Table of Contents

TABLE OF CONTENTS
A LITERATURE REVIEW ON THE CAUSES OF DEEPWATER HORIZON

I. SECTION I : INTRODUCTION – Page 2.

1. Background and Study Statement
2. Problem Analysis
3. Research Scope
4. Study Methodology
5. Subjects and Scope of Study
6. Contribution of Research

II. SECTION II : LITERATURE REVIEW – Page 4.

1. Piper Alpha (1988)
2. Alexander L. Kielland Drilling Rig Accident (1980)
3. Bohai 2 Oil Rig Disaster (1983)
4. Mumbai High North Disaster (2005)
5. The Gulf War Oil Spill (1991)
6. The Sanchi Oil Tanker Collision (2018)

III. SECTION III : OVERVIEW OF DEEPWATER HORIZON ACCIDENT – Page 6

IV. SECTION IV : DEEPWATER HORIZON ACCIDENT ANALYSIS – Page 8.

1. Analysis A : Critical Factor: Well integrity was not established or failed – Page 9.
2. Analysis B : Critical Factor: Hyrocarbons entered the well undetected and well
control was lost – Page 15.
3. Analysis C : Critical Factor: Hydrocarbons ignited on Deepwater Horizon – Page 21.
4. Analysis D : Critical Factor: The blowout preventer did not seal the well – Page 27.

V. SECTION V : VALUE OF THE PRACTICAL EXPERIENCE – Page 30.

1. Lesson Learnt and Experience Gained – Page 30.
2. Problems or Challenges and Solutions to overcome – Page 31

VI. SECTION VI : REFERENCES – Page 32.

VII. SECTION VII : WEEKLY REPORT SCHEDULE – Page 33.

Page 1 of 33
Introduction

INTRODUCTION
1. Background and study statement :
In today’s modern society, marine industry is one of the most crucial transportation sector in
portaging commodity. Million gallons of crude oil, gas, LPG are transported daily on the ocean,
and also millions of barrels are produced everyday all over the world. In the process of
transporting or producing, people cannot avoid technical incidents, collision or even massive
accidents, and consequently, the leakage of oil and gas has always been a huge problem that
directly affects not only the evironment, marine ecosystem and animal but also the life of
coastal areas, and may even consume billions of dollars to solve the damages.

Developed countries, multinational companies as well as insurance companies have put

endlessly effort, money and time to overcome the domination of oil spill, pay the compensation
and heal the ecosystem. However, the natural ecosystem takes a long period of time to heal
itself, or perhaps it will never return to the original condition. With all these risks mentioned,
safety issues and environmental protection are always the top priorities in developed countries.
On the contrary, developing countries do not have a proper consideration on these
environmental problems.

2. Problem analysis :

Viet Nam has more than 3.200 kilometers of coast and 2.700 islands, in the few decades, the
coastal areas of Viet Nam have incredibly increased and contributed significantly to the national
economy. This is a positive sign of the country’s development, but it also creates more pressure
putting on the coastal ecosystem. Over-exploitaion, waste emission and also illegal hunting
have been destroying the natural environment in those areas. Therefore, in order to protect the
ecosystem, it is compulsory to acknowledge the importance of oil spill, which is a consequence
of national development.

3. Research scope :

In this project, I essentially concentrate on studying the detailed cause of Deepwater Horizon in
Mississippi Canyon Block 252 in the Central of Gulf of Mexico.

4. Study methodology :

 Study and analyze the needed information via textbooks, scientific researches, etc.
 Collect and review documents that include: papers, thesis, reports, newsletters, etc.
 Normalize data and using Data Collection Methods to select the most meaningful
content.

Page 2 of 33
Introduction

 Study on the dynamics of a situation, frequency counts of target behaviors, compare to

other behaviors as indicated by needs of the evaluation.

5. Subjects and Scope of Study :

The subject of study is the original causes of Transocean’s Deepwater Horizon took place on the
evening of April 20, 2010.

The scope of study focuses on the events leading up to the explosions and fire on April 20,2010,
and on attempts to activate the subsea BOP from April 21 – May 5, 2010, using subsea remotely
operated vehicles (ROVs)

6. Contribution :

The project is to analyze the root of Deepwater Horizon accident, therefore, acknowledge the
risks of explosions on rigs and prevent the same accident. By reading this report, readers can
have a general view on one of the most tragic disasters in the oil and gas industry

Page 3 of 33
Literature Review

LITERATURE REVIEW
Piper Alpha (1988) – On July 6,1988 , a worker was performing a routine maintenance
on Pump A – Piper Alpha’s one of two condensate pumps that was used to remove condensate
down the pipeline to the coast. He removed the Pressure Safety Valve (used to regulate
pressure in case of an overpressure) from Pump A and sealed off the open pipe with a blind
flange. Since the maintenance could not be completed before the 6 p.m shift change, the
worker left the seal in place and made a form stating that Pump A was not ready and could not
be activated. At 9.45 p.m that day, Pump B stopped and could not be restarted, the whole
production on the Piper Oilfield would be halted unless they used Pump A. Unfortunately,
engineers were not able to find the papers relating to the missing valve since the worker who
removed it placed it in a box near the valve. The engineers on the rig believed that Pump A was
useable and activated it at 9.55 p.m. Consequently, the high-pressure gas leaking through the
flange triggered six alarms before igniting and exploding moments later.

Alexander L. Kielland Drilling Rig Accident (1980) - Alexander L. Kielland was

a Norwegian semi-submersible drilling rig that capsized while working in the Ekofisk oilfield in
March 1980, killing 123 people. Later on, an investigation proved that the rig collapsed because
of a fatigue crack in one of its six bracings (bracing D-6), which was the connection between the
D-leg with the whole rig. Specifically, it was a failure in a small 6mm fillet weld which connected
a non-load-bearing flange plate to the D-6 bracing. Furthermore, the investigators found out
that there was a considerable amount of lamellar tearing in the flange plate and cold cracks in
the butt weld, which is a contributed factor increasing stress concentrations due to the
weakened flange plate.

Bohai 2 Oil Rig Disaster (1983) - Bohai Number 2 Oil rig was built in 1969 by Mitsubishi
and sold to China in 1973. It was one of the oldest rig owned by China. It sank on November
25,1979 in Gulf of Bohai which is between China and Korea. The accident killed 72 people
aboard. The accident was caused by strong wind while the rig was towed. A huge wave washed
over the main deck breaking a ventilator pump causing a big puncture hole on the deck.
Extensive flooding caused the rug to sink. The crew lacked proper training on emergency
evacuation procedures and the use of lifesaving equipment.
Mumbai High North Disaster (2005) – Mumbai High North, which was located in the
Arabian Sea 160km West of the Mumbai coast, was operated by the state-owned Oil & Natural
Gas Corporation (ONGC). The field included four platforms which were linked by brigdes :
 NA – Small wellhead platform;
 MHF – Residental platform;
 MHN – Processing platform;
 MHW – Recent additional processing platform.
At time of accident on July 27, 2005, the MSV Samudra Suraksha was trying to approach
the MHN on the windward side to transfer an injured person. Unfortunately, after sucessfully
transfering that person, strong swells pushed the MSV towards the MHN platform, causing the
helideck at the back of the vessel to collide and sever more than one gas export risers on the

Page 4 of 33
Literature Review

MHN platform. Within a short time, the resultant gas leaked ignited and exploded. Due to the
close proximity of other risers as well as lack of fire protection, the attempts to stop the fire did
not work, making the subsequent fire engulfted the platforms MHN and MHF, which followed
by the complete destruction of MHN platform. The fire also spread to MSV Samudra Suraksha
and NA platform, causing severe damage to both platform and vessel. The fire resulted in the
loss of 22 persons.

The Gulf War Oil Spill (1991) - Starting in January of 1991, large quantities of oil began
to spill into the Persian Gulf. Early reports from Iraqi forces claimed that the spill had been
caused by the United States sinking of two oil tankers. It was later revealed that in a desperate
military move, Iraqi forces had opened oil valves of the Sea Island pipeline, releasing oil from
numerous tankers. The goal of this spill was to impede US troops from attempting beach
landings, but in the end the spill simply resulted in over 240 million gallons of crude oil being
dumped into the Persian Gulf. This spill is one of the first times in military history where a
natural resource and specifically pollution was used as a tactic of war. Though it is hard to know
the full scale of the spill for certain, many scientists believe it to be one of the worst in human
history. The effect on marine life and on the shores was extensive and the region is still feeling
the effects of the spill, manifested in a loss of biodiversity and uninhabitable coastlines.

The Sanchi Oil Tanker Collision (2018) – Sanchi, which was a double-hulled Suezmax
crude oil tanker, was on its way carrying 136,000 metric tons of natural-gas condensate from
Iran to South Korea. On the evening of January 6, 2018, the oil tanker collided with a bulk
carrier on a voyage from Washington to Guandong province, China. The Sanchi Oil Tanker
caught fire shortly after the collision, and after burning and drifting for more than one week, it
sank on 14 January, 2018. None of 32 crew members of Sanchi survived, and at least 2,200
tonnes of oil was estimated to be leaked. Consequently, the incident caused a slick 13km x
11km on the seasurface, which was being pushed toward Japan by strong wind.

Page 5 of 33
Overview of Deepwater Horizon Analyses

OVERVIEW OF
DEEPWATER HORIZON ANALYSES

This section includes an overview of the detailed analyses conducted by BP’s investigation
team. There was a complex and interlinked serire of mechanical failures, engineering design,
human judgements, operational implementation and team interactions came together that
lead to the initiation and escalation of Deepwater Horizon accident.

The investigation persued four primary lines of inquiry, based on the initial review of the
accident events. For the accident and its consequences to have occurred, the following critical
factors had to have been in place :

 Well integrity was not established or failed.

 Hydrocarbons entered the well undetected and well control was unable to work.
 Hydrocarbons ignited and exploded on Deepwater Horizon.
 The blowout preventer (BOP) did not seal the well.

The investigation of this complex accident became four linked investigations into the facts and
causes underlying these critical factors. The investigation team, however, after using fault tree
analysis, multiple scenarios, failure modes and possible contributing factors were took into
consideration. Eight key findings are listed :

1. The annulus cement barrier did not isolate the hydrocarbons.

2. The shoe track barriers did not isolate the hydrocarbons.
3. The negative-pressure test was accepted although well integrity had not been
established.
4. Influx was not recognized until hydrocarbons were in the riser.
5. Well control response actions faile to regain control of the well.
6. Diversion to the mud gas separator resulted in gas venting onto the rig.
7. The fire and gas system did not prevent hydrocarbon ignition.
8. The BOP emergency mode did not seal the well.

In the following figure, the eight blocks describe the defensive physical or operational barriers
that were in place to eliminate or mitigate hazards. The holes represent failures or
vulnerabilities in the defensive barriers. The eight key findings are represented by the holes
that lined up to enable the accident to occur.

Page 6 of 33
Overview of Deepwater Horizon Analyses

If any of the mentioned factors had been removed, the consequences of Deepwater Horizon
events could have been either prevented or at least reduced in severity. In the following
section, I will sum up the investigation team’s analysis and conclusions regarding each key
finding or barrier breach.

Page 7 of 33
Deepwater Horizon Accident Analyses

DEEPWATER HORIZON ACCIDENT ANALYSES

The investigation team examined potential causal or contributory factors for each critical
factor. The analyses contain key findings and conclusions that are associated with the critical
factors. The four critical factors and their associated key findings are listed below :

Analysis A. Critical Factor: Well integrity was not established or failed

Key Finding 1. The annulus cement barrier did not isolate the hydrocarbons.
Key Finding 2. The shoe track barriers did not isolate the hydrocarbons.

Analysis B. Critical Factor: Hyrocarbons entered the well undetected and well control was lost.

Key Finding 3. The negative-pressure test was accepted although well integrity had not
been established.
Key Finding 4. Influx was not recognized until hydrocarbons were in the riser.
Key Finding 5. Well control response actions faile to regain control of the well.

Analysis C. Critical Factor: Hydrocarbons ignited on Deepwater Horizon

Key Finding 6. Diversion to the mud gas separator resulted in gas venting onto the rig.
Key Finding 7. The fire and gas system did not prevent hydrocarbon ignition.

Analysis D. Critical Factor: The blowout preventer did not seal the well

Key Finding 8. The BOP emergency mode did not seal the well.

Page 8 of 33
Deepwater Horizon Accident Analyses
Analysis A

Analysis A. Well Integrity Was Not

Established or Failed.
The loss of well integrity was caused by a failure of the annulus cement barrier that allowed
hydrocarbons to flow into the wellbore annulus. Failure of one or more of the mechanical
barriers (i.e, the shoe track, the casing hanger seal assembly or the production casing and
components) allowed hyrocarbons to flow to the surface.

1. Annulus Cement Barrier

The annulus cement barrier failed to prevent hydrocarbons from migrating into the wellbore.
The investigation team’s analysis identified a probable technical explanation for the failure.
Interactions between BP and Halliburton and shortcomings in the planning, design, execution
and confirmation of the cement job reduced the prospects for a successful cement job.

A 9 7/8 in. liner was set in place at 17,618 ft. prior to drilling the production section of the well
to a total depth of 18,360 ft. This last hole section was difficult to drill due to a reduction on
fracture gradient at the bottom of the wellbore. This condition required selecting the correct
mud weight to maintain overbalance on the formation while avoiding fluid losses to the well.

Considering the narrow margin between pore pressure and fracture gradient, a number of
different options were evaluated prior to selecting the design for the production casing string,
cement formulation and placement plan.

The investigation team reviewed the decision to install that 9 7/8 in. x 7 in. long string
production casing rather than a 7 in. production liner, which would have been tied back to the
wellhead later, and concluded that both options provided a sound basis of design.

BP’s investigation team also found no indication that hydrocarbons enter the wellbore prior to
or during the cement job. In order to specifically determine how the hydrocarbons got into the
well after the cement job, the investigation team assessed the cement slurry design, cement
placement and conformation of the placement.

a. Cement Slurry Design

Because of the narrow margin between fracture gradient and pore pressure, the efficiency of
cement placement was critical. Several design iterations were conducted by Halliburton using
the OptiCemTM wellbore simulation application to establish an acceptable slurry design and
placement plan. A complex design for the cement job with base oil spacer, cementing spacer,
cap cement, foam cement and tail cement, was recommended and implemented.

Page 9 of 33
Deepwater Horizon Accident Analyses
Analysis A

The evidence reviewed by the investigation team suggests that the cement slurry was not fully
tested prior to the execution of the cement job. The team was unable to confirm that a
comprehensive testing program was conducted. The test results reviewed by the investigation
team indicated that only limited cement testing such as thickening time, foam density,
mixability and ultrasonic compressive strength, was performed on the slurry used in the
Macondo well. The tests reviewed did not include fluid loss, free water, foam/spacer/mud
compatibility, static gel strength transition time, zero gel time or settlement.

The investigation team, eventually, requested a third party cementing lab – CSI Technologies –
to design the cement slurry as closely as possible to the actual slurry used for the Macondo well
(since the investigation team did not have accessibility to gain the information about the
cement slurry that Halliburton used for Macondo well).

The results of these tests pointed out that it was not possible to generate a stable nitrified foam
cement slurry with greater than 50% nitrogen (by volume) at the 1,000 psi injection pressure.
As for the Macondo well, a mixture of 55% to 60% nitrogen (by volume) was required at 1,000
psi injection pressure to achieve the design mixture at 18% to 19% nitrogen (by volume) foam
cement at downhole pressure and downhole temperature conditons.

CSI Technologies’ test results indicated that the foam cement slurry used for the Macondo well
was likely unstable, resulting in nitrogen breakout. The investigation team identified cement
slurry design elements that could have been a contributing factor to a failure of the cement
barrier, including the following:

 The cement slurry yield point was extremely lw for use in foam cementing, which could
have increased the potential for foam instability and nitrogen breakout.
 A small slury volume, coupled with long displacement and the use of base oil spacer,
could have increase the potential for foam instability and nitrogen breakout.
 A defoamer additive was used, which could have destablilized the foam cement slurry.
 Fluid loss control additives were not used for cementing across the hydrocarbon zone,
which could have allowed formation fluids to permeate the cement.

Conclusion

Based on CSI Technologies’ lab results and analysis, the investigation team concluded that the
nitrified foam cement slurry used in the Macondo well probably would have experienced
nitrogen breakout, nitrogen migration and incorrect cement density, which would explain the
failure to achieve zonal isolation of hydrocarbons. Nitrogen breakout and migration would have
also contaminated the shoe cement and may have caused the shoe track cement barrier to fail.

Page 10 of 33
Deepwater Horizon Accident Analyses
Analysis A

b. Cement placement

Effective cement placement is necessary for the isolation of permeable hydrocarbon zones. The
macondo well cement placement was to place the top of cement (TOC) 500 ft. above the
shallowest identified hydrocarbon zone in compliance with Minerals Management Service
(MMS) regulations.

The 500 ft. TOC design was chosen to:

 Minimize annulus hydrostatic pressure during cement placement in order to avoid lost
returns.
 Avoid cementing into the next casing string and creating a sealed annulus. A sealed
annulus would have increased the risk of casing collapse or burst due to annular
pressure build-up during production.
When the placement model was run using 21 centralizers, the results indicated that the
possibility of channeling above the main hydrocarbon zones would be reduced. The 7 in. casing
string that had been purchased for the job was supplied with six inline centralizers. An
additional 15 slip-on centralizers were sourced from BP inventory and sent to Deepwater
Horizon. The BP Maccondo well team erroneously believed that they had received the wrong
centralizers. They decide not to use the 15 centralizers due to a concern that these slip-on
centralizers could fail during the casing run and cause the casing to lodge across the BOP. To
mitigate the risk of channeling associated with using fewer centralizers, the six inline
centralizers were positioned across and above the primary hydrocarbon zones.

Conclusion
Even though the decision not to use 21 centralizers increased the possibility of channeling
above the main hydrocarbon zones, the decision likely did not contribute to the cement’s
failure to isolate the main hydrocarbon zones or to the failure of the shoe track cement.

c. Planning for Temporary Abandonment

The cement job was pumped with expected volumes and mud returns. The BP Macondo well
team used final lift pressure and returns to declare a successful cement placement. After
discussion with Macondo well contractors and consistent with a decision tree developed by the
team, the team decided that no further evaluation was needed at that time.

2. Mechanical Barriers

After the annulus cement did not effectively isolate the reservoir, a mechanical barrier failure
enabled hydrocarbon to get into the wellbore. The investigation team considered that one or
more of the mechanical barriers must have failed alloing hydrocarbons to flow to the surface.

Page 11 of 33
Deepwater Horizon Accident Analyses
Analysis A

One possible flow path was through the shoe track. The barriers within the shoe track included
the shoe track cement and double-valve float collar

The second possible path was through the annulus are. In the annulus the mechanical barriers
were :

 The casing hanger seal assembly at the wellhead.

 The production casing and components.

Available evidence and analysis conducted by the

investigation team leads it to conclude that initial flow into
the well came through the shoe track barriers.

The Shoe Track

The shoe track comprised three components: the double-

valve flat collar, the reamer shoe and the cement inside the
casing. The shoe track functions as an aid to cementing
during the placement operation and then as a barrier to
prevent hydrocarbons from entering through the bottom f
the casing. If hydrocarbons passed through the shoe track,
two failures in the shoe track must have occurred: one
involving the cement inside the shoe track and the other
involving the double-valve float collar.

Cement in the Shoe Track

The tail cement (shoe track cement) was used to fill an

approximately 190 ft. section of the casing (around 7 bbls)
from the top wiper plug through the reamer shoe, thus
preventing hydrocarbons from reaching the float collar.
Figure 1. The shoe track

Analysis – Cement in the Shoe Track

Based on available evidence, hydrostatic pressure calculations, OLGA well flow modeling and
analysis of data from the Macondo well static kill on August 4, 2010, hydrocarbons entered the
casing through the shoe track. Therefore, the shoe track cement and the float collar must have
failed to prevent this ingress. The investigation team has not established whether this failure
was attributable to the design of the cement, contamination of the cement by mud in the
wellbore, commingling of cement with nitrogen due to nitrogen breakout from the foam

Page 12 of 33
Deepwater Horizon Accident Analyses
Analysis A

cement slurry, swapping of the shoe track cement with the mud in the rathole (bottom of the
well), or some combination of these factors.

Double-Valve Float Collar in the Shoe Track

The float collar, a check valve device installed in the shoe track ti prevent backflow or ingress of
fluids into the casing. As for hydrocarbons to flow into the casing from the bottom of the
wellbore, the hydrocarbons must have passed through this barrier.

The first issue concerned conversion of the float collar. After the casing was installed, float
collar conversion was attempted. The flat collar was run with two check valves that were held
open by the auto-fill tube. The auto-fill tube allows mud to flow into the casing, minimizing the
surge forces placed on the formation to prevent lost circulation. To convert the float collar, a
ball seals in the auto-fill tube during circulation, restricting flow by diverting mud through two
small ports in the auto-fill tube. Circulation through these ports creates a differential pressure
in the float collar, forcing the auto-fill tube out of the float collar, and allowing the check valves
to close.

Based on given information, the float collar conversion should have occurred with a differential
pressure between 400 psi to 700 psi. However, after making nine attempts to establish
circulation by increasing pressure on the casing, circulation was finally established with 3,142
psi.

The second issue concerned another event that may have affected the float collar. This
occurred when the bottom wiper plug landed on the float collar. This wiper plug separated the
cement from the fluids ahead of the wiper plug to prevent cement contamination. When the
wiper plug landed on the float collar, pressure was applied to rupture a burst disk in the wiper
plug, which allowe circulation to continue. This burst disk was designed to rupture between 900
psi and 1,100 psi. the burst disk did not rupture until 2,900 psi was applied, and cement
displacement continued.

Page 13 of 33
Deepwater Horizon Accident Analyses
Analysis A

Figure 2. Float Collar Conversion

Three possible failure modes for the float collar were identified:

 Damage caused by the high load conditions required to establish circulation

 Failure of the float collar to conver due to insufficient flow rate.
 Failure of the check valves to seal.

However, at the time the report was written, the investigation team had not determined which
of these failure modes occurred.

Page 14 of 33
Deepwater Horizon Accident Analysis
Analysis B

Analysis B. Hydrocarbons Entered the Well

Undetected and Well Control Was Lost.
This section provides an overview of how the previous findings relate to the subsequent
operations on Deepwater Horizon as the integrity of the well wes tested and how the inflox got
into and moved undetected up the wellbore to the riser, resulting in the catastrophic
explosions.

To test the integrity of the well, the rig crew ran a positive-pressure test on the casing, later on,
they started to conduct a negative-pressure test in order to confirm that the cement barrier
and mechanical barriers were capable of withstanding an inderbalanced condition. Abnormal
pressures observed during the negative-pressure test were indicative f a failed or inconclusive
test; however, the test was deemed successful.

Subsequent displacement f the well to seawater put the well in an underbalanced condition,
allowing the well to flow. This flowing condition went unchecked until an estimated 8 minutes
before the first explosion, after flow had become severe.

1. Operational Activities – Pressure Integrity Testing.

Testing the Pressure Integrity of the Well

A positive-pressure test indicates that the casing and wellhead seal assembly are capable of
containing pressure inside the well. On the other hand, a negative-pressure test assesses the
integrity of the casing shoe track, the casing and the wellhead assembly to hold back formation
pressure. Removing the mu and replacing it with seawater simulates the temporarily
abandoned condition wen the BOP and riser are removed.

Significance of the Negative-pressure Test

During drilling process, one of the purposes of the mud is to create sufficient hydrostatic
pressure to prevent flow from the reservoir. At the end of the drilling process, cement is placed
between the casing and the reservoir to act as a barrier.

The Macondo well was designed to be temporarily abandoned and completed later as a
production well. To temporarily abandon this well, mud had to be removed to a depth of 8,367
ft. and replaced with seawater, and a temporary abandonment cement plug had to be set in
the 9 7/8 in. casing. These procedures were in accordance with common industry practice and
were necessary before the rig moved off the well. The negative-pressure test simulated the
hydrostatic condition of having seawater instead of mud in the riser, causing an underbalance
in the well.

Page 15 of 33
Deepwater Horizon Accident Analysis
Analysis B

The investigation team concluded that the negative-pressure test results indicated that well
integrity had not been established. This situation as not recognized at the time of the test,
therefore, remedial steps were not taken.

During the negative-pressure test, the well was placed in an underbalanced state when
hydrostatic pressure in the wellbore was reduced below reservoir pressure.

In order to make preparation for the negative-pressure test, mud in the boost line, choke line,
kill line, drill pipe and in the upper part of the production casing was displaced to seawaer. To
provide separation between the mud and the seawater in the casing, a spacer was pumped
down the drill pipe ahead of the seawater.

With the heavier fluids in position, the annular preventer was shut to isolate thte hydrostatic
head of the fluids in the riser from the well. At this time, the annular preventer di not seal
around the drill pipe, resulting in heavy spacer leaking down past the annular preventer. After
adjustment of the regulator hydraulic pressure for the annular preventer, an effective seal was
established. The residual pressure of 1,260 psi in the drill pipe was bled off from the well. The
investigation team’s analysis indicates that approximately 3.5 bbls should have been expected.
This excess flow from the drill pipe, with the well in an underbalanced condition, should have
indicated to the rig crew a communication flow path with the reservoir through failed barriers.
The Application for Permit to Modify (APM) to MMS for the Macondo well temporary
abandonment stipulated that the negative-pressure test should be conducted by monitoring
the kill line. The well site leader noticed the discrepancy and after a discussion with the rig
crew, preparations for continuing the negative-pressure test were made by bleeding the kill
line. According to witness accounts,
between 3 bbls and 15 bbls of seawater flowed from the kill line, which was then shut in.

From 18:00 hours to 18:35 hours, the drill pipe pressure increased from approximately 50 psi to
1,400 psi. To resume the negative-pressure test, the kill line was filled and then opened, 0.2
bbls flowed, and no further flow was observed from the kill line during a 30-minute period of
monitoring. The drill pipe pressure was constant at 1,400 psi.

Page 16 of 33
Deepwater Horizon Accident Analysis
Analysis B

Figure 3. Possible Movement of Spacer into the Kill Line

This pressure of 1,400 psi on the drill pipe was misinterpreted by the rig crew and the well site
leaders. According to witness accounts, the toolpusher proposed that the pressure on the drill
pipe was caused by a phenomenon referred to as ‘annular compression’ or ‘bladder effect.’
The toolpusher and driller stated that they had previously observed this phenomenon. After
discussing this concept, the rig crew and the well site leaders accepted the explanation. The
investigation team could find no evidence that this pressure effect exists.

The investigation team has identified two possible reasons that flow did not exit the kill line:

 The kill line may have been plugged with solids from the spacer.
 The system may not have been lined up correctly; a valve may have been inadvertently
left closed.

Conclusion
The investigation team concludes that the lack of flow from what was believed to be an open
kill line, coupled with the erroneous explanation for the 1,400 psi on the drill pipe, led the well
site leaders and the rig crew to the incorrect view that the negative-pressure test was
successful and that well integrity was established.

Page 17 of 33
Deepwater Horizon Accident Analysis
Analysis B

2. Operational Activities – Monitoring the Well

After the negative-pressure test was concluded and the annular preventer was opened, the
hydrostatic head in the annulus returned the well to an overbalanced state, and the influx of
hydrocarbons did not occur again until the well was underbalanced with seawater at
approximately 20:52 hours. The rate of influx would have gradually increased as the well
became more underbalanced with heavier fluids being displaced by lighter seawater and
hydrocarbons. Flow increase from the well was discernable in the real-time data after
approximately 20:58 hours.

The investigation team's analysis of fluid volumes shows an approximate gain of 39 bbls by
21:08 hours. No well control actions were taken at that time, indicating that this fluid gain was
not detected.
Simultaneous end-of-well activities were occurring and may have distracted the rig crew and
mudloggers from monitoring the well. These activities included preparing for the next
operation (setting a cement plug in the casing), bleeding off the riser tensioners and
transferring mud to the supply vessel M/V Damon Bankston.

The investigation team did not find evidence that either the Transocean rig crew or the Sperry-
Sun mudloggers monitored the pits from 13:28 hours (when the offloading to the supply vessel
began) to 21:10 hours (when returns were routed overboard).

At 21:08 hours, the spacer reached the top of the riser, and the rig crew shut down pumping
operations to complete a sheen test prior to discharging the spacer to the sea. During the
sheen test, the rig crew configured the flow path to route the spacer overboard. This flow path
bypassed the mudlogger’s flow meter and the mud pits; therefore, fluid flow could no longer be
monitored at the mudlogger’s console. However, drill pipe pressure should have been
observable at the mudlogger’s console, and flow and drill pipe pressure should have been
observable at the driller’s console.

During the sheen test between 21:08 hours and 21:14 hours, the mud pumps were shut down,
and real-time data showed flow continuing and drill pipe pressure increasing by 246 psi. The rig
crew apparently did not recognize these indications of flow, and displacement was
recommenced.

Analysis of OLGA® well flow modeling suggests that by 21:30 hours there would have been
approximately 300 bbls of hydrocarbon influx in the well.

At 21:31 hours, the mud pumps were shut down. Witness accounts indicated that a
conversation between the toolpusher and the driller took place on the rig floor regarding
‘differential pressure.’ Between 21:31 hours and 21:34 hours, the pressure on the drill pipe
increased by approximately 560 psi.

Page 18 of 33
Deepwater Horizon Accident Analysis
Analysis B

Analysis suggests that between 21:31

hours and 21:41 hours, with the pumps
shut down, the well was unloading at an
average rate of approximately 60 bpm to
70 bpm. Analysis also suggests that
hydrocarbons did not enter the riser until
approximately 21:38 hours. (Refer to
Figure 4.) The investigation team believes
that the first well control action taken by
the rig crew was at 21:41 hours.

Conclusions

Analysis indicates that the first indications

of flow from the well could be seen in the
real-time data after 20:58 hours. The rig
crew and mudloggers either did not
observe or did not recognize indications of
flow until after hydrocarbons entered the
riser at approximately 21:38 hours. The
first well control response likely occurred
at 21:41 hours.

The Transocean Well Control Handbook

stated that the well was to be monitored
at all times. However, the policy did not
specify how to monitor the well during in-
flow testing, cleanup or other end-of-well
activities.

Figure 4. Hydrocarbons entering the riser

3. Loss of Well Control and the Resulting Response

Transocean had policies and procedures that governed rig crew actions while monitoring the
well for flow and for responding to well control events. The policies and procedures specified
that the driller should monitor the well for flowing conditions and was responsible to shut in
the well at the first indication of flow.

The shut-in protocols specified how to respond to a relatively small influx into the well and how
to handle the possibility of gas in the riser. The instructions stated that the well was to be shut
in using an annular preventer first, and then a variable bore ram (VBR) was to be closed if there

Page 19 of 33
Deepwater Horizon Accident Analysis
Analysis B

were still indications of flow from the well. The protocols did not fully address how to respond
in an emergency situation (loss of well control).

The investigation team could not find instructions in the protocols document describing how to
handle continued flow (e.g., closing the BSRs and closing the internal blowout preventer to seal
the drill pipe). There was no mention in the protocols about whether or when the emergency
disconnect sequence should be activated in an emergency response (with the exception of a
station-keeping emergency).

a) Drill pipe pressure fluctuations

At approximately 21:40 hours, witness accounts indicated that mud flowed uncontrolled onto
the rig floor. Real-time data and further witness accounts suggest that the rig crew attemptedto
control the well by closing an annular preventer in the BOP at approximately 21:41 hours. This
first action was too late to prevent the release of hydrocarbons, which were already in the riser.
Modeling suggests that the annular preventer did not fully seal around the drill pipe, allowing
hydrocarbons to continue entering the riser.

The rig crew diverted hydrocarbons coming through the riser to the mud gas separator (MGS)
which was quickly overwhelmed and failed to control the hydrocarbons exiting the riser. The
alternative option of diversion overboard through the 14 in. starboard diverter line did not
appear to have been chosen; this action would probably have vented the majority of the gas
safely overboard.

b) Well control response 21:40 hours to 21:49 hours

Real-time data indicated that at 21:47 hours, drill pipe pressure rose from 1,200 psi to 5,730 psi
within one minute. This was likely caused by the closure of one or two variable bore rams
(VBRs), which sealed the annulus. At approximately 21:49 hours, rig power and real-time data
were lost. Witnesses recall an explosion on the rig, followed closely by a larger explosion.

After the explosions, fires continued on the rig. The subsea supervisor attempted to activate
the emergency disconnect sequence (EDS) some time after the explosion. This would have
sealed the well and disconnected the riser from the BOP stack. There were no indications that
the sequence activated.

Page 20 of 33
Deepwater Horizon Accident Analysis
Analysis C

Analysis C. Hydrocarbons Ignited

on Deepwater Horizon

When hydrocarbons reached the surface of Deepwater Horizon, the protective systems did not
prevent the gas from reaching an ignition source and igniting. As a result, at least two
explosions occurred at approximately 21:49 hours on April 20, 2010.

To conclude how the release of hydrocarbons and dispersion of gas occurred, how the
hydrocarbons came to ignite and how an explosion may have been prevented, the investigation
team reviewed the design philosophy of some of the protective systems for Deepwater
Horizon. This design review included surface well control equipment, electrical area
classification, the fire and gas (F&G) system, and heating, ventilation and air conditioning
(HVAC) systems.

1. Diversion to the mud gas separator resulted in gas venting onto

the rig

a) Mud Gas Separator

The main inlet and outlet connections to the MGS vessel were a:
 14 in. inlet line from the riser diverter.
 4 in. inlet line from the choke manifold.
 12 in. outlet vent line terminating at the top of the derrick.
 10 in. liquid outlet that could be lined up to either the gumbo box or the trip tanks.
 6 in. relief line flowing overboard to the starboard side.
 6 in. vacuum breaker terminating approximately one-third of the way up the derrick.

Page 21 of 33
Deepwater Horizon Accident Analysis
Analysis C

Figure 5. Simplified Drawing of the MGS

Because the 12 in. MGS outlet vent and the 6 in. vacuum breaker vent were
goosenecked, they would have diverted flow back down toward the rig. The MGS 10 in. liquid
outlet was designed with a liquid seal, but the seal would have been blown out by the pressure
spike during the well blowout. If the valve on the MGS 10 in. liquid outlet to the gumbo box was
open, gas would have flowed directly under the deck. This 10 in. valve was manually operated
and may not have been open at the time of the accident.

The set pressure of the bursting disk was believed to have been 15 psi. The MGS
vessel working pressure was 60 psi. The bursting disk (designed on the basis of 18 ppg mud)
was sized to protect the bottom of the vessel from over-pressure in the event that the vessel
overfilled with liquid. During the well blowout, the liquid leg of the MGS would have been
subjected to the greatest pressure, due to the additional hydrostatic head; therefore, it would
have been the most likely part of the vessel to fail during the well blowout.

A simplified model of surface equipment was used to determine the backpressure at the
diverter packer. At these pressures it was possible that some components of the MGS vessel
such as flange connections began to fail, but it was unlikely that the vessel itself ruptured.

Page 22 of 33
Deepwater Horizon Accident Analysis
Analysis C

Figure 6. OLGA® Well Flow Modeling Prediction of Backpressure

and Flow at the Diverter Packer.

Based on these modeled pressures, it appears that some of the surface equipment could have
begun to fail and release hydrocarbons. The two most vulnerable pieces of equipment were the
MGS vessel, which was rated for 60 psi; and, if selected in low-pressure mode, the riser slip
joint seal, which was rated for 100 psi.

b) Gas Dispension Modeling

For the gas dispersion modeling, the investigation team assumed that there was a potential
failure of low-pressure surface equipment. The design pressure rating of this equipment could
have been exceeded during the high simultaneous flow of gas and liquid.

The case presented in this analysis assumes that the 12 in. MGS vent and the 10 in. MGS liquid
outlet to the gumbo box, the riser slip joint seal, the MGS 6 in. bursting disk and the 6 in. MGS
vacuum breaker vent were all open flow paths.

Other scenarios, such as a closed MGS liquid outlet and no equipment failures (all fluid flowing
out of the 12 in. MGS vent) or a catastrophic failure of the MGS vessel were possible, but the
investigation team believes that these other scenarios would not substantially alter the net
effect of the initial gas release.

Page 23 of 33
Deepwater Horizon Accident Analysis
Analysis C

Figure 7. Schematic of Postulated Hydrocarbon Release Locations

Witnesses in both the bridge control room and the engine control room described several gas
alarms going off in rapid succession.

c) Outcomes of Different Shut-in Scenarios

The investigation team concluded that, if the BOP had closed and sealed around the drill pipe at
any time prior to 21:38 hours, and if the pressure integrity had been maintained through the
drill pipe to the mud pumps, the chance for hydrocarbons to enter the riser and flow to the
surface would have been reduced or eliminated.

Page 24 of 33
Deepwater Horizon Accident Analysis
Analysis C

Figure 8. Illustration of Wellbore and Position of Hydrocarbons

at 21:38 Hours if BOP Was Closed

2. The F&G System dia not prevent hydrocarbon ignition.

For operating environments where hazardous substances could be present, secondary levels of
protective systems are normally part of the design philosophy. On Deepwater Horizon, the
secondary levels of protective systems included a fire and gas system and the electrical
classification of certain areas of the rig.

The fire and gas system detects hydrocarbon gas and initiates warning alarms when acceptable
limits are exceeded. For some alarms, an automated function initiates when hydrocarbon gas is
detected beyond acceptable limits. This automated function primarily prevents gas ingress to

Page 25 of 33
Deepwater Horizon Accident Analysis
Analysis C

vulnerable locations through the heating, ventilation and air conditioning (HVAC) system. When
gas is detected, the fire and gas system closes the dampers and shuts off the ventilation fans.

Areas on the rig are electrically classified, based on the probability of the presence of
hydrocarbons. Equipment in electrically classified areas must meet design code criteria that
reduce the possibility of providing an ignition source.

Because of the low probability of hydrocarbons being present before a well produces, only a
small area of Deepwater Horizon was electrically classified. The two main electrically classified
areas were within the rig floor and under the deck, where the mud returning from the well
could convey some residual hydrocarbons. If a flammable mixture migrated beyond these
areas, the potential for ignition would be higher.

Deepwater Horizon engine room HVAC fans and dampers were not designed to trip
automatically upon gas detection; manual activation was required. This design was probably
selected so that false gas-detection trips would not interrupt the power supply to the thrusters,
which keep the dynamically-positioned rig on station. The HVAC system likely transferred a gas-
rich mixture into the engine rooms, causing at least one engine to overspeed, creating a
potential source for ignition.
The information used to complete the analysis is based on pre-2001 documentation; therefore,
some of the equipment details and system designs may have changed. However, in the view of
the investigation team, it is unlikely that any such differences would significantly affect the
conclusions drawn.

Conclusion
The fire and gas system did not prevent released hydrocarbons from reaching potential ignition
sources.

Page 26 of 33
Deepwater Horizon Accident Analysis
Analysis D

Analysis D. The Blowout Preventer

Did Not Seal The Well
One important reason contributed to the damage of Deepwater Horizon was the failure of the
blowout preventer (BOP) to isolate the wellbore prior to and after the explosions and the fire.
None of the emergency methods available for operating the BOP were successful in isolating
the wellbore. The different methods available were not fully independent; therefore, single
failures could affect more than one emergency method of BOP operation. Ultimately, the only
way to isolate the well at the BOP was to close a single component, the blind shear ram (BSR);
that ram had to shear the drill pipe and seal the wellbore.

1. Emergency Disconnect Sequence

To isolate the well after the explosion, the subsea supervisor attempted to operate the EDS
that would close the BSR, sealing the wellbore, and disconnect the lower marine riser package
(LMRP). The EDS required a communication signal to be sent through one of two multiplex
(MUX) cables routed through the moon pool, which would have been affected by the
explosions and fire. Witness accounts indicated that an attempt was made to activate the EDS
approximately 7 minutes after the initial explosion. The LMRP did not disconnect, and
hydrocarbons continued to flow, indicating that the BSR did not seal.

Conclusion
The explosions and fire very likely damaged the MUX cables, disabling the EDS means of closing
the BSR.

2. Automatic Mode Function

The automatic mode function (AMF) of the BOP activates the BSR to shear the drill pipe and
seal the wellbore in the event of catastrophic failure of the marine riser. Two independent
control pods on the BOP initiate the AMF sequence to close the BSR if specific conditions are
met (i.e., when electrical power, communications and hydraulic power are all lost to both
control pods). According to witness accounts, during the attempt to activate the EDS, there
was a low accumulator alarm on the BOP control panel, indicating loss of hydraulic supply
pressure. The AMF conditions were very likely met upon the damage to the MUX cables and
loss of hydraulic supply pressure after the explosion.

Page 27 of 33
Deepwater Horizon Accident Analysis
Analysis D

Figure 9. Simplified Schematic of the AMF Control System.

The AMF requires at least one operational control pod to initiate and complete the sequence.
Both the blue and yellow control pods from Deepwater Horizon BOP were retrieved after the
accident, and their AMF functionality was tested. Insufficient charge was discovered on the 27-
volt AMF battery bank in the blue pod, and a failed solenoid valve 103 was discovered in the
yellow pod. If these conditions existed at the time of the accident, neither pod would have
been capable of completing an AMF sequence.

Conclusion

The AMF initiation conditions were very likely met soon after the first explosion, but the AMF
sequence very likely could not have been completed by either control pod, due to the failed
solenoid valve 103 in the yellow pod and an insufficient charge on the 27-volt AMF battery bank
in the blue pod.

Page 28 of 33
Deepwater Horizon Accident Analysis
Analysis D

3. Intervention by Remotely Operated Vehicle

The autoshear function is designed to activate the BSR upon inadvertent disconnection of the
LMRP. Evidence indicated that the BSR closed 33 hours after the explosion, when a remotely
operated vehicle (ROV) activated the autoshear function. Though the BSR appeared to have
been closed, the investigation team has not been able to determine why it failed to seal the
well. Potential causes examined by the investigation team included:
 Seal failure due to the prevailing flow condition in the BOP.
 Insufficient hydraulic power to shear the drill pipe and seal the wellbore.
 Non-shearable pipe or debris across the BSR.

Page 29 of 33
Value of The Practical Experience

VALUE OF THE PRACTICAL EXPERIENCE

1. Lessons learned and experience gained

During my precious time interned at PVE – PetroVietnam Engineering from June 15th to August
15th, I have gained a lot of knowledge not only from my lecturer, but also from the professional
environment of this company.

A precious chance to officially practice the theoretical knowledge I learnt in class

Throughout my internship program, it was truly amazing to finally use the information I have
learnt during three years in university to apply to my work. Theory will only be useful until we
have an opportunity to test and apply it into our real work. Therefore, not only did I can realize
the use of my theoretical knowledge but also I gained precious knowledge that I have never
learnt at school.

The professionalism at PVE

Never before have I imagined how would it be when working in a professional and international
environment until I have this valuable chance to experience it myself. I learnt to be early is
better to be on time, during my internship period, I always try to arrive at the office early since I
can prepare my paper work as well as take care of my working place. I also realize that being as
specific as possible is necessary when I need any support, because everyone around is busy
with their own work. Thus, being specifically clear when asking for something can save your
time as well as leave a good impression with people. Another crucial lesson I learnt is that : do
not be shy when you do not know about any topic, it is reasonable to be lack of knowledge
since I am an undergraduate, however, it is unacceptable to hide that.

Management skill

This is considered as a must-have skill in every internaltional working environment, and during
my time at PVE, I learnt that being able to manage my time as well working quantity can greatly
contribute to my working results. By balancing between working and relaxing time reasonably, I
can not only have a chance to build relationships with other persons in the office, but I can also
finish my work with better results.

Page 30 of 33
Value of The Practical Experience

2. Problems or challenges and solutions to overcome

a. Shortage of books or papers about the researching topic

 Solution : Use previous thesises at school, ask lecturers and instructors for more
information, search for papers in other universities.

b. Shortage of time to work at company

 Solution : Try to separate time reasonably, prepare questions for following working day
to save more time.

c. Shortage of knowledge about the topic

 Solution : Ask lecturers and instructors, read more technical papers/books and attend
technical conferences to gain more information.

Page 31 of 33
References

REFERENCES
[1] NATIONAL ACADEMY OF ENGINEERING AND NATIONAL RESEARCH COUNCIL (November
2010), “Interim Report on Causes of the Deepwater Horizon Oil Rig
Blowout and Ways to Prevent Such Events”

[2] BP Investigation Team (September 2010), “Deewater Horizon Accident Investigation Report”

[3] DHSG – Deepwater Horizon Study Group (March 2011), “Final Report on the Investigation of
the Macondo Well Blowout”

[4] KITSUNAI, Yoshio & KOBAYASHI, Hideo ( March 27th, 1980), “Capsize of Offshore Oil Drilling
Platform”

[5] Jacqueline Michel, Zachary Nixon, Miles O. Hayes, Gail V. Irvine and Jeffrey W. Short
(February 28th, 2011), “The Distribution of Lingering Subsurface Oil from the Exxon Valdez Oil
Spill”

[6] National Aeronautics and Space Administration – NASA ( May 2013), “The Case for Safety –
The North Sea Piper Alpha Disaster”

[7] Milman, Oliver. “Deepwater Horizon disaster altered building blocks of ocean life” The
Guardian, June 28th, 2018; https://www.theguardian.com/environment/2018/jun/28/bp-
deepwater-horizon-oil-spill-report

[8] National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling (January
2011), “Deep Water – The Gulf Oil Disaster and the Future of Offshore Drilling”

Page 32 of 33
Weekly Report Schedule

WEEKLY REPORT SCHEDULE

During my eight-week internship at PVE, my instructor and I have agreed that I will report
on every Monday, and it was fortunate that the topic I was doing – A literature review on
the causes of Deepwater Horizon Accident – was divided into four different critical factors
including eight key findings. Thus, I have one week for reading and summarizing each key
finding, and the schedule was set as follow.

Week 1 : Summarize why the annulus cement barrier did not isolate the hydrocarbons.
Was there any other factor affected the hydrocarbon flow?

Week 2 : Summarize why the shoe track barriers did not isolate the hydrocarbons.

Week 3 : Summarize the role of the negative-pressure test and the reason it was accepted
although well integrity had not been established.

Week 4 : Summarize why influx was not recognized until hydrocarbons were in the riser
and give appropriate methods to determine unexpected hydrocarbon flow.

Week 5 : Summarize why well control response actions failed to regain control of the well.

Week 6 : Summarize why diversion to the mud gas separator resulted in gas venting onto
the rig and exploded. Then give assessment on the damage after explosion.

Week 7 : Describe the fire and gas system on the rig and summerie why they failed to
prevent hydrocarbon ignition.

Week 8 : Describe the procedure and working mechanism of BOP and why the BOP
emergency mode did not seal the well

As for the results of weekly reports, I have already combined and made it a complete
report.

Page 33 of 33