Mary Beth Mulcahy, Ph.D. marybeth.mulcahy@csb.gov www.csb.gov

July 19, 2016

Advisory Committee Meeting

Ocean Energy Safety Institute (OESI)

Chemical Safety Board (CSB) • Independent Federal Agency

• Non-regulatory

Mission

To prevent chemical accidents

• Conducting root cause investigations

• Reporting findings publicly

• Making recommendations to organizations and agencies that can affect change • Companies

• Government Agencies (local, state and federal)

• Standard setting, i.e. American Petroleum Institute (API)

New Operational and Organizational Learnings

Macondo Investigations Timeline

Root Cause Investigation

Technical

(equipment & engineered controls)

Organizational

(policies & procedures)

Operational

(human action)

Management System Failures

Work as Imagined

Vs

Work as Done

Natural Gap: Work as Imagined vs Work as Done

Design Risk

Operational Risk

[the negative test procedure] “broad, operational guidelines” [and the crew would use] “the method consistent with their regular practice on prior wells.”

“BP was responsible

Macondo Gap

developing detailed plans as to where and how the Macondo well was to be drilled…and for obtaining approval of those plans from MMS.”

Missing Tools to Minimize the gap

• Transocean drilling team and BP well site leaders expected to deal with any problems by employing their knowledge, experience and skills. • Missing: tools that could have minimized the gap between WAI and WAD.

• Transocean did not follow its corporate policies to meaningfully engage the workforce

• (1) Transocean policies required written safety critical procedures for negative pressure test. • “The rig crew does not have to be told how to run a negative test. This

should be a routine operation that fits within their training.”—MDL Expert

• (2) Generic Deepwater Horizon safety critical procedures identified hazards focused on personal safety or relatively minor spills of drilling mud on the rig and overboard. • “But we do warn that every time we do a job, the conditions are changed.

The weather conditions may be different. The experience of the crew may be different. You have to take into account that every time you do it, it may not be exactly the same as the last time.” Transocean VP QHSE

Human Factors

•Modifying behavior

• Finding fault in order to blame

•Weeding out the bad apples

Human factors is NOT about

•Understanding expectations

•Determining if those expectations are reasonable

• Putting in place systems and processes that ensure those expectations can be achieved

− Design

− Planning

− Execution

Human factors IS

Pre-Macondo: Well Kick Expectations

• Crew will be able to detect gas influx into the riser soon after it occurs

• Crew will be able to determine that gas in the riser is of sufficient magnitude that it should be routed overboard

• Crew will be able to complete correct sequence of buttons on control board to send flow overboard

• System will have capacity to divert well fluids overboard

The Reality

• Company practice to pre-set route to MGS

− Well Control Manual neutral on preferred pre-set route and did not identify route-decision criteria

− Environmental penalties for discharges into water

− Mud is expensive and onsite supplies may be limited

The Reality (cont.)

• Heavy reliance on crew to make real-time decisions if/when to route overboard

• Crew did not detect influx until mud released out onto the deck

• Design required multi-step process to manually route overboard

Design of the Control System

Design of the Control System

The Reality (cont.)

• Not enough time

− Rate of gas migration depends on many factors – cannot be reliably predicted or readily detected until gas nears the surface

− Contents of the 5,000-ft (1,524-m) riser erupted on rig floor only 2-3 minutes after the BOP initially sealed the well

The Reality (cont.)

• High potential that gas volume might have overwhelmed the system anyway

• Gas-in-riser scenario not well understood

− Generally not possible to predict surface flow rates of gas-in-riser events

− Speed at which gas can propagate up riser varies

− Even with best reaction time response, system could be overwhelmed

Post Macondo Policy Change

An engineering control replaces manual intervention

Lessons from Diverter Analysis

• Expectations of crew may be unreasonable

• Potential technical gap, not human “failure”

• Environmental/regulatory penalties may cause drift back to original practice of MGS-routing

• Improved kick detection capabilities and further study on riser unloading events

Seemingly Insignificant

Decisions

Seemingly Insignificant Decisions

Unusual spacer

No risk assessment

Generic procedure

Equipment assumptions

Rationalization

Unusual spacer

The use of this material as a spacer was not a replacement-in-kind but there was no risk

assessment

Equipment assumption

Generic procedure (no safety critical limits)

Rationalization Riser level was not full. The level could have dropped before BOP was closed or after. After = leak past annular Before = well integrity lost Crew assumed it was after the BOP was closed. This option made more sense to them.

Post-Incident Well Data Analysis • Real-time Deepwater Horizon data indicates the drillpipe

pressure began to drop just after the crew closed an annular preventer, implying a loss of well integrity NOT leaking annular.

Why did that assumption seem more plausible?

• Challenges of well up to this point successfully overcome, reinforcing mentality that success was inevitable - Multiple loss-of-well control events - Changes to drilling plans to accommodate challenges

• Various personnel deemed the cement job successful • Positive pressure test was successful (e.g., no leaks from inside

the well to the outside) • It is “not uncommon” to see an annular leak.

Beyond today’s presentation…

Volume 3 further addresses

• HUMAN FACTORS • ORGANIZATIONAL FACTORS • SAFETY PERFORMANCE INDICATORS

• (1) Metrics of barriers and safety systems and • (2) Active monitoring of real-time barrier indicators meant to

drive daily decisions, as well as slow moving management system indicators.

• RISK MANAGEMENT PRACTICES • The complexity of the operator-contractor relationship can

lead to vaguely defined safety roles for both parties. • CORPORATE GOVERNANCE

Volume 3 further addresses • SAFETY CULTURE

• Poor adherence to their own corporate major hazard management policies, which were stronger than regulatory requirements;

• Inadequate individual performance contracts and bonus structures with limited inclusion of process safety goals

• Inadequate development and usage of relevant process safety performance indicators

• Failed efforts aimed toward bridging major risks

Volume 4 further addresses

• US OFFSHORE SAFETY REGULATION DURING AND AFTER MACONDO

• ATTRIBUTES OF AN EFFECTIVE REGULATOR AND REGULATORY SYSTEM

Questions?