makes difference in this case far from
fundamentally subjective
I guess populations in both cases were killed within a certain distance of the city center but that just glosses over too many objective factors that are intrinsic to dying in either road or an air accident (or both at once) that are deeply internalized within our frame of reference to strengthen your claim that
The difference in perception is fundamentally subjective.
You must have a less flawed but still simple example out there somewhere teach
?-)
The weather was telling NASA not to launch Challenger, but they did. The decision to launch is forever regretted.
The right thing at the right time.
When you are staring at your potential demise because of one silly mistake, mostly because of lack of preparation, then you learn how to pay attention. You made a bad decision, but you get to live to tell about it. Several beers always help.
Works into problem solving and completion.
All of the work that is getting done to complete a well to have the oil refined to gasoline so people can drive 1200 miles to a concert is bordering on insanity.
'You drill the well for that oil if you want some gas'
'Get the stuff yourself if you want it so bad'
Barack Obama should have to drill his own oil well, refine some of the oil into jet fuel, and he should have to fill the 54,000 gallon tank himself.
Can't have that, increases risk. Gasoline needs to be rationed, imho. It will result in fewer highway deaths and fewer accidents in oil exploration.
Greater preparation, if you will.
I think this is a really good example-
There is a risk in getting killed in a car crash ( I believe it is about 1 for every 10 million miles driven)but the odds of that risk have to be weighed against the number of times you will get into a car and the cost incurred by not getting into the car. What you have to do is balance the aggregate reward versus the potential loss.
In the case of NASA they just didn't have enough launches to justify taking the risk of the weather. The potential loss was far to great relative to the cost of aborting a launch. With a limited number of launches -the probability of loss is meaningless. e.g. in the case of getting into a car if you are only going to do it once in your life would you take even a 1 in 10 million charge to drive to the super market?
This is also an interesting example as it illustrates what I think is a potential flaw in many risk management systems:
Managing risk based on the probability of a particular negative occurance can create a false sense of security - ie: lead one to conclude that aggregate reward out-weighs the potential loss.
This view may be correct in some circumstances, but when the risk being evaluated derives from a complex system, it is very difficult (impossible?) to know if the probability of a particular occurance has been established accurately.
This uncertainty is the realm from which the so-called "Black Swan events" originate.
A risk manager may determine that the risk of a particular negative occurance is say, 1 in 1000000 - when in reality, because of other unanticipated dynamics within the same system, the odds may be more like 1 in a 1000.
Just a bureaucratic note:
"The MMS renamed itself. Having gone through various iterations the agency which now has authority over offshore safety is known as The Bureau of Safety and Environmental Enforcement [ bsee.gov ] (BSEE, generally pronounced “Bessie”)."
That is not really accurate. One problem with the MMS was that it had a triple mandate: 1) help develop energy production, 2) collect royalties from energy production and 3) regulate worker safety and environmental concerns. Of course the goals were in conflict with each other and the last one was given less emphasis.
It should also be noted that the MMS was created by James Watt's Interior Department and funded by the royalties collected. Thus it lacked congressional oversight.
MMS Employees said accepting free trips, meals and gifts from energy lobbyists was their "way of doing business," and some said MMS employees should be exempted from certain ethics laws because of the agency's unique role.
The Clinton and Bush administrations allowed for "Categorical Exclusions" on various projects. Exempting them from having to file Environmental Impact Statements on installations. There were 3 in 1997 but up to 795 exclusions in 2000. The Bush administration an average of 650 categorical exclusions a year in the Gulf region.
Following DWH disaster, the Obama administration split the MMS into 3 agencies:
* Bureau of Ocean Energy Management: responsible for the sustainable development of the Outer Continental Shelf’s conventional and renewable energy resources, including resource evaluation, planning, and other activities related to leasing.
*Bureau of Safety and Environmental Enforcement: be responsible for ensuring comprehensive oversight, safety, and environmental protection in all offshore energy activities.
*Office of Natural Resources Revenue: responsible for the royalty and revenue management function including the collection and distribution of revenue, auditing and compliance, and asset management.
This is a good example of Tainter's concept of addressing problems by adding layers of complexity (and also a good example of why government bureaucracy expands).
"5.Are the government regulations sufficiently stringent and up to date, and are the regulatory agencies doing their work properly?"
We can't regulate having good leaders that use good judgment all of the time. Here's one question I've been asking since Macondo that no one has ever been able to properly answer. Why didn't our government put agents on every drilling rig in OCS federal waters? There was strong support for doing that from Republicans, Democrats and even major energy companies and it never happened. The energy companies would have even covered the rather small cost if necessary.
What's the government afraid of?
The government is likely well aware that regulation is a least-common denominator trailing indicator. Legislators should realize that they are not technically competent to write good leading edge regulations, so they adopt those created by private sources. If you are looking for safe boilers, you adopt the American Society of Mechanical Engineers (ASME) boiler code.
Check this out http://www.msha.gov/PerformanceCoal/NIOSH/Independent%20Assessment%20Pan...
The Secretary of Labor had an independent study done of the Mine Safety and Health Administration (MSHA). They were charged with safety at the Upper Big Branch mine, where 29 miners died. In between the weasel words of a panel paid for by the government, their criticism is still quite stark.
From page 4 of the pdf
So the inspectors ignored large accumulations of explosives just lying about over a period of four inspections and neither stopped work to clean up the dust nor closed the mine, though that was the specific nature of their employment! Twenty nine miners are dead. Tougher penalities against the mine's owner will not make the inspectors work any harder.
Firing inspectors might.
The value of regulation to the public is to provide a check and balance to the operators and owners. Standard engineering practice is for every drawing to be drawn by one person and checked by another. We are all human and make mistakes. So performing an independent reality check is a strong positive action. But faith that the government is some all-seeing, all-knowing oracle is plain foolishness.
Good work habits and good training are the first line of defense. Asking questions is something to be strongly encouraged. Would the DWH have turned out differently if someone had more forcefully asked, "What exactly is a bladder effect?" But group-think is both rampant and deadly.
As for BSEE, I for one still do not believe they know anything about rupture disks! The part of the chief counsel's report regarding rupture disks is riddled with misconceptions. And I am unaware of any of the many investigations of the DWH that actually questioned the manufacturer of the rupture disks used in the 16" casing subs. Who minds the minders??
So the inspectors ignored large accumulations of explosives just lying about over a period of four inspections and neither stopped work to clean up the dust nor closed the mine, though that was the specific nature of their employment! Twenty nine miners are dead. Tougher penalties against the mine's owner will not make the inspectors work any harder.
Firing inspectors might.
several decades of heavy construction under my belt--fastest way to get run off for a safety guy (never saw one first half of my career)--stop the work too often--they walk a hell of a tightrope in that 'hurry up and be safe' world. I've seen the job about break guys that came in from the trades...smacking down the hands and overlooking big ticket less than safe shortcuts by the companies was tearing them apart.
Lots of pressure from the money to make govt. inspectors myopic as well. No doubt they weren't doing the job they were officially paid to do but straight up laziness may not at all be the reason why.
Bruce have you ever worked on an offshore drilling rig? I'm not being rude or pointed with that question it's just a question. I'll follow up depending on your answer.
No I have not worked on an offshore oil rig, but I have spent over forty years selling products to people in the manufacturing business. I become their "expert" for the subject at hand. And selling is in large part teaching. You need to listen to what they want to do, then rationalize the situation in your own mind, then impart your insights back to the potential customer.
You have no idea how many "engineers" think they can heat a 500 gallon tank of water in 1-2 hours, with an electric heater they can plug into an ordinary 120 volt, 15 amp wall socket. Group think is verboten in my business.
Bruce, I'm sorry I was so late getting back to explain my question. We had a little tornado take out our local internet service.
What I was going to say is that an offshore rig is kind of a fuedal system where the Well Site leasder or company man for the energy company or operator is the High Lord and leader on many rigs still today. It's very different than any other type of working environment you've ever seen, but your quickly conditioned to accept that way of life, get in line or get a new job rather quickly. Now my reasoning for saying of federal government should have accepted the invitation to inbed agents on rigs in Federal waters is due to what I've seen over the years.
What I've seen is that upon arrival of MMS and BSEE agents to the rigs for a visit even the biggest, baddest and grumpiest of Well Site leaders turn into wimps. They damn near want to stop all operations until the agents leave. The power that the well site leaders have gets reigned back for a short period of time. Now If you inbedded agents on the rig, they don't have to have a whole lot of experience, they don't have to leave the office very often, all they have to do is be there. That would give company men and they're managers enough pause to make good, prudent and legal decisions. If they show up to morning call in meetings with the home office, pre-tour safety meetings and sat in on most pressure testing that would be enough to help more than you would think.
Wild - Based on the DWH, I don't share your hopes for the power of unsophisticated inspectors. Go back to the Big Bend mine accident. Through four inspections, the inspectors did not take any actions with respect to piles of coal dust lying around. Coal dust is so explosive, that would be like a fire marshall walking through an office where there were sticks of dynamite scattered around on desks and file cabinets and book shelves, who did nothing because the lights in the fire exit signs were not burned out and the fire extinguisers had been certified within the last six months. The inspector would be more likely to become a part of the gang.
The most effective inspector is a technically competent auditor. Many of my customers respond best to audits done by their insurance companies. When we make rupture disks, we have regular audits done by the National Board approved inspectors http://www.nationalboard.org/Index.aspx?pageID=66&ID=123
None of those auditors works for the govenment. They also are dealing with their customers, so they do not have the antagonistic reign-of-terror you can get from power mad government inspectors with police power.
If you look at the post about the Aftermath of the DWH, you can see that abuse of their police power led the Federal Government to force BP to stop its top kill operation, when it was on the verge of success, as determined by the govenment's own expert consultants from the Petroleum Engineering Dept at LSU.
Trying to infer what happened, I'd guess Steven Chu got nervous about using a pressure of 8,900 psi (relative to sea level) when the rupture disks were rated at 8,000 psi differential pressure, without allowing for the back pressure on the disks, which meant the disks were in no risk of bursting.
http://www.houmatoday.com/article/20100527/ARTICLES/100529348
http://online.wsj.com/article/SB1000142405274870487560457528013357716426...
http://www.nytimes.com/2010/07/17/us/politics/17chu.html?_r=2&ref=john_m...
The result is flow spewed into the Gulf unnecessarily from Late May 2010, until July 15, 2010!
There are a lot of people who agree with Ronald Reagan about the nine most terrifying words in the English language. http://www.youtube.com/watch?v=xhYJS80MgYA
Right now the government is trying to build a case that BP should pay $4,300 per barrel for 4.9 million barrels of oil, from a spill that the majority of which would not have happened if Steven Chu had kept his damn mouth shut!
EDIT - Check this out http://www.nola.com/politics/index.ssf/2012/04/michael_bromwich_opens_a_...
So now Michael Bromwich is going into the "protection" business, just like a mobster! He'll offer "consulting services" to those who are regulated by the agency he used to lead. What will his advice be, one wonders, how to make political campaign contributions to the "right" politicians??? He can't lobby the Interior Department to rationalize or fix the regulatory process, so where would be his value? His only value would be to the politicians as a fundraiser.
What did he do about inspections while he was there at BOEMRE? He went out to Columbia University to hire new graduates as inspectors for offshore oil rigs! So wet-behind-the-ears Ivy Leaguers with ZERO practical experience are supposed to improve safety?? That's counter to what the President's Oil Spill Commission recommended!! They wanted an industry based safety institute, such as the one in the nuclear industry. But it is right in line with the crony capitalism we see so much of in Washington D.C.
"I used to be with the government and I'm here to help you!"
This is from Ian Sutton. ChemicalEngineer is my pseudonym for this blog.
This is the first time that I have written for The Oil Drum. I am impressed with the quality of the replies. At the paper I gave yesterday I quoted this site and stated that it was rapidly turning into one of the premier publications in our industry.
Let me respond to some of the comments.
Rockman:
Regarding leaving sufficient weight of mud, I suppose we still need a system to ensure that what should be done is done. One of the factors that I see in bad accidents is that someone who was highly competent slipped up that day (I distinguish between slips and mistakes). We all do it. It's why pilots use so many checklists.
I really like your comments about having to defend a decision that you made.
By the way, thanks for all your comments on previous posts. I have found them invaluable.
Sponia
I quoted your words in yesterday's presentation. I wish that I could have provided a proper citation but I didn't know your name. The idea that there are two risk management tracks is very topical. I would estimate that a quarter of the new papers in this area are on the vexed topic of "culture".
wildbourgman
The lack of experienced people seems to be getting worse due to “The Big Crew Change” – a large number of experienced people are retiring, and we don’t have sufficient replacements for them.
miloshr
Another reference to the Big Crew Change.
Your comment, and the comments of others, circle the whole issue of prescriptive vs. performance-based standards. No standard is all one or the other, but Safety Cases (and Swedish nuclear power plants, evidently) are performance-based, whereas traditional API Recommended Practices are more prescriptive. Neither approach is better than the other; there’s a balance.
Maybe I’ll write another post on that topic.
adamx
Yes, people are more mobile and company loyalty (in both directions) is declining.
One of the challenges that SEMS poses is that the responsibility for safe operations lies entirely with the operator/owner. So, if a small painting contractor, for example, has an accident the regulator will come after the operator, not the contractor. So you are faced with the issue of company/company loyalty also.
Matt
Thanks for your question to Rockman about PO. For what it’s worth, I would agree with his response.
Lucas/Mcraig
See my earlier response.
erainh2o
DuPont has always been exceptional. You only had to walk through the gates of one of their plants to feel the difference. Back in the early 1990s their recordable rate was literally ten times better than that of their peers’. Interestingly, in the intervening 20 years industry has pretty much caught up with DuPont while their record has improved only a small amount. I wonder if safety performance levels out asymptotically.
Todd
My concern when working in the chemical industry was more to do with health than safety. I never knew what effect the chemicals I was breathing were going to have.
Regarding dust explosions, the Chemical Safety Board has done a lot of work in this area recently.
TinFoil
One of the ironies to do with our improved safety record is that many people have not witnessed a major event. I find that the easiest companies to work with are those that have just had a major event. It takes care of the, “I’ve been here sixteen years and I’ve never seen that”, with the unspoken follow-on, “therefore it cannot happen”. My response is, "There's the plant, lying on the ground behind a police-evidence line. Don't tell me that it can't happen".
Toolpush
Interesting comment – once more we come to the differences between performance-based and prescriptive standards.
Bruce
There have been three serious offshore blowouts in the last two months. The Total event is just one of them and seems to be very tricky. At least Macondo was so deep all the gas dissolved before it got to the surface.
Regarding “operating error” it is so easy to blame the operator when something goes awry. Of course the driver is responsible for the bus, but if the brakes fail the responsibility almost certainly lies in other areas such as the design of the brakes, the management of the maintenance group or the quality control systems at the company that makes brake fluid.
Regarding DWH, that was largely the theme of yesterday’s paper. The people on the rig actually had two days of warning. During those two days if someone had said, “You know what, things are going wrong, we don’t understand what’s happening – let’s close our valves, make a pot of tea and sit down and think about this” then this blog would never have been written.
HARM
So far we have two independent reports on DWH/Macondo (the report to President Obama and the BOEMRE/Coast Guard analysis). In my opinion, both provide very useful insights and do not defend management. (The third report – from the Chemical Safety Board – is being held up for legal reasons).
It might be useful for someone to write a post for TOD summarizing the findings of those two reports.
Luke H
I am not sure that I understand your comment. As I mention in the post risk is affected by all sorts of factors – not least the perceived benefit to the indidivual. Also, the analogy could be tightened by comparing long distance road journeys to airplane travel (given that flying to the local grocery store is not an option).
The essential point is that people generally perceive high consequence/low likelihood events as being particularly serious. As an example, the Fukushima Daiichi catastrophe has led to a shutdown of the both the Japanese and German nuclear power industries. Now that’s a strong response.
wardpierce
My first job was with a large chemical company. For my first week at work I was assigned to the night shift to “hold the tools for Fred”, i.e. to learn “what really goes on around here”. My first task for Fred to was to watch for maintenance workers while he fixed a minor leak. In other words I was a spy from one union against another.
They don’t teach you that at college.
In that company, for the first year of employment, no matter what you did, your paycheck came from the Training Department. The message was not subtle.
crazyv
Yes, it’s hard to calculate likelihoods when you have very little operating experience.
Lucas
I am working on a “Black Swan” paper. My early conclusion is that Black Swans don’t really exist – at least not in the process industries. But we do need to develop more imaginative hazards analysis techniques.
klee
Your’re right. I really didn’t want to get into all the government bureaucracy – MMS, BOEMRE, BOEM, BSEE – and all the rest.
I am not sure that splitting BOEM and BSEE is necessarily adding complexity. And it certainly helps ensure integrity.
wild/Bruce/Luke
Why would the government put agents on every drilling rig? Do they know what to look for? Look at the challenges that they are facing in findings sufficient Independent Third Party Auditors (I3Ps) for SEMS II.
The idea that legislators are not able to write good leading edge regulations is something that they recognize, hence the move toward non-prescriptive/Safety Case systems. For the same reason BSEE is calling on companies to develop their own audit plans. BSEE with then “audit the audit”.
Regarding company pressure, the key reason for splitting BOEM from BSEE was to separate the money-collection side from the safety enforcement function.
Ian - If the crew of DWH had simply asked questions, they would have been safe.
I have not seen any investigation deal with that simple observation. It seems that Macondo 252 was the very first time most of those involved, including the Halliburton people, had ever used nitrified cement as a pressure barrier at depth. There was near total ignorance!!!
So they got a nitrogen breakout, which caught them by totally by surprise and while they were pondering what to do (CLOSE THE DAMN BOP NOW!!!!!!!!!!) the natural gas got above the BOP. BOOM!
Not even Gagliano could tell the JIT team whether the use of nitrified cement at depth met the API recommended practices. But OptiCem let him put it in and so he did. No investigation ever publicly called Halliburton's experts to discuss the correct percentage of nitrogen (nitrogen quality) to use. Gagliano's design used way too much.
And did you hear all the blather about using a "long string" versus a "liner and tieback"?
Ask Chevron why their Sedco 706 well experienced an underground blowout despite presumably using a liner and tieback design
http://www.chevron.com/articledocuments/latest/news_203789/1457697f-c289...
The biggest issue facing the oil drilling business is dramatically improving the success of cement jobs, but you'd never know it from the government investigations. Cement failures caused BP's Macondo 252, Australia's Montara, Chevron's Sedco 706, Total's Elgin and a whole bunch of fracking drinking water contamination events.
Have you seen any of Halliburton's internal experts (not the Chairman, not the mechanics, but the guys who supervised the writing of the OptiCem program) testifying about cementing wells? No? didn't think so!
Ian - I'll repeat a point I've made before though it embarrasses me for all the collective oil patch. One can argue the technology of the situation till the cows come home. Was it the right cement to use? Was is necessary to displace with sea water? Did they test the bottom cmt plug adequately? And on and on and on. All valid discussions.
But how ever dangerous or not dangerous the situation was perceived by the hands on board the rig there was a foolish act of carelessness that can’t be debated or defended by anyone. Here is a very basic and incredibly simple (so simple some may not believe me) to tell if a well is flowing. Same method whether it’s a cased hole or an open well bore while drilling. They may be pumping down sea water to displace the mud or pumping down mud while drilling. When you pump a fluid down it will push fluid back out of the hole to the tanks on the rig. How do you know if the well is flowing (the prelude to a blow out) when you’re pushing fluid out of the hole as a normal course of operations? You simply turn the pumps off. We call this “checking for flow”. If the pumps aren’t pushing fluid out of the hole then it should stop flowing. If it continues to flow the something down hole is flowing into the well. It might be oil, NG or water. Or any combination of those fluids. But something is flowing into the well. That’s what we call “taking a kick”.
Even if there were no disagreement on the DWH over the safety of the cement job, watching the mud returns for flow should have been SOP. And I’m fairly certain it was a written SOP on the rig. When my hands are drilling and have to turn the pumps of in order to connect another section of drill pipe they check for flow. SOP for most operators. And if they have any concern about taking a kick while drilling they simply stop the pumps and check for flow. Takes less than a minute. The mud tanks on the rig may have sophisticated monitors keeping track of the volume of mud pumped down and how much is returning to the surface. Pump down 100 bbls of fluid and see the tanks gain 150 bbls of fluids: you know something is flowing into the well that shouldn’t be. The DWH probably had the state of the art of this type of equipment. Was the returns not being monitored? Obviously not. Even more maddening is that you need not depend on such an automated systems (they do screw up more often than you would like). You simply turn the pumps off and a hand looking at the return line either sees the flow stop or not. If it doesn’t stop he notifies the tool pusher that they are taking a kick. And there is a set of procedures to deal with that situation which will prevent a blow out.
So why the heck were they not following a safety protocol that a 10 yo child could have preformed? I’m not being silly: sit a 10 year old to watch a pipe and tell you if the fluid is still flowing after you turn the pumps off. It really is that simple. But I know the answer: they were shutting down operations. I’ve been in that situation. The hands are cleaning and rigging down their equipment. Materials inventory being taken. Helicopter and boat transportation being vied for. Management is filing final reports.
It was a simple matter of discipline breaking down. Every member of the drill crew and every manager out there understood the importance of watching for flow. The hand that made the sarcastic remark “Well…I guess that’s why we have a BOP” when his safety concerns were dismissed: why the hell didn’t he make sure they were checking for flow? From the early reports one person saw info the well was flowing: the boat captain who was tied off to the rig. They were offloading mud from the rig to his boat. He called up to the rig and told them to stop pumping because his tanks were full. The rig told him he had to be wrong: they had not pumped that much mud. Of course they hadn’t: the extra mud was being pushed out of the hole by the kick. So even with the earlier safety concerns and with the report of excess mud no one checked for flow.
There were procedures in place that would have alerted the crew to the kick. There were procedures in place to deal with a kick. The best safety protocols are worthless if they are aren’t followed. For all the bad decisions that might have been made the well need not have blown out. Discipline would have saved the 11, the rig and the GOM. And the saddest part: that discipline costs nothing.
to ROCKMAN
I think you missed the REAL point here (cause u comment only one single breaking part of chain which lead to incident) all incident like this one happened due number of failures ....not single one ...in your explanation - lost of hydrostatic head control (primary barrier in well control) is all that matters, but real problem is related at least to:
1. poor well design
2. poor execution (cement job)
3. push to complete well quickly (cost cut, underlying cause, but important)
4. poor well control response (that's your point)
5. wrong reaction when control is lost (psychological factor, very interesting one)
6. malfunction of secondary well control equipment (I've seen very interesting results of forensic investigation about that)
7. very dubious response once the incident was REAL (including firefighting of rig + everything else, dome, bullheading, etc....)
that's only 7 chain elements I can recall from one of investigations reports I have read ...there were actually 9 0r 10 ....
my point is ...yes primary well control was one of cause of disaser, but not only and not even fundamental one , incidents like that usually happened as combination of failures.
sorry for my bad english
The report is part of the blame game. If everyone is at fault then noone is solely responsible. What you're reading is part of an elaborate 'cover thy butt' protocol which happens after every single major disaster. What Rockman said is entirely valid, for want of a 10 year old the well was lost.
h - Your English is fine. But I think you miss my point. All the potential failure points are correct. I've seen most of them fail many times in my career. In 36 years I've probably had over 200 cement jobs that failed which had to be redone. About 18 months ago I had 3 failed cement jobs on just one well. That's exactly my point about monitoring a well closely: every aspect of the well could be done improperly and it still doesn’t guarantee a blow out to the surface. Just 6 months ago I had a well drilled by an outside company that blew out. Fortunately they saw the kick coming and the shut the well in. Unfortunately the well still blew out. We call it an underground blow out: the high pressure NG blew into a shallow formation. Never reached the surface...no dramatic "Film at 11".
If the DWH crew had notice the well flowing they would have shut the well in. Once shut in there are fairly standard procedures to kill the well. Again, in my career I've had this situation develop at least at least 30 to 40 times and not once did a well explode. Again, to be very clear: Had the DWH crew had seen the well flowing they could have shut it in and eventually killed it. And neither you nor anyone in the public would have known how close the nightmare had come. Since the DWH blow out there have been many such events...probably many dozens of similar events in the US alone and you've never heard about them. And there have been similar events in the US when they didn't shut in the well in time and there were explosions and injury/deaths. And yet I doubt you and 99.9% of the public are aware of those incidents…not the big story like Macondo. Had an onshore well blow out about 10 months ago two miles from where I was standing, killed one hand, burned and was put out. You remember seeing stories about the Maurice tragedy? Didn’t think so. LOL.
The bad cement jobs, casing failures, BOP malfunctions, etc happen all the time. The kick at the Macondo well was not a rare event. Happens often...every week in the oil patch. What was rare was the crew not seeing the kick coming in time to shut the well in. Deep Water GOM drilling has resumed. And I can promise you there have been a number of kicks experienced in those wells. No...that's not said to make folks feel comfortable. The only difference in those events and the BP blow out is that they knew the wells were kicking and they shut them in and killed the flow. You’ll never see a TV from Chevron bragging how they took a kick on a DW GOM well and thanks to the response of the drill crew they averted another potential Macondo blow out by perhaps just minutes. And if that hasn’t to Chevron yet it will certainly happen in the near future.
Rockman - I think one of the factors that surprised the crew was that the well was blowing nitrogen. Therefore they did not get any gas alarms until the nitrogen ran out and the NG suddenly caused the whole board on the bridge to go red all at once. There was testimony from the officers on the bridge that they had never trained for more than one or two simultaneous alarms.
Confusion causes a deer in the headlights kind of reaction. The nitrogen was injected at a fairly high pressure (between about 1,000 and 1,600 psi) and compressed further to 12,000 psi as it was pumped down hole, but if allowed to expand to atmospheric pressure and temperature, its volume was something like 8,000 barrels! So there was "snot" raining down from above, no gas alarms and still no one shut in the BOP.
They didn't need to look at the tanks, it was raining mud, and no one shut in the BOP. Instead they got on the phone to pass the buck up the chain of command.
Bruce - Thanks. I had forgotten about the N2. Just one more reason they should have paid even closer attention to their mud volume returns. As far as passing the buck I make it clear to everyone of my drilling consultants on all my wells: you'll never be criticized for making a costly call for the sake of safety even if I disagree with that call. OTOH if you make a bad safety decision and tell me you did so to save me money you’ll never work for me again. I doubt any BP shore based manager has ever made that point to the field personnel.
But to give credit where it is due: I’ve seen ExxonMobil managers take my position. Folks may love to hate XOM but I’ve worked with few companies that put safety above profits as much as them. At least at the field operations level.
Rockman -Let's see if we can reach some more areas of agreemnet based on a lot of hard work and thought that we put into understanding the DWH.
Specific to Macondo 252, there is the fact that out of all the wells ever drilled in the history of Mankind, this is the only one that used nitrified cement for a pressure barrier (as distinct from foundational support for the large diameter conductors) with such a huge percentage of N2. It was UNIQUE.
In the more general sense, I think we both agree that no safety management system will work unless the people involved accept personal responsibility for safety. That would be your 10 year old watching for returns when the pumps are stopped.
We have discussed before the importance of fostering an attitude where people ASK QUESTIONS! The offshore drilling industry is built on a quasi-apprenticeship model, where people learn on-the-job. That reality is what leaves me so aghast that seemingly only one person aboard during the pumpiing of the cement had ever used nitrified cement for a pressure barrier before (though there might have been more, I never heard anyone say so), not even the cementing contractor's (Halliburton) foam team members. That's like Mickey Mouse trying out the Sorceror's magic wand.
Wild Bourgman asked me about my experience, which is as a vendor. Working on commissions, I do not get one red cent unless the potential customer buys something. And Rule Number One is "The customer is always right!" Except in my business it is possible for uninformed customers to choose options that are dangerous, impossible or both. So I have to have the integrity to say NO!, even at the risk of starving, in the greater hope that by teaching him I can sway him to a new option that will do something he'll pay for, that won't kill him. I'm in a tough business!!
As part of my business, you have to be able to say "I don't know, but I'll try to find out" and go out to find others with more knowledge and/or relevant experience to reach a greater understanding of the problem. For the DWH crew that would have been saying I don't know what the "bladder effect" is, let's bring in the brain trust to hash it out. Let's stop work and call the shore team!
Finally, there is the recognition that a micro-managing, top down command structure is not a guarantee of safety. Lot's of people wanted to blame Tony Haywood for the DWH accident, though he was totally out of the loop. If the crew had realized that they had a leak through the cement in the shoe track, they could have done a remedial cement squeeze job and still had a viable well with Haywood none the wiser. Government regulators like to interject themselves into the mix as all-seeing, all-knowing swamis. I hope today's news events give them a dose of reality. By noon today, a Department of Justice lawyer will go before the 5th Circuit Appeals court and submit a three-page, single spaced, written confirmation of her prior verbal agreement, renouncing feality to the Chief Executive of the Executive Branch and re-affirming her fealty to the Law of the Land, the United States Constitution.
In the Real World, compliance with the regulations doesn't mean anything, compliance with the Laws of Nature is all that really matters.
Now let me concentrate on my own perspective, separate from Rockman's. This is just my own.
As a salesman for rupture disks, I find it useful to understand how users can misinterpret the instructions, or misuse the product, so as to cause a danger to themselves, outside of my control. I do NOT want to waste time sitting in a courtroom while lawyers run up the billable hours trying to find someone to blame.
So I find it appalling that after all the hours of investigation and hearings and legal discovery, that seemingly no one understands that rupture disks are pressure DIFFERENTIAL devices. So perhaps an illustration of the principle will help. You all have seen video of the Titanic resting on the bottom of the Atlantic. You may also have seen pictures of the USS Thresher on the bottom of the Atlantic. Titanic is, relatively speaking, in one piece; Thresher is scattered in lots of tiny pieces.
The differing results are due to the differing pressure differentials placed on their hull plates. Titanic flooded before she sank, equalizing the pressure differential, so with little to no pressure differential, she remained in one piece. The Thresher was filled with air as she exceeded her test depth, so there was a very large pressure differential across her hull plates. She imploded and broke into tiny pieces.
You cannot understand rupture disks without understanding the pressure differential they will be exposed to.
End of today's lesson.
Bruce,
You have confused me a little here,
Are we talking about the rupture discs that blew out in the Mud gas separator that flooded the main deck with gas from the well.
Or are we taking about the rupture disc in the 16" casing that everyone was worried about when the considered opinions thought the leak path was up the outside of the casing. Which in 20/20 hind sight proved to be a red hearing as it was discovered the shoe failed and the leak path ended up being directly up the 7" casing (I think that was the string of casing they were cementing)
Bruce - I understand all too well about hands not wanting to ask questions or express concerns when they are unfamiliar with a system. When I have a pre-job safety meeting and ask if everyone understands their job I look for the eyes that look down. And then I start asking them questions. Not uncommon to turn up some problem. I knew nothing about rupture disc until you and the wildman began explaining it way back when. Again, if the rig management had any uncertainty about the N2 cement you think they would be watching returns even closer. And since watching returns is SOP they need not admit any uncertainty that could hurt their egos.
Maybe my very early experience with death on the drill floor has marked me for life. I'm fanatical about checking returns when there's little or no reason for worries. But to put a well in an underbalanced state with a cement with uncertain stability in a well with a known high pressure oil reservoir? I would have both towers on deck taking care of business. And me, the mud engineer and probably a couple of more hands would have been on the mud tanks watching returns until the top plug was set and tested.
But that’s just me I suppose. I’ve pissed off a few hands in my career by pushing safety. But the vast majority appreciate it…we all have someone waiting at home for us. I’ve mentioned it before: about a year ago I had my consultant jump on a hand who stayed in the drop zone when they were unloading drill pipe off the truck with a fork lift. I try to do it like this: me bad cop…my consultant good cop. Hand shot me a dirty look. I think had I not been standing there on crutches he would have walked over and got in my face. And then another roustabout nearby told him about another hand that was killed a week earlier about 40 miles from where we were. A joint of casing rolled off a fork lift and killed him instantly. He didn’t say anything but his face did soften some. And, of course, he looked down at the ground. LOL.
Rockman,
Couldn't agree more with the eyes.
I doesn't matter what language the the person speaks the eyes always tell the story. I never worry too much what the mouth tells me, I also watch the eyes to look for understanding. If I don't see the correct response, then I know I have to try another approach.
Gentlemen - The rupture disks I am talking about were the ones in the 16" casing subs. If you go to the Oil Spill Commission Chief Counsel's final report Chapter 4.2 http://www.oilspillcommission.gov/sites/default/files/documents/C21462-2... (page 5 of the pdf, page 56 of the overall report) you'll see the ones I'm talking about.
The principal point where they came in to the sequence of events was during the "top kill" and subsequently where a debate raged about the possibility of an underground blowout. This for a well that ultimately proved to have pressure integrity during the "well integrity test" begun July 15, 2010. How long had the debate raged on TOD that the flow was up the annulus? Well the Chief Counsel had something to say about the flow path too! http://www.oilspillcommission.gov/sites/default/files/documents/C21462-2...
But let's concentrate on the causes of the accident and debate the containment operation separately.
Regarding the issue of nitrifed cement as a pressure barrier at 18,000 feet, as near as I can tell (and I could have missed someone) the only person to express any reservations was Transocean's Offshore Installation Manager (OIM) Jimmy Harrell.
Let me quote from Joel Achenbach's book A Hole at the Bottom of the Sea page 133
So the use of nitrified cement led Harrell to recommend the negative test to look for exactly the problem which did arise, a bad cement job. They all were supposed to be looking for the exact problem that caused the blowout, but they explained the anomalies away with the "bladder effect". And, according to Lee Lambert (page 227 of Achenbach's book), it was Jason Anderson (Transocean's Toolpusher) who offered that explaination. Jason Anderson died in the accident.
So how do you develop a plan to avoid that chain of events?
Bruce - wasn’t going to beat that dead horse anymore but since you asked. Not wanting to sound flippant but you well never eliminate the potential chain of events that led to the blow out IMHO. You can use the perfect cement for the job but if the cement engineer mixes it wrong (not a rare event) the cement job can still fail. You can use the perfect cement mixed exactly correct and pumped exactly how it should and you can still develop channels in the annulus that allows the well to blow out. You can run a cement log that shows a perfect cement job but have an undetected micro-annulus that allows the well to blow out. You can do positive and negative tests that indicate the cement is good but can be misinterpreted and the well can blow out.
Some folks think the BOP is the “last line of defense”. They are wrong. The BOP is the worst line of defense. Someone tossed the stat out during he DWH event. According to Statoil in the last 20 years or so 40% of the time a BOP was activated it failed to some degree. The last line and the unarguable best line of defense is keeping the well over balanced. If the reservoir pressure is 11,000 psi and the mud column is exerting a bottom hole pressure of 13,000 psi the well will not flow…the well will not blow out. Doesn’t matter if you use N2 cement…doesn’t matter if you pump no cement at all. Doesn’t matter if you misinterpreted the tests. Doesn’t matter if you have rupture discs in the well or not.
There were cost saving reason why BP displaced with sea water. There was no technical reason they had to leave the well underbalanced. Additionally they could have set removable packers (think “corks”) in the casing as an additional safeguard…just would have costs some more money when they came to complete the well. This works: the only time in my 36 years I intentionally put a well in an underbalanced state is when I’m perforating the well. At that time all the equipment is in place to deal with a flowing well and everyone knows the well is coming in.
A very simple non-technical analogy: how do you avoid shooting someone accidentally. You can follow standard weapons handling safety procedures and you can still accidently shoot some when you drop the gun. You can put the safety on and still shoot someone…safeties have been known to fail. So how do you make sure: you don’t load the weapon. IOW you don’t put in a condition where it can fire…and you don’t put a well in a condition where it can flow until you're prepared to handle the flow.
And when you know the weapon isn't loaded you still follow the same safety protocols for a loaded weapon.
BP did what it did because they thought it would work and it would save money. They did not have to follow procedures that put the well in an underbalanced state. They did so because they thought it would save money. They were wrong.
Rockman - A few more observations.
The decision to do a negative test was a last day decision. From the collective testimony of various people on and off the rig, it seems virtually no one had ever done a negative test on the cement in the shoe track before. So that was yet another first time procedure they just did without thinking or learning about. To do one, you have to underbalance the well, so I would assume you never have done one either, if you have never underbalanced a well.
Given that the riser and production casing were displaced down to about 8,300 feet and the annulus was still full of mud up to the production casing hanger, there was about 3,300 feet more mud in the annulus then in the production casing. This meant the hydrostatic head in the shoe track was lower than the hydrostatic head in the annulus [(14.2 ppg mud - 8.5 ppg water)x -3300 x .052 = -978 psi). Which is what Jinn was going on and on about, that they never actually performed a negative test in the annular space, (which was based on his incorrect assumption that the flow was up the annulus). The negative test in the shoe track was designed to be -999 psi. Add in that the lift pressure due to the Top Of Cement (TOC) being higher than in the shoe track, and you can see what he meant. The head difference plus the lift pressure exceeds 1,000 psi. They never did get the hydrostatic pressure in the annulus into negative territory. That's just one more nail in the annular flow theory's coffin.
As to waiting too long to close the BOP, consider that the captain of the Damon Bankston was subjected to a rain of mud that included chunks of cement. Where did the cement come from? With the actual flow path, it had to have come from the shoe track. So by the time the cement chunks hit the deck of the Bankston, the well had ejected all the mud between 8,300 feet and 18,000 feet inside the production casing. That's a lot of mud!
None of that 10,000 feet of mud should have been displaced with sea water, so it was all excess returns. Who was watching for excess returns???? It seems the answer is no one. Which goes back to the question, what were the guys in the drill shack doing? Some one once facetiously suggested watching porn movies on their displays. I don't know what they were doing, but for all the attention they were paying to the well (none), they might as well have been watching TV.
Bruce - Great explanation of the negative test. I know more about drilling than most geologists but such analysis is beyond me. With re: to " I don't know what they were doing, but for all the attention they were paying to the well (none), they might as well have been watching TV." I mentioned it before. They were in the process of mobilizing the rig off the well. I've been there many times and it is nothing but non-stop distractions. Services companies are packing up their equipment and left over materials. Everyone is competing for space on boat/chopper transport. Statistically more personnel injuries occur during this time. Thoughts tend to be back on the bank. The situation with the mud being offloaded is a perfect example. Simply put the captain was telling the rig they had an excess of drilling mud. The only source for it would be from the well kicking. Yet no one with that info put 2+2 together. And as you say: who was watching the volume in the mud pits? Obviously no one. Adding to that during mud transfers it can be very difficult to keep track of volumes so extra efforts need to be taking.
I always feel uncomfortable laying the ultimate blame for the well blowing out as result of the crew not keeping track of the mud returns. Many mistakes/poor techniques/ineffective corporate policies can be discussed. But every hand on the rig, including the galley crew, understands the importance of monitoring returns and that well will flow indicates a kick is underway that could lead to a blow out. Possibly a number of the 11 failed to catch the sign of the kick. Obviously none of them can defend themselves now. For all the other mistakes made the drill crew has the responsibility to monitor the well and react accordingly. In such a situation the driller and tool pusher has the authority to override any corporate policy e it BP and the drilling contractor. And in my experience most won't hesitate to do so when it's their lives are on the line. And that makes it all the more difficult to understand what happened.
Rockman - Thanks for the compliment.
Now let's look at Part II of this two part drama. Part I was the accident. Part II was the aftermath. We have done extensive independent "audits" of the accident. But with the government using its police powers to intimidate the public sector players, we have not gotten an independent "audit" of the aftermath, which was the time interval starting with the declaration of a "spill of national significance". The governemnt was in charge, but their players were ill-prepared for a supervisory role. How many times did the comments here on TOD note that Thad Allen was way behind the power curve? And he was taking orders from his superiors up the chain of command all the way to the White House, who knew much, much less.
As we have seen, even in an industry where the penalty for inattenion/ignorance/distraction/sloth etc. etc. is DEATH!, accidents will happen. So we collectively need to address the methods and techniques of blown out well control. Right now we have a blown out well to deal with, Total's Elgin Platform. But we cannot do an audit without an effective investigation that will not say "NO!" to the organization being audited, the United States Government.
I expect many of you had never seen the pictures in the Chief Counsel's report on the flow path. No one in the government has come out in public and said that the Macondo 252 well was killed by the static kill operation in early August 2010. They stood by their message that "the relief well is the final solution" long after the facts demonstrated the static kill was the final solution. They pulled the BOP off the well head leaving it open to the sea with nothing coming out and it was still "the relief well is the final solution".
As Paul Simon put it, "a man believes what he wants to believe and disregards the rest".
Understanding what is going on down hole, with a very limited set of indicators, is difficult. If I were to do an audit, I would talk to Mark Hafle, the senior drilling engineer at BP, to discuss some of these things we've learned, but no one seems to have had enough insight to ask him about.
How is it that the depth of the drill pipe during the displacement to sea water was so close to the point where the negative pressure on the shoe track was at the maximum possible negative pressure without also going negative in the annulus? It seems it might have been deliberately chosen to do the toughest test possible on the nitrified cement in the shoe track without ambiguity caused by the annulus flow path, in response to the concern voiced by Transocean's senior man on the rig, the OIM Jimmy Harrell.
And somebody at BP chose to use the rupture disks in the 16" casing subs, specified the burst pressures to Weatherford, whose engineers in turn specified them to the rupture disk manufacturer (I do NOT know who that was, let's call them SRDM for Sub Rupture Disk Manufacturer).
SRDM supplies disks to the specification Weatherford gave them, which was the spec BP gave Weatherford. So SRDM bears ZERO liablity for what happened, but would have been a great source of engineering information when Steven Chu (with input from BP) decided that blown out rupture disks would make further attempts to top kill the well in MAY, 2010 dangerous!!! Is there anybody out there who wishes that Chu did NOT overule BP and let them finish the top kill?
Here is another document you almost certainly have not seen http://www.oilspillcommission.gov/sites/default/files/documents/Analysis...
So what you have is the government's own consultants from LSU saying that the decisoion to stop BP from going to a higher flow rate during the top kill operation was all that stood between BP and a successful top kill in May 2010, whereas the well ultimately spewed oil until July 15, 2010!!
I do not see anyone in the federal government taking ownership of that!
Speaking of Total Elgin Platform http://www.elgin.total.com/elgin/home.aspx
The Titanic is actually in two pieces. The flooding of the bow lifted the stern out of the water. The weight of the stern cracked the ship in half.
Ian, first thank you for the key post, I should have said that in my initial comment.
Shouldn't have muddled that comment with the second paragraph. I understood that
The essential point is that people generally perceive high consequence/low likelihood events as being particularly serious
perfectly.
In my opinion your chosen example did not illustrate that point very well. Man hour exposure to hazard is a major factor in determining risk, it is an objective criteria, incident per man hour exposure is pretty much how you are going to define frequency. In a typical large American city the number of man hours yearly spent in a locale that would expose a person to death from an airplane crash (including all within each flight's potential path if it left the air) would be dwarfed by the number of man hours spent in a locale that would expose a person to death by a road crash (including all within each travelling vehicle's potential path if it left the road).
So the perception that 500 people dying in an airplane crash a year is less acceptable than 500 people dying a year in road accidents is born out by the rate of fatality to man hour exposure. The fatality frequency of the former would be much greater as the man hour population exposed would be much smaller. In this case we have both high consequence and higher likelihood.
But mention of the Fukushima catastrophe brings up a couple questions:
1. What is the relative frequency (using the man hour exposure metric) of death by tsunami to death by exposure to nuclear power plant radiation?
2. How is that relative risk perceived by those with relatively high exposure to either or both?
3. How is that relative risk perceived by those with relatively low exposure to either of both?
"Why would the government put agents on every drilling rig? Do they know what to look for?"
You can see my earlier repsonse the Bruce for more on this, but in short, the agents don't need to have to know what to look for, all they have to do is be there. They have to make the company men on the rig and the managers in the office think twice. They have to be the guys to ask questions and report to they're office daily. We don't need the government to be the experts or in control of the drilling ops we just need them to be available. If the drilling contractor supervisor has a concern, the agent on the rig would be the guy he could talk to when he can't go to anyone else.
It would be cheap insurance that would have helped me on at least three occassions since Macondo and countless ones before. Why would anyone be against that? It couldn't hurt!
ROCKMAN ...I got your point ...don't worry ...I do have also some experience in the business
and yes, I agree with you about one ....basics well control principles were not followed, anybody who know anything about it knows that - but you didn't discover anything new ...still, hydrostatic control is just one of barriers to avoid this kind of disasters to happen. I am pretty sure that hydrostatic column of mud plays nothing in recent North Sea incident. Right? Your focus is on drilling and construction, my is on overall well life ...that's only difference ...even if you lose control you can get it back, if your rig is not under fire or sink down the sea...that's one of chains of decisions I said in previous comment... flow goes to the rig and platform, but it could be released to sea - that's also something to think of.....that's psychological factor I mentioned in previous comment. if they did proper cement job ...nothing would happened. if they left the well with heavy mud ....nothing would happened for the time the rig is still there to maintain that heavy mud column....but, later on who knows? if the bop closed properly ...again nothing would happen. your explanation is maybe very interesting to laics, but not really to people who are in the industry ...your 200 failed cement jobs in your career (and I am not surprised about that number at all) is something industry should really be concerned of. well control is nothing really but, fire fighting ...alter all...
h - "I am pretty sure that hydrostatic column of mud plays nothing in recent North Sea incident. Right?" Actually, if I understand the condition of the well bore at the time of the leak, there was no column of mud/fluid. In the production phase the casing contains nothing but the oil/NG. The only way to control that flow is via the well head. There could also be a safety valve sitting below the wellhead that might automatically shut the well in under certain conditions.
And that's the problem they face now. They either have to fix the wellhead to stop the leaking NG or try to pump a heavy kill fluid into the well bore to offset the high reservoir pressure.
http://www.elgin.total.com/elgin/home.aspx
Given that they were involved in a plug and abandonment procedure, it is likely that there was mud in the well. That would be why there was such a low pressure (5 bar) at the well head. So increasing the average mud weight a relatively small amount should be enough to overbalance the well and stop the flow of gas.
All this talk of using a high pressure bullheading operation is foolish (pre-supposing the reports of a 5 bar well head pressure are true!). A pressure of 5.1 bar would start a downward flow of mud. The trick is to work around the wellhead without creating a risk of fire.
Lubricate and bleed! It's right there in the well control syllabus!
Though I would do it by hot tapping the 30" conductor at the mud line and letting sea water in to increase the average mud weight in a simple, de facto, 300 foot deep relief well, safely isolated from any source of oxygen to support a fire.