SPE163276

Lessons Learnt From Root Cause Analysis of Gulf of Mexico Oil Spill 2010
Tanu Garg, Swetha Gokavarapu (Pandit Deendayal Petroleum University)

Copyright 2012, Society of Petroleum Engineers

This paper was prepared for presentation at the SPE Kuwait International Petroleum Conference and Exhibition held in Kuwait City, Kuwait, 10–12 December 2012.

This paper was selected for presentation by an SPE program committee following review of information contained in an abstract submitted by the author(s). Contents of the paper have not been
reviewed by the Society of Petroleum Engineers and are subject to correction by the author(s). The material does not necessarily reflect any position of the Society of Petroleum Engineers, its
officers, or members. Electronic reproduction, distribution, or storage of any part of this paper without the written consent of the Society of Petroleum Engineers is prohibited. Permission to
reproduce in print is restricted to an abstract of not more than 300 words; illustrations may not be copied. The abstract must contain conspicuous acknowledgment of SPE copyright.

Abstract

Root cause analysis (RCA) is a class of problem solving methods aimed at identifying the root causes of problems/ incidents.
By directing corrective measures at core causes, it is hoped that the chances of problem recurrence will be minimized. Thus,
RCA is frequently considered to be an iterative process, and is frequently viewed as a tool of continuous improvement.RCA,
initially is a reactive method of problem detection & solving. This means that, the analysis is done after an incident has
occurred. By gaining proficiency in RCA it becomes a pro-active method. This means that RCA is able to estimate the
possibility of an incident even before it could occur. Root cause analysis mainly consists of three steps
A): Define the problem. B): Analyze the problem. C): Find the solutions for the problem.

In view of the accident which took place recently i.e. Gulf of Mexico oil spill 2010, there were eight catastrophic failures
which led to the explosion that destroyed the Deepwater Horizon drilling rig in the Gulf of Mexico .These failures included the
sending of unofficial cement by specialist cementing services, no indications of testing done on the surface by drilling rig
provider company before deploying it, pressure test which would have revealed problems in the drill was incorrectly deemed
as a success by operator company and drilling rig provider company rig personnel. A complex and interlinked succession of
mechanical failures, human judgments, engineering design, operational implementation and team interfaces caused this
tragedy. Consequences of these plain errors were quite hazardous. It affected the humanity, environment, economy and also
the settlements.

The core objective of the paper is to bring about a detailed analysis so as to throw light on new techniques and how they can be
utilised to prevent such disasters. To achieve this objective we acknowledged all the possible solutions for this issue so that the
most excellent solutions can be selected and the challenges that are to be faced are studied thoroughly and examined to prevent
future errors. However, it is recognized that complete prevention of reappearance by a single intrusion is not always possible.
On the belief that problems are best solved by attempting to correct or eliminate root causes, as opposed to merely addressing
the immediately obvious symptoms.

Introdution

Root cause analysis (RCA) is a class of problem solving methods aimed at identifying the root causes of problems/ incidents.
By directing corrective measures at core causes, it is hoped that the chances of problem recurrence will be minimized. Thus,
RCA is frequently considered to be an iterative process, and is frequently viewed as a tool of continuous improvement.RCA,
initially is a reactive method of problem detection & solving. This means that, the analysis is done after an incident has
occurred. By gaining proficiency in RCA it becomes a pro-active method. This means that RCA is able to estimate the
possibility of an incident even before it could occur. We will use the Gulf of Mexico oil spill as an example of how the root
cause analysis can be applied to a specific incident.

Introduction about deepwater horizon

The Deepwater Horizon was a 9-year-old semi-submersible mobile offshore drilling unit, a massive floating, dynamically
positioned drilling rig that could operate in water up to 8,000 feet (2,400 m) deep and drill down to 30,000 feet (9,100 m). The
2 SPE63276

rig was built by South Korean company Hyundai Heavy Industries. It was owned by drilling rig Provider Company, operated
under the Marshallese flag of convenience, and was under lease to Operator Company from March 2008 to September 2013.
At the time of the explosion, it was drilling an exploratory well at a water depth of approximately 5,000 feet (1,500 m) in the
Macondo Prospect, located in the Mississippi Canyon Block 252 of the Gulf of Mexico in the United States, exclusive
economic zone about 41 miles (66 km) off the Louisiana coast.

Operator Company is the operator and principal developer of the Macondo Prospect with 65% share, while 25% is owned by
Anadarko Petroleum Corporation, and 10% by MOEX Offshore 2007, a unit of Mitsui. Operator Company leased the mineral
rights for Macondo at the Minerals Management Service's lease sale in March 2008.
Operator Company’s primary objective for Macondo well was to evaluate a Miocene geological formation for commercial
hydrocarbon-bearing sands.
Macondo well was an exploratory well, designed so that it could later be completed to be a production well if sufficient
hydrocarbon were found.

Explosion

At approximately 9:45 p.m. On April 20, 2010, methane gas from the well, under high pressure, shot all the way up and out of
the drill column, expanded onto the platform, and then ignited and exploded. Fire then engulfed the platform. Most of the
workers escaped the rig by lifeboat and were subsequently evacuated by boat or airlifted by helicopter for medical treatment;
however, eleven workers were never found despite a three-day Coast Guard search operation, and are presumed to have died in
the explosion. 11 people lost their lives, and 17 were injured. Efforts by multiple ships to douse the flames were unsuccessful.
After burning for approximately 36 hours, the Deepwater Horizon sank in the morning of April 22, 2010. Hydrocarbons
continued to flow from the reservoir to the wellbore and BOP for 87 days, causing a spill.

Volume and extent of oil spill

An oil leak was discovered on the afternoon of April 22 when a large oil slick began to spread at the former rig site. According
to the Flow Rate Technical Group the leak amounted to about 4.9 million barrels (205.8 million gallons) of oil exceeding the
1989 Exxon Valdez oil spill as the largest ever to originate in U.S.-controlled waters. Approximately 210,000 gallons of oil
was leaking per day.

Effects of Gulf of Mexico oil spill

When oil is spilled or leaked in water or in ocean, it spreads very quickly with help of wind and currents .When oil starts
mixing with water, it can exchange the composition and becomes “MOUSSE”. This is a sticky substance that clings even more
to whatever it comes in contact with.

 Gulf of Mexico oil spill had spread over 580 square miles in just three days.
 It caused extensive damage to marine life an eroded the incomes of those dependent on it, particularly in Louisiana
where the oil slick has swamped the states fragile coastal marshlands.
 According to government estimates, the spill has so far caused 21,00gallons, or 5000 barrels of oil per day to leak into
the ocean.
 11 people died and 20 injured.
 Operator Company lost half of its market capitalization, nearly $1.6 billion so far.

Environmental Effects

 Hypothermia and drowning of birds as the oil breaks down the insulating capabilities of feathers, makes them heavier
and compromises flying ability.
 Interruption of breeding and failing of breeding grounds.

Application of RCA on GOM

Root cause analysis mainly consists of three steps

a): define the problem.
b): analyze the problem.
c): find the solutions for the problem.
 63( 3

A) Define The Problem:

The first step of the root cause analysis is to define the problem by asking the three questions.
 What is the problem?
 When did it happen?
 Where did it happen?

 What is the problem?

 Well integrity was not established or failed.
 Hydrocarbons entered the well undetected and well control was lost.
 Hydrocarbons ignited on deepwater horizon.
 The blowout preventer (BOP) did not seal the well.

 When did it happen?

It is one of the largest accidental marine oil spill in the history of the petroleum industry. the spill stemmed from a sea-
floor oil gusher that resulted from the April 20, 2010 Deepwater Horizon drilling rig explosion.

 Where did it happen?

The Macondo well is located approximately 48 miles from the nearest shoreline; 114miles from shipping supply point
of Port Four chon, Louisiana; and 154 miles from Houma, Louisiana, helicopter base.

B) Analyze The Problem

The second step of root cause analysis is to identify/analyze the causes for the above defined problems in a detailed manner. A
complex and interlinked series of mechanical failure, human judgements, engineering design, operational implementation and
team interactions came together to allow the initiation and escalation of the deepwater horizon accident.

The accident on April 20, 2010, involved a well integrity failure, followed by a loss of hydrostatic control of the well. This
was followed by a failure to control the flow from the well with the BOP equipment, which allowed the release and subsequent
ignition of hydrocarbons. Ultimately, the BOP emergency functions failed to seal the well after the initial explosions.

Overview Of Deepwater Horizon Accident

This paper basically presents an analysis of events that lead to the accident by gathering the facts surrounding the accident, 8
key findings related to the casual chain of events and analysing these facts with the help of information available to identify
the possible causes by making recommendations to enable the prevention of similar accidents in future.
The chronology of the events in the hours that lead to the accident are presented here as a factual timeline to allow a straight
forward description of events. (See Fig 1)

Eight catastrophic failures (See Fig 2 and 3) led to the explosion that destroyed the Deepwater Horizon drilling rig in the Gulf
of Mexico, killing 11 people and leading to one of the biggest oil leaks in history, according to Operator Company's long-
awaited investigation into the accident. Operator Company says the accident was caused by the failure of eight different safety
systems that were meant to prevent this kind of incident:

 WELL INTEGRITY WAS NOT ESTABLISHED OR FAILED

1) The annulus cement barrier did not isolate the hydrocarbons.
2) The shoe track barriers did not isolate the hydrocarbons.

 HYDROCARBON ENTERED THE WELL UNDETECTED AND WELL CONTROL WAS LOST
3) The negative pressure test was accepted although well integrity had not been established.
4) Influx was not recognized until hydrocarbons reached the riser.
5) Well control response actions failed to regain control of the well.

 HYDROCARBONS IGNITED ON THE DEEPWATER HORIZON

6) Diversion to the mud gas separator resulted in gas venting onto the rig.
7) The fire and gas system did not prevent hydrocarbon ignition.

 BLOW OUT PREVENTER DID NOT SEAL THE WELL

8) The BOP emergency mode did not seal the well.
4 63(

Eight key findings related to the causes of the accident emerged are described in detail as follows:

 The Annulus Cement Barrier Did Not Isolate The Hydrocarbons:

Operator Company investigation team has stated that specialist cementing services has conducted several design iterations
in order to establish acceptable slurry design and placement plan. A complex design for the cement job with base oil
spacer, cementing spacer, lead cement, foam cement and tail cement, was recommended and implemented.

The cement slurry was not fully tested prior to the execution of the cement job. The test results reviewed by the investigation
team indicated that only limited cement testing such as thickening time, foam density, mix-ability and ultra sonic compressive
strength was performed on the slurry used in the Macondo well. The test review didn’t include fluid loss, free water,
foam/spacer/mud compatibility, static gel strength transition time, zero gel time or settlement.
The day before the accident cement had been pumped down the production casing and up into the wellbore annulus to prevent
hydrocarbons from entering the wellbore from the reservoir. The annulus cement that was placed across the main hydrocarbon
zone was light, nitrified foam cement slurry.

The results of these tests indicated it was not possible to generate stable nitrified foam cement slurry with greater than 50%
nitrogen at the 1000 psi injected pressure. For the Macondo well, a mixture of 55% to 60% nitrogen was required at 1000 psi
injection pressure to achieve the deign mixture.

The investigation team identified cement slurry design elements that could have contributed to a failure of the cement barrier,
including the following:
1) The cement slurry yield point was extremely low for use in foam cementing, which could have increased the
potential for foam instability and nitrogen breakout.
2) A small slurry volume, coupled with long displacement and the use of base oil spacer, could have increased the
potential for the contamination and nitrogen breakout.
3) A de-foamer additive was used, which could have destabilized the foam cement slurry.
4) Fluid loss control additives were not used for cementing across the hydrocarbon zone, which could have allowed
formation fluids to permeate the cement.

 The Shoe Track Barriers Did Not Isolate The Hydrocarbons:

Lowering the casing string into the well with the float equipment installed pushes drilling fluid ahead of it and can create surge
pressures that can fracture the formation, leading to loss of drilling fluids and damage of the hydrocarbon production zones. To
reduce surge pressure and protect the formation, Operator Company incorporated a surge reduction system including an auto-
fill type of float collar and reamer shoe. The shoe track comprised a float collar with two check valves.

The investigation team identified the following possible failure modes that may have contributed to the shoe track cement’s
failure to prevent hydrocarbon ingress:
 Contamination of the shoe track cement by nitrogen breakout from the nitrified foam cement.
 Contamination of the shoe track cement by the mud in the wellbore.
 Inadequate design of the shoe track cement.
 Swapping of the shoe track cement with the mud in the bottom of the hole.
 A combination of these factors.

Three possible failure modes for the float collar were identified:
 Damage caused by the high load conditions required to establish circulation
 Failure of the float collar to convert due to insufficient flow rate.
 Failure of the check valves to seal.

Based on available evidence, hydrostatic pressure calculations and analysis of data from the Macondo well, it was said
hydrocarbons entered the casing through the shoe track. Therefore, the shoe track cement and the float collar must have failed
to prevent this ingress.

The casing hanger seal assembly was run and installed according to the installation procedure, and the positive-pressure test
verified integrity of the seal. The investigation concluded that initial flow into the wellbore was through the shoe track, not
through the casing hanger seal assembly. With no locking mechanism installed, thermal stresses caused by sustained
hydrocarbon flow from the reservoir through the shoe track may have subsequently opened a flow path through the seal
assembly (See Fig 4)
63( 5

 The Negative Pressure Test Was Accepted Although Well Integrity Had Not Been Established.

A negative pressure test confirms the integrity of barriers in the well (such as cement barriers, mechanical barriers, casing, and
seal assembly) by simulating the reduction in hydrostatic pressure that occurs when heavy mud is displaced with lighter
seawater, and the BOP stack and the riser are removed. The test is critical to determine that the cement will block flow from
the reservoir after mud is replaced with seawater. Importantly, it was the only means of testing the float collar valves and
down-hole cement.

To conduct the test, pressure inside the well is reduced to fall below the pressure outside the well, and then the well is
monitored. This process simulates the well condition at the time of abandonment. The test is deemed successful if there is no
indication that hydrocarbons have entered the well, as characterized by no pressure increase if the well is shut in and by no
flow if the well is open.

During the negative pressure test, pressure was bled off three separate times in an attempt to reduce the drill pipe pressure
close to 0 psi so that the well could be monitored.The first attempt to bleed pressure from the drill pipe resulted in a decline
from 1,395 psi to 240 psi. The well was shut in, and the drill pipe pressure increased to 1,250 psi. During this bleed, the crew
noticed a drop in the riser fluid level, indicating that heavy spacer had moved below the closed annular. After some time the
drill pipe was bled to 0 psi. The Operator Company open the kill line and conduct the negative pressure test by monitoring for
flow via the kill line as specified. When the kill line was opened, fluid flowed from the drill pipe to the cement unit, and the
well was shut in for a second time.

The crew again bled drill pipe pressure; it declined to nearly 0 psi, and the well was shut in. The drill pipe pressure increased
to 1,400 psi. The rig crew has misinterpreted that the well is in communication with reservoir. They monitor the kill line for
flow instead of the drill pipe and no flow was observed. The drill crew then bled pressure from the drill pipe and opened the
annular BOP to continue displacement of the riser.

 Influx Was Not Recognized Until Hydrocarbons Were In The Riser

Following the negative pressure test, the annular preventer was opened, and the hydrostatic head of fluid in the riser returned
the well to an overbalanced state. The rig crew began the displacement of the mud in the riser to seawater. As the mud was
displaced from the riser, the pressure at the bottom of the wellbore decreased, but there was no clear indication of an influx at
that time. When the spacer was expected at the surface, the pumps were shut down for the compliance engineer to conduct a
sheen test to verify that the displacement of synthetic oil-based mud was complete and that it was appropriate to discharge the
remaining water-based fluids in the riser overboard into the sea.

The sheen test was conducted, drill pipe pressure increased from 1,013 psi to 1,202 psi. This pressure increase was a result of
hydrocarbons flowing into the well. The Operator Company well site leader and the Sperry mud logger performed visual flow
checks during this period, but no flow was identified. It is possible that the valve configuration had already been moved to
direct returned fluids overboard.

Although the compliance engineer concluded the sheen test was successful, analysis indicates that the spacer had not reached
the surface at the time the test was conducted. He directed the drill crew to continue with the displacement. They used pumps
to move the spacer out of the well. Drill pipe pressure increased as the pumps were accelerated.

The drill crew identified a pressure anomaly and shut down the pumps to investigate. The drill pipe pressure fell due to the
shutdown of the pumps but did not match the kill line pressure, as it should have.

The driller directed a floor hand to bleed pressure from the drill pipe until it equalized with the kill line. When the bleed
stopped, pressure returned, but to a lower level than previously.

The drill crew changed the flow path to the trip tank to check for flow, alerting the drill crew to an influx. The drill crew
closed the upper annular BOP element to shut in the well. The actions of the drill crew were consistent with the belief that the
well was secure and a plug existed within the lines.

 Well Control Response Actions Failed To Regain Control Of The Well

Upon recognizing an influx, the drill crew took well-control actions including activating the upper annular BOP, diverting the
flow of hydrocarbons from the riser into the mud-gas separator (MGS), and closing both of the variable bore rams (VBRs).
The drill crew closed the upper annular BOP to shut in the well. In setting up for the negative pressure test, the driller had
6 63(

positioned the drill pipe tool joint so that only drill pipe was through the ram BOPs. However, the high-volume and high-
velocity flow of hydrocarbons up the well forced the drill pipe tool joint upward into the upper annular BOP before it was
closed.

The annular preventer closed partially upon drill pipe and partially upon a tool joint. Hydrocarbons and well debris flowed
between the rubber sealing element of the annular preventer and the drill pipe tool joint. The high-velocity flow of material
eroded the rubber of the sealing element and the metal of the drill pipe and prevented the annular BOP from sealing. Mud
overcame the flow-line capacity and overflowed onto the drill floor, indicating that flow into the riser continued either because
the upper annular BOP had not sealed the well or gas had entered the riser

The rig crew diverted hydrocarbons coming through the riser to the mud gas separator (MGS), which was quickly
overwhelmed and failed to control the hydrocarbons exiting the riser. The alternative option of diversion overboard through
the 14 in. starboard diverter line did not appear to have been chosen; this action would probably have vented the majority of
the gas safely overboard.

The drill crew closed two VBRs and sealed the wellbore. As the VBRs closed, pressure increased dramatically inside the drill
pipe. Hydrocarbons continued to exhaust onto the rig as gas expanded within the riser to the surface.

 Diversion To The Mud Gas Separator Resulted In Gas Venting On To The Rig

The MGS removes only small amount of gas entrained in the mud. Once separated, the gas is vented to the atmosphere at a
safe location. When the rig crew diverted high flow to the MGS, the system was overwhelmed.

When an annular preventer appeared to be activated, the well was flowing at a high rate, and hydrocarbon fluids were above
the BOP. As the hydrocarbon gas expanded, the flow of gas, oil, mud and water to the surface continued at an increasing rate.
Rig crew diverted the flow of hydrocarbons to MMS. The MMS is a low pressure system, and its design limits would have
been exceeded by the expanding and accelerating hydrocarbon flow. The main 12 in. gas outlet vent from the MGS was
goosenecked at its terminus on top of the derrick, and it vented gas down onto the rig. Several other flow-lines coming from
the MGS vessel directed gas onto the rig and potentially into confined spaces under the deck.

Large areas of the rig were enveloped in a flammable mixture within minutes of gas arriving at the surface. (See Fig 5)

 The Fire And Gas System Did Not Prevent Hydrocarbon Ignition

For operating environments where hazardous substances could be present, secondary levels of protective systems are normally
part of the design philosophy. On deepwater horizon, the secondary levels of protective systems included a fire and gas system
and the electrical classification of certain areas of the rig.

The fire and gas system detects hydrocarbon gas and initiates warning alarms when acceptable limits are exceeded. For some
alarms, an automated function initiates when hydrocarbon gas is detected beyond acceptable limits. This automated function
primarily prevents gas ingress to vulnerable locations through the heating, ventilation and air conditioning (HVAC) system.

When gas is detected, the fire and gas system closes the dampers and shuts off the ventilation fans.
Because of the low probability of hydrocarbons being present before a well produces, only a small area of deepwater horizon
was electrically classified. The two main electrically classified areas were within the rig floor and under the deck, where the
mud returning from the well could convey some residual hydrocarbons. If flammable mixture migrated beyond these areas, the
potential for ignition would be higher.

Deepwater Horizon engine room HVAC fans and dampers were not designed to trip automatically upon gas detection; manual
activation was required. The HVAC system likely transferred a gas-rich mixture into the engine rooms, causing at least one
engine to overspeed, creating a potential source for ignition.

 The Bop Emergency Mode Did Not Seal The Well

None of the emergency methods available for operating the BOP were successful in isolating the wellbore. The different
methods available were not fully independent; therefore, single failures could affect more than one emergency method of BOP
operation. Ultimately, the only way to isolate the well at the BOP was to close a single component, the blind shear ram (BSR);
that ram had to shear the drill pipe and seal the wellbore
63( 7

Crew members on the bridge attempted to activate the emergency disconnect system (EDS), which is designed to close the
blind shear rams (BSRs) and detach the LMRP (low marine riser package) so that the rig can move away. The explosions on
the rig severed the communication link between the BOP stack and the rig, preventing surface control of the EDS.As a result;
efforts to activate the EDS from the bridge were unsuccessful.

Automatic Mode Function

The automatic mode function (AMF) of the BOP activates the BSR to shear the drill pipe and seal the wellbore in the event of
catastrophic failure of the riser. The AMF initiation condition were very likely met soon after the first explosion, but the AMF
sequence did not work completely by either of the control pads, due to the failed valve and an insufficient charge on the AMF
battery tank

Evidence indicated that BSR closed 33 hours after the explosion when a remotely operated vehicle (ROV) activated the auto
shear function. (See Fig 6)

Blowout Preventer (BOP) Findings of Fact

The findings from the investigation team and those of independent industry experts conclude the following:
 The Deepwater Horizon BOP and MUX control system were fully operational at the time of the incident and
functioned as designed.
 The equipment was maintained in accordance with drilling rig provider company requirements, and all
implemented modifications maintained or improved the performance of the BOP.
 Minor leaks identified pre-incident did not adversely affect the functionality of the BOP.
 Upon detection of the flowing well, the drill crew shut in the well by (1) closing the upper annular BOP; (2)
closing the diverter packer and diverting the flow to the mud-gas separator; and (3) closing the upper and middle
VBRs, which initially sealed the well.
 The high flow rate of hydrocarbons from the well prevented the annular BOP element from sealing on the drill
pipe and subsequently eroded the drill pipe in the sealing area.
 Increased pressure inside the drill pipe and external damage caused by erosion ruptured the drill pipe, allowing
hydrocarbons to flow up the riser. The drill pipe then parted as the Deepwater Horizon drifted off location.
 The explosions and fire severed the communication link between the BOP and the rig, preventing activation of the
BOP emergency disconnect system (EDS) from the tool pushers control panel.
 The automatic mode function (AMF) operated as designed to close the blind shear rams following the explosion.
 High pressure bowed the drill pipe partially outside of the BSR shearing blades, trapping it between the ram
blocks and preventing the BSR from completely shearing the pipe, fully closing, and sealing.

C) Solution Of The Problems

The third step of root cause analysis gives the best possible solutions to the analysed problems mentioned below:

1. Cement design and testing should be done properly prior to the installing the cement in to the well. It is very much
necessary to perform all the tests (Cement Bond Log, Variable Density Log, based acoustic(Transient Time)
principle) related to the cement job, so that there won’t be any barrier or failures while performing the cementing
activities.
2. Appropriate number of centralizers should be used during the casing run in order to mitigate the risk of channelling.
3. Placing Top of the Cement should be determined by a “proven cement evaluation techniques” such as conducting
cement evaluation log which should typically be done during the completion phase of the well.
4. Well integrity should be monitored at all times and should be recorded properly, which should be clearly defined and
rigorously applied on all Operator Company -owned and Operator Company - contracted offshore rigs.
5. Require drilling contractors to implement an auditable integrity monitoring system to continuously assess and
improve the integrity performance of well control equipment against a set of established leading and lagging
indicators.
6. When many activities are performed simultaneously then care should be taken in such a way that they are monitored
properly without any negligence.
7. Defining critical leadership and technical competencies are very much required for effective performance any test
related to well operations.
8 63(

8. Conduct periodic assessments of competency that include testing of knowledge and demonstration of the practical
application of skills. Developing a certification process to assure and maintain proficiency.
9. Develop an advanced deepwater well control training program that supplements current industry and regulatory
training. Training outcomes would be the development of greater response capability and a deepwater understanding
of the unique well control conditions that exist in deepwater drilling.
10. Require hazard and operability (HAZOP) reviews of the surface gas and drilling fluid systems for all Operator
Company -contracted drilling rigs.
11. Include in the HAZOP reviews a study of all surface system hydrocarbon vents, reviewing suitability of location and
design.
12. Develop a clear plan for ROV intervention (independent of the rig- based ROV) as part of the emergency BOP
operations in each of Operator Company’s operating regions, including all emergency options for shearing pipe and
sealing the wellbore.
13. Require drilling contractors to implement a qualification process to verify that shearing performance capability of
BSRs is compatible with the inherent variations in wall thickness, material strength and toughness of the rig drill pipe
inventory.
14. Eliminate human judgment as much as possible where mistake could have huge consequences.
15. There should be proper communications among operators and contractors regarding the risks associated with
decisions being made.

Acknowledgement
The authors would like to express the gratitude to Pandit Deendayal Petroleum University to complete this paper.

References

1. Deepwater Horizon Accident Investigation Report, BP Investigation 2010, BP Website:

www.bp.com/.../BP.../Deepwater_Horizon_Accident_Investigation_Report.pdf.
2. “Deepwater-The Gulf Oil Disaster and The Future of Offshore Drilling”, National Commission on the BP Deepwater Horizon Oil
Spill and Offshore Drilling. January 2011.
3. Macondo Well Incident Transocean Investigation Report, Volume 1, June 2011, Transocean website:
http://www.deepwater.com/fw/main/Public-Report-1076.html.
4. “Lesson Learnt From Macondo Oil Spill”, Presentation to Ocean Energy Safety Advisory Committee, April 18, 2011.
5. “Sustainability Review 2010” BP website:bp.com/sustainability.
6. “The Gulf Oil Disaster” National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling, Chief Counsel’s
Report (2011).
7. URL: http://en.wikipedia.org/wiki/Deepwater_Horizon_oil_spill.
8. URL:http://en.wikipedia.org/wiki/Oil_spill.
9. URL:http://en.wikipedia.org/wiki/Root_cause_analysis.
10. URL: http://fopnews.wordpress.com/2010/05/.
11. URL:http://static.guim.co.uk/sysimages/Guardian/Pix/maps_and_graphs/2010/9/9/1284025934143/Deepwater-Horizon-report--
007.jpg.
12. URL:www.pakistanideology.com/.../oil_leak_cause.gif.
13. URL: http://www.valdezrca.com/valdez-oil-spill-root-cause-analysis.
63( 9

Figures

Fig 1

Fig 2
10 63(

Fig 3
63( 11

Fig 4 Fig 5

Fig 6