UIS, FACULTY OF SCIENCE AND TECHNOLOGYDEPARTMENT OF INDUSTRIAL ECONOMICS, RISK MANAGEMENT AND PLANNING

DEEPWATER HORIZON PIPER ALPHA

MOS200 APPLIED RISK ANALYSIS

ANALYSIS AND DISCUSION OF PIPER ALPHA AND MACONDO EXPERIENCE DATE – 11TH OCTOBER 2010

GROUP 13NWOKOCHA CHIGOZIE C.Student nr.210630BAMIDELE OYEWOLEStudent nr. 207977

Table of Contents

Preface

Chapter 1 Introduction and Background

1.1. Introduction…………………………………………………………………….41.2. Background……………………………………………………………………..4

Charter 2 Description of the accidents

2.1. Short description of piper alpha accident………………………………………5 2.2 Short description of Macondo accident…………………………………............ 6 2.3 Comparison of both accidents……………………………………………………7

Chapter 3 Circumstances common to the current offshore industry practice and obsolete circumstance

3.1 Piper Alpha Circumstances………………………………………………………8 3.2 Macondo Circumstances………………………………………………………….8

Chapter 4 Barrier Failures and Evaluation of Applicability of Barriers in Present Offshore Industry

4.1 Barrier failures for Piper Alpha Accident ……………………………………..10 4.2 Barrier failures for Macondo Accident ………………………………………11 4.3 Applicability of barriers in Piper Alpha Accident ....…………………………15 4.4 Applicability of barriers in Macondo Accident ………………………………17

Chapter 5 Major Accident Risk Management Lessons Learnt and Conclusion

5.1 Lessons from Piper Alpha………………………………………………………21 5.2 Lessons from Macondo Accident……………………………………………….21 5.3 Others ……………………………………………………………………………22 5.4 Conclusion..………………………………………………………………………22

List of Figures and table ………………………………………………………………23References ………………………………………………………………………………23

2

Preface

This is report about the analysis and discussion of the Piper Alpha and Macondo experience. We have tried to make the report as concise as possible. The report contains – short discussion of Piper Alpha and the Macondo accident, discussion of the circumstances that are common to present offshore industry, discussion of the barriers failures in both accidents and we also evaluate their applicability to present offshore industry; finally, we presented some major accident risk management lessons learned.

We obtained most of our information from the report of the investigating team of the accidents and some information is also obtained from the internet. The references to theses are made at the end of the report.

We have tried to make the report as concise as possible by making use of our knowledge from various safety courses which we have been exposed to in the University of Stavanger, especially from the Applied Risk Analysis. A critical evaluation of the accidents has helped us to present our report. We hope that the report represents a concise form of the original report and can be used for academic purposes

3

Chapter 1 Introduction and Background

1.1 INTRODUCTION

This project presents the summary of two most popular accidents in the oil and gas industries. I.e. Piper Alpha accident in the North Sea and Macondo accident in Gulf of Mexico (GOM) Accident and comparison between both accidents. The project consists of the circumstance common to the obsolete and present offshore industry. It also consists of barrier failures, applicability of the barriers in present offshore industries, Risk management lesson learned for both accidents and then conclusion

1.2 BACKGROUNDDeepwater Horizon was a fifth generation, ultra-deep water, dynamically positioned semi-submersible drilling unit built in 2001.It makes use of an automated drilling system and a 15000 psi-rated BOP system. In the nine years of its operation, it has drilled wells up to 35,055 ft.

The BP acquired the lease for the Macondo well from the Mineral Management Services (MMS) on March 19, 2008. The shared ownership is as follows BP (65%), Anadarko (25%), and MOEX offshore (10%) with BP as the lease operator.

The Macondo well was an exploration well located in the Mississippi Canyon Block 252, about 60km southeast of the Louisiana coast. The well had been drilled to a depth of 18360 ft, however, the well penetrated a hydrocarbon bearing Miocene reservoir and it was seen as a commercial discovery. Decision was taken to abandon the well temporarily and complete it as a production well later.

Part of this report was about the accident which happened during the activities that would have led to the temporary abandonment of the well.

4

Charter 2 Description of the accidents

2.1 SHORT DESCRIPTION OF THE PIPER ALPHAPiper Alpha was an oil production platform cited in the in North Sea. It was operated by Occidental Petroleum .It began production in 1976, first as an oil platform and then later converted to gas production. The platform was meant to be modified with few constructions which were sited closes to sensitive areas such as control room. Gas pipes were installed several activities such as welding were involved which changes normal operating routines but the platform wasn’t shut down. During this period, small usual gas leaks were discovered but there was no cause for concern.

The Platform had 2 large Pumps A and B, which pressurized the gas that was been sent onshore. Pump A was taken out of service that morning (6 July, 1988) so also was the pressure valve (safety value) for maintenance and the pipe was temporarily sealed with a metal plate. The pressure was meant to be replaced at the end of the day but the job over ran. The Engineer signed off without informing the Supervisor on duty about the situation because the supervisor was busy.Piper Alpha had an automatic fire fighting system like other platforms driven by diesel and electric pumps with automatic control, designed to suck in large amount of sea water for fire fighting. But it was switched to manual on the evening of 6 th July 1988. But this is only switched to manual in other platforms when divers were near the intake Inlet. That of piper was switched to manual regardless of the location of the divers.Pump B stop during operation, but because the entire power supply of the offshore construction work depends on this pump, it had to be brought back into operation in few minutes. The documents were checked to see if pump A could be used and a 2 weeks maintenance work permit was found but the permit to work (PTW) for the pressure safety valve wasn’t found since it was in a different location. So the supervisor assumed the pump could be used since the maintenance work hasn’t started. Pump A started, no one noticed that the vital pressure safety valve has been removed. The metal used to cover the opening couldn’t resist the gas pressure .There was gas leakage at high pressure, with about six alarms triggered and before the men around could react, there was an explosion.

The first explosion cause extensive damage and it immediately led to a large crude oil fire in B Module, the oil separation module, which engulfed the north end of the platform in dense black smoke. This fire, which extended in C module and down to the 68 ft level, was fed by oil from the platform and by a leak from the main oil line to the shore, to which pipelines from Claymore and Tartan platforms were connected. The fire was massively intensified by second explosion at about 22.20 hours. This was due to rupture of the riser on the gas pipeline from Tartan as a result of the concentration and high temperature of the crude fire. If oil production on the other platforms around had been shut down earlier than it was, it is probable that this rapture would have been delayed.

5

The fire was further intensified by the raptures in riser on the gas pipeline to the Frigg disposal system and the gas pipeline connecting Piper with Claymore at about 22.50 and 23.20 hrs respectively. (Cullen) The timing of the depressurization of the pipeline couldn’t have had any material effect on the fire at Piper because The OIMS on Claymore and Tartan were not prepared for an emergency on another platform with which their own platform was connected.The firewall (Fire water system) wasn’t designed for explosion so it was destroyed thereby dislodging all the panels around Module A. Also because the control room wasn’t designed for explosion it was destroyed and the platform's organization disintegrated. No attempted was made to use the loud speakers or order evacuation.There were 226 men on the platform, 62 were on night shift duty. Majority of them were in the accommodation. Attempts made to rescue by helicopter or life boat were truncated by smoke and flames. Diving personal on duty, along with other personal on duty were able escaped to the accommodation .A larger number of men congregated near the gallery on the top level of accommodation because the condition initially was conducive but later deteriorated greatly owing to the entry smoke. A number of personnel including 28 survivors, decided on their own to get out of their accommodation. They reached the sea by the use of ropes and hoses or by jumping off the platform at various levels. 61 persons survived from Piper.39 had been on night shift and 22 had been off duty .This was because no attempt was made at any stage to lead the men out of the accommodation. This resulted into many deaths.

2.2 SHORT DESCRIPTION OF THE MACONDO ACCIDENT

The drilling of Macondo well started initially with Transocean’s semi-submersible Marianas on October 6, 2009 but because of hurricane Ida, it was evacuated and removed for repairs.The Deepwater Horizon which was drilling the Macondo well at the time of the accident replaced Marianas and it arrived on site on January 31, 2010. It started the drilling work on February 6, 2010. The Deepwater Horizon was positioned on the Macondo and it was on the last phase of completing its drilling of an exploration well.

On 20 April, 2010, a major accident happened when a well control event allowed the escape of hydrocarbons from the well onto the Transocean’s Deepwater Horizon. This resulted in explosions and fire on the rig. Unfortunately, 11 people lost their lives, 17 were injured while 98 people survived without serious physical injury. The fire continued for 36 hours being fed by hydrocarbons from the well and eventually the rig sank.However, hydrocarbon continued to flow through the wellbore and the blowout preventer for 87days before it was brought under control. This resulted in one of the worst oil spill in the US history.An independent investigation team made up of over 50 professionals was set up by BP immediately after the accident. The team also made use of information provided by other companies including Transocean, Halliburton and Cameron. The job of the team was however limited by lack of access to some key witnesses and physical evidence. The purpose of the findings by the team was not to apportion blame rather the report is meant

6

to be used for learning and also to be used to prevent future recurrence of similar incident.Our report is based on critical evaluation of the findings published by the BP investigation team and this evaluation is considered in the subsequent pages.2.3 Comparison of the two accidents

Both accidents started as a result of hydrocarbon leakages The Piper Alpha was on platform while that of Macondo was on Semi-submersible drilling unit. And they were due to Human Failure: Both operations have poor management system. The personnel lacked the required training needed for operation.There was also poor communication channel between the management and the staff.

Technical Failure: Both accidents were also due to technical failures. The Barriers put in place failed to prevent the occurrence of the accidents.

Organizational Failure: The organization structures were poor in both companies. There is nonchalant attitude toward work.

7

Chapter 3 Circumstances common to the current offshore industry practice and obsolete circumstance

3.1 PIPER ALPHA CIRCUMSTANCESThe traditional offshore practice had focused on prevention of design and material failures. These potential failures were prevented or controlled by rigid codes and prescriptive regulations. The practice paid inadequate attention to operational issues, the management of safety then was poor and the prescriptive regulation was inappropriate.‘’Findings has shown that approximately 80% of failure were attributed to operational failures’’ (1).Inadequate training, inappropriate operational procedures, lack of emergency procedure and poor ergonomics were also lacking in the traditional offshore practice (Piper Alpha). These have contributed to several operational failures.The management of safety at organization level was also poor then due to poor communication and inadequate deficiency in rectification procedure. This management failure has lead to a lot of accidents. Several small leakages were noticed before the major incident that led to the destruction of Piper Alpha.Control system on Piper was out-dated. It was expensive to provide in terms of space, weight and cost. Expensive to operate and maintain, being manpower-intensive and based older technologies.Finally, the offshore practice was based on prescriptive approach. This approach is not appropriate to modern technology .This is because it is a reactive approach. This approach tends to be forward looking and do not readily adapt to technical or functional changes. It encourages a ‘’compliance culture’’ that was focused on complying with the word of the rule rather than it intent. There was little incentives to understand the rule, it inherent assumptions and its objective and to optimize safety and economy by the best possible. The prescriptive approach was not amenable to regulatory management structure and corporate communications; they were major contributing factor to accidents. Also, in addition to safety implication of traditional offshore practice, prescriptive regulations had cost relate and operational implications because they provide limited scope to be innovative or take full advantage of technological advance. [1]Arrangement of structure or moduleKeeping of diesel fire pumps of manual mode during periods of diving was peculiar with piper Pier Alpha despite the audit recommendation that it should be changed.

3.2 MACONDO CIRCUMSTANCESThere are many incidents which happened onboard the Deepwater Horizon prior to the tragic accident, which is still prevalent in the current offshore industry.Below are some of these circumstances based on the findings of the investigation team and our evaluation.

8

(i) There was lack of effective communication between the operator, BP and their contractor, Halliburton. During the cement job on Macondo well, there was no effective quality assurance on Halliburton’s technical service and they failed to communicate effectively with the BP well team.

(ii) During the positive pressure test, the integrity of the blind shear ram (BSR), the seal assembly, casing and the top wiper plug were established but the integrity of the shoe track which plays a role in isolating hydrocarbon was not tested because of the presence of the top wiper plug. The test was deemed successful even when everything has not been tested.

(iii) In the negative-pressure test, there are no established industry standards for conducting this. Both the regulating bodies and the operators have their own procedures and in most cases, large discrepancies exist. This was the case in Deepwater Horizon because the rig crew had to abandon the method that they are used to, in order to perform the test based on MMS stipulations.

(iv) Inability of the regulating bodies to specify success or failure criteria for negative pressure test. This is also common with the operators, for instance, BP did not specify minimum expectations for negative-pressure test procedures.

(v) Lack of adequate communication in abnormal situations. A negative-pressure test is deemed successful if no flow is noticed on the kill line or no pressure on the drill pipe. However in the Deepwater Horizon, a pressure of 1400 psi was observed on the drill pipe, which is an indication of communication with reservoir. The rig crew discussed this abnormality though informally, and based on the investigation, the rig crew accepted the explanation of the tool pusher and the driller, that the pressure was due to a phenomena called “bladder effect”. There was no basis for accepting this explanation. The negative-pressure was deemed successful by the rig crew and well site leaders even though well integrity had not been established.

(vi) Another situation which is prevalent in present day offshore industry is running of some activities simultaneously. On the day of the tragic accident, effective monitoring of the well was adversely affected due to simultaneous operations which occurred during preparation to abandon the well temporarily. In the Deepwater Horizon prior to the accident, it was observed that some of the mud pits and the trip tank were being cleaned and emptied causing pit levels to change. These changes in the pit levels may have complicated the ability to use pit volumes to monitor whether the well was flowing. Pit levels indicate the volume of the fluids at the surface; if volume pumped into the well equals the volume returned from the well, pit levels remain constant, indicating no flow from the reservoir into the well.Other simultaneous operations, such as preparing for setting cement plug in the casing and bleeding off the riser tensioners were occurring and may have also distracted the rig crew and mud loggers from monitoring the well effectively.

9

Chapter 4 Barrier Failures and Evaluation of Applicability of Barriers in Present Offshore Industry

4.1 BARRIER FAILURES FOR PIPER ALPHA ACCIDENT

Human FailureOn Piper Alpha, there was sequence (operational failure) of events which resulted in barrier failure leading to the destruction of the entire platform. These barrier failures are:Deficient training: The management of Occidental failed to provide the training needed to ensure that an effective permit to work (PTW) system was operated in practice. And when faced with known problem with deluge system they did not become personally involved in probing the extent of the problem and what should be done to resolve it as soon as possible. The adopted a superficial attitude to the assessment of the risk of major hazard. This failed as a barrier to prevent the incident.Permit to Work barrier: Some gas leakages were noticed earlier on but because the management was too satisfied with fact that the permit to work system was being operated correctly. They rely on the absence of any feedback of problem as indicating that all was well. The major leakages that lead to the destruction of Piper was caused by repeated attempts to start a pump that had been taken out of service for maintenance, owing to the fact that the crew were oblivious of the fact the that downstream had been isolated. This occurred because permit to work failed as barrier; it suffered from deficiencies in regard to the actions taken to suspend a permit, the absence of a procedure for handover of permit at shift change, the crucial information that could prevent this wasn’t passed to the installation engineers.Technical FailureIgnition barrier: The ignition barrier that was meant to prevent ignition failed. Though, source of ignition of the leaks was unknown.Escalation Barrier: The barrier functions to avoid escalation due to explosion and fire failed to reduce the consequences. This was because the emergency fire water system was not available owning to the fact that the diesel pump was in manual standby mode. This was a precaution taken when divers are near the intake pump. But for Piper, divers were not diving near the intake pump, and the pump could have been switched back to automatic standby.Escape barrier: The barrier function to prevent fatalities through escape and evacuation also failed. This was due to the fact that some of them were insufficiently robust. The plant design was poor. The platform had large unprotected pipes which when subjected to impinging fire loads for extensive period won’t withstand it. This failure actually occurred during the design of unprotected pipes and was also repeated at later stages, when the company management commissioned studies that pointed the vulnerability of the pipes, and the management failed to take action to rectify the situation.

10

Leak Isolation Barrier: The leak isolation barrier which was meant to isolate the link and limit the source of fuel worked initially when the segment was isolated by ESD valves. But the barrier failed later due to escalation.Layout Plan/plant design: This was supposed give protection to the accommodation during fire or explosion incident but also failed as a barrier. According to the layout, the Central Control Room (CCR) was sited close to the gas compression and accommodation was also close (and above) gas compression. The layout was supposed to have a utility module as a buffer between gas compression and safety critical equipment such as emergency power and fire water supply). These systems will have provided a further buffer for the accommodation. The Piper design was poor.

Figure 1 Bow – Tie for Piper Alpha

4.2 BARRIER FAILURES FOR MACONDO ACCIDENT

Just like most major accidents, there are some critical factors which were in place for the accident to happen and based on the BP investigation team, four critical factors were identified and these are:

“-Well integrity was not established or failed- Hydrocarbons entered well undetected and well control was lost- Hydrocarbon ignited on Deepwater Horizon- The Blowout preventer(BOP) did not seal the well”

By investigating the above critical factors, the use of fault tree analysis, various scenarios and failure mode, eight key findings/barriers which failed were identified. These are:

“(1) The annulus cement barrier did not isolate the hydrocarbon(2) The shoe track barriers did not isolate the hydrocarbon

11

Communication failureInadequate trainingGas leakage

Work permitIgnition EscapeEscalationLeak isolation

Pump Failure

Loss of livesLoss of assetsEnvironmental pollutionExplosion

(3) The negative-pressure test was accepted although well integrity had not been established.

(4) Influx was not recognized until hydrocarbons were in the riser.(5) Well control response actions failed to regain control of the well(6) Diversion to the mud gas separator resulted in gas venting onto the rig(7) The fire and gas system did prevent hydrocarbon ignition(8) The BOP emergency mode did not seal the well”. [1]

The above eight barriers were the operational barriers that were in place to prevent or reduce any possible hazard. The figure below shows the barriers breached and their relationship to the critical factors using the Swiss cheese model of hazards analysis.

Figure 2- Illustration of Swiss cheese model of hazards analysis based onDeepwater Horizon report [2]

There are many operations onboard Deepwater Horizon before, during and after the tragic accident, and many of these events can serve as initiating event in a bow-tie diagram. We tried to present a bow-tie by using ‘hydrocarbon on the rig’ as our initiating event and below is the bow-tie diagram for the Macondo accident:

12

Annulus cement barrier failedShoe track failedInadequate negative test procedureIneffective fluid managementIneffective well monitoringBOP failure

-Adequate training-Effective maintenance-Effective Communication- Effective Communication-Defined test procedures-Combustible gas detectors

Hydrocarbon on The rig

-HVAC system-FIRE & GASAlarm-Escape Routine-Abandon the Well

Explosion and fireLoss of lives

Economic loss

Environmental pollution

Loss of livelihood

FIGURE 3 – BOW-TIE DIAGRAM FOR MACONDO ACCIDENT

The outcome of Deepwater Horizon events on April 20, 2010 could have been either prevented or reduced if any of the critical factors in figure 2 had been eliminated. Below is a brief discussion of barrier failures for the Macondo accident.

(A) The annulus cement barrier did not isolate the hydrocarbon There was no indication that the hydrocarbon entered the wellbore before or during the cement work based on the findings by the investigation team. In order to find out how the hydrocarbon may have entered the wellbore after the cement job, assessment of the cement slurry design, cement placement and confirmation of placement was done.To evaluate the effectiveness of the Halliburton cement slurry design, the investigation team requested a third party cementing Lab, to conduct series of tests. Based on the test, it was identified that the foam cement slurry used for the Macondo well was likely unstable, resulting in nitrogen breakout. The cement slurry design element that could have contributed to a failure of the cement barrier includes:-(i)”The cement slurry yield point was extremely low for use in foam cementing which could have increased the potential for foam instability and nitrogen breakout.(ii) A small slurry volume, coupled with long displacement and use of base oil spacer, could have increased the potential for contamination and nitrogen breakout.(iii) A defoamer additive was used, which could have destabilized the foam cement slurry.(iv) Fluid loss control additives were not used for cementing across the hydrocarbon zone which could have allowed formation fluids to permeate the cement.”

It was concluded that the nitrified foam cement slurry used in the Macondo well probably would have experienced nitrogen breakout, nitrogen migration and incorrect cement density, which would explain the failure to achieve zonal isolation of hydrocarbons. Nitrogen breakout and migration would have also contaminated the shoe cement and may have caused the shoe track cement barrier to fail.

(B) The shoe track barriers did not isolate the hydrocarbonSince the annulus cement did not isolate the reservoir effectively, a mechanical barrier failure enabled hydrocarbon to enter the wellbore. Three possibilities for this entrance are- through the shoe track barriers, through the hanger seal assembly, or through the production casing and components.The possible failure modes that may have contributed to the shoe track cement’s failure to prevent hydrocarbon ingress are as follows:-- Contamination of the shoe track cement by nitrogen breakout from the nitrified foam

cement.- Contamination of the shoe track cement by the mud in the wellbore.- Inadequate design of the shoe track element- Swapping of the shoe track cement with mud in the rat hole.- A combination of the above factors

For the float collar, the possible failure modes were identified as follows:-- Damage caused by high load condition required to establish circulation

13

- Failure of the float collar to convert due to insufficient flow rate- Failure of the check valves to seal

At the time of the report, the specific mode which caused the hydrocarbon ingress was not established.

(C) The negative-pressure test was accepted although well integrity had not been established.The negative-pressure test was conducted following the completion of the positive-pressure test. The main objective of the negative-pressure test was to test the ability of the mechanical barriers to withstand the differential pressure that would occur during reduction of hydrostatic head to seawater and disconnection of the BOP and riser.During the test, the rig crew monitored the drill pipe flow but based on the MMS guideline, the negative-pressure test should be done by monitoring flow on the kill line.The test was done on the kill line but they noticed later that the drill pipe pressure was constant at 1400 psi. There was a discussion about this pressure but based on the tool pusher’s idea that it was caused by a phenomena known as “annular compression” or “bladder effect”, the rig crew and the well site leaders misinterpreted the situation.In addition to the above, there were two possible reasons why flow did not exit the kill line: the kill line may have been plugged with solids from the spacer and the system may not have been lined up correctly; a valve may have been inadvertently left closed.

(D) Influx was not recognized until hydrocarbons were in the riserOn the Macondo well, the rig crew failed to observe significant indication of hydrocarbon influx during the displacement of the riser to seawater. The annular preventer was probably open following the negative-pressure test and the well was returned to an overbalanced state by the hydrostatic head of fluid in the riser.Due to simultaneous operations (end-of-well activities) occurring on the Deepwater Horizon, the rig crew and mud loggers may have been distracted from monitoring he well effectively.Based on analysis, the first indication of flow from the well could be seen in the real-time data after 20:58 hours but the rig crew and mud loggers did not recognize indication of flow until after hydrocarbon entered the riser at approximately 21:38 hours. The first well control response probably occurred at 21:41 hours.

(E) Well control response actions failed to regain control of the wellRapid response is critical when well influx is observed. A clear and effective procedure must be implemented in order to maintain control over a deteriorating well condition.When control of the well has been lost and hydrocarbon flow has escalated, the rig crew members need to act immediately and effectively.Based on witness account, mud flowed uncontrolled onto the rig floor and the rig crew attempted to control the well by closing the annular preventer in the BOP. This first action was rather too later because hydrocarbon was already in the riser.The rig crew diverted hydrocarbon to the mud gas separator (MGS) which failed to control the hydrocarbon exiting the riser probably due to high pressure of the flow. Real-time data showed that drill pipe pressure rose from 1200 psi to 5730 psi within one

14

minute which was likely caused by one or two variable bore rams (VBRs), which sealed the annulus. A small explosion occurred after loss of power on the rig, this was followed by a larger explosion and fires continued on the rig.The subsea supervisor also tried to activate the emergency disconnect sequence (EDS) after the explosion but there was no indication that this happened. The EDS would have sealed the well and disconnect the riser from the BOP stack.(F) Diversion to the mud gas separator resulted in gas venting onto the rigThe mud gas separator (MGS) is used in removing small amount of gas in the mud. When separated, the gas is released to the atmosphere at a safe location. The MGS is designed to work at a low pressure but the rig crew diverted the flow of hydrocarbon to the MGS. The pressure limit of the MGS would have been exceeded by the expanding and accelerating hydrocarbon flow. This would have caused the MGS to vent gas onto the rig and potentially into confined spaces under the deck.Large areas of the rig were covered in highly flammable mixture within minutes of gas arriving at the surface.

(G)The fire and gas system did prevent hydrocarbon ignitionThe fire and gas systems on rigs help to detect hydrocarbon gas and it initiates warning alarms when acceptable limits are exceeded. In some situations, an automated function initiates when gas is detected beyond acceptable limits. This prevents gas from entering vulnerable locations through the heating, ventilation and air-conditioning (HVAC) systems. When is detected, the fire and gas system closes the dampers and shuts off the ventilation fans.Because of the low probability of hydrocarbon being present before a well produces, only a small area (rig floor and under the deck) of Deepwater Horizon was electrically classified. Deep water horizon engine room HVAC and dampers were not designed to trip automatically, manual activation was required upon gas detection. This design may have been selected so that false gas detection trip would not interrupt the power supply to the thrusters, which keep the dynamically positioned rig on station. The HVAC system probably transferred gas-rich mixture into the engine rooms causing at least one engine to over speed, creating a potential source of ignition.

(H)The BOP emergency mode did not seal the wellIn order to isolate the well after the explosion, the subsea supervisor tried to operate the EDS that would have closed the BSR, sealing the wellbore and disconnect the lower marine riser package (LMRP). The EDS needs communication signal to be sent through one of two multiplex (MUX) cables routed through the moon pool. There was no communication because the explosion and fire may have damaged the MUX cables, thereby disabling the EDS means of closing the BSR.The automatic mode function (AMF) of the BOP should have been initiated when there is loss of electrical power, communication and hydraulic power. Neither of the control pods (blue and yellow) would have been able to perform the AMF because each showed short-comings that may have incapacitated them in completing an AMF sequence.

4.3 APPLICABILITY OF BARRIERS IN PIPER ALPHA ACCIDENT

15

There has been emphasize of the use modern safety regulation based on a ‘’goal setting’’ approach by the Health and Safety Authorities. This approach sets out high-level objectives or performance standards. The primary objective is based on the principle that safety risk must be as low as reasonably possible (practicable) .This principle ‘means not only that risk must be reduced to a tolerable level, but also a further reduction must be achieved, provided that the penalties ( in terms of time, money trouble ) are not disproportionate to improvement gain.The Authority has emphasized firstly, that companies must work with a clean slate for each new installation and demonstrate that all safety issues have been identified and addressed. Secondly, that the owner has much greater flexibility in demonstrating compliance. That company owners are free to use novel or innovative solutions as long as they are supported by the appropriate analysis and (or) testing.Based on this, various improvement/modification has been carried out on the safety barriers for them to applicable to present offshore industries. They are as follows Human failureAdequate Training: Offshore industries have lain serious emphasize on the training of the personal before heading offshore. Work to permit: Adequate training is given to personal and compliance is been enforced by the management in other to prevent lapses.Fire protection System: These consist of the fire water main and hydrant fed by fire pumps. Two independent pumps are used to avoid uninterrupted water supply, one diesel-driven and the other electric. In present offshore industry, water is used more as a means to protect the control equipment, structures and passive barriers than for suppressing fire.Fixed extinguishing System: These are used when more extended fire protection systems are required. Most commonly used is the sprinkler. The extinguishing agent is water; it is effective relatively cost-effective and the available almost everywhere. With chemical additives, e.g. foam, the system’s capacity can be increased according to the hazard needing protection. Dry chemicals are commonly used as extinguishing agent. This method is based on the principle of chemically blocking the chain reaction and smothering the fire area, thus preventing re-ignition.Detection and alarm systems: Fire and smoke detection systems are a vital element of the fire protection system. They are installed as a means of giving early warning of hazards. They can alert site personnel to respond to the situation and automatically activate counter-measures. In locations where flammable gases can appear, gas detection can be installed to detect hazardous gas releases. Combustible gas detectors are typically calibrated at two levels, 10% and 40% of the lower explosion limit (LEL).Smoke ventilation: These are systems used to evacuate smoke and unburned gases that otherwise will present a potential risk of igniting if the temperature reaches the critical level (also called ‘flashover’). They will also provide better visibility for the personnel involved in the extinguishing effort, and therefore also the possibility for safe escape from the area.

Explosion venting: Rupture discs are installed to relief pressure in order to prevent damage caused by the explosion of unburned natural gas in the gas engine exhaust system. In addition to structural design, forced ventilation is installed in the exhaust

16

system to prevent flammable gases from accumulating. These ventilation systems purge the exhaust system during standstill and must be in operation before the engine starts.Hazardous areas: Areas where flammable liquids and gases are handled or stored are now evaluated due to the possible release of flammable vapours. All installations that can be a source of ignition are also evaluated and the equipment must meet the requirements stated in the appropriate standards before installation. For example, in the USA, suitable guidelines are provided by standards such as API 500and API 505, NFPA 37 and NFPA 850.Similar European codes are represented byEN 60079-10.

4.4 APPLICABILITY OF BARRIERS IN MACONDO ACCIDENTBarriers are present in order to eliminate or mitigate any potential hazard. The barriers which were discussed above are still present in the present offshore industry and breaching of these barriers may have serious consequences just like in the Macondo accident. Below is an evaluation of applicability of these barriers in present offshore industry.(A) ANNULUS CEMENT BARRIERIn the Macondo case, this barrier failed to prevent entrance of hydrocarbon into the annulus after cement placement. In the present offshore industry, this barrier is still of importance and so it has to be assessed critically.The cement design and testing by Halliburton did not include testing for fluid loss, stability, free water compatibility, static gel strength transition time, zero gel time or settlement.OptiCem model predicated the use of 18% to 19% foam quality but cement slurry tested showed 12.98% foam quality which can be seen as an oversight on part of Halliburton.Effective communication of risk, testing procedures and advanced techniques by Halliburton could have identified the low probability of the cement to achieve zonal isolation. This would have increased understanding of the risks associated with the cement job and this would have led to additional mitigation steps.

(B) MECHANICAL BARRIERSAfter the first barrier (Annulus cement barrier) was breached, two possible flow paths existed for the hydrocarbon. Each of these also had additional barriers and one or more of these barriers must have failed allowing hydrocarbon to flow to the surface. These two flow paths are the shoe track and the annulus area. The barriers within the flow paths are:-- shoe track cement and double-valve float collar- the casing hanger seal assembly at the wellhead - the production casing and components

Based on the investigation, it was established that ingress of hydrocarbon was through the shoe track.In present offshore industry, these barriers are still there, therefore critical assessment and evaluation of the risk associated with them is very since it will reduce the potential of future occurrence.

17

(C) PRESSURE TESTSThe positive-pressure test was conducted in two stages (at low and high pressure) and in both cases, the rig crew deemed it successful.The rig crew began the negative-pressure test by using method which is consistent with their regular practice on previous wells. However, based on MMS approval, the negative-pressure test was supposed to be done by observing flow from the kill line and not the drill pipe as done by the rig crew.It was however observed that there was no established industry standard for conducting negative-pressure tests and MMS regulation did not specify minimum procedures/criteria for the negative-pressure test. Also BP and Transocean did not specify/establish minimum expectations for negative-pressure test procedures.This is a barrier which is highly applicable in present offshore industry because of oversight of the operators, the contractors and the regulating bodies, many procedures/tests do not have a detailed specification for the success or failure of the procedure or test. This was the case in the Deepwater Horizon and it resulted in a major accident.

(D) WELL MONITORINGThe annular preventer was opened after completion of the negative-pressure test. The test was deemed successful although well integrity has not been established.Although some barriers that would have prevented the influx of hydrocarbon into the riser failed, continuous monitoring of the well should have helped the rig crew in taking action as soon as possible. This would have prevented or mitigated the hazard on the Deepwater Horizon.Inability to monitor the well effectively may also have been caused by lots of simultaneous activities going on in the rig and this is common in present offshore industry because the operators and the contractors wants to save time and cost.The well control response taken failed to regain control of the well because hydrocarbon was already in the riser and the action came quite late.Based on the investigation, it was observed that there was no detailed specification on what should be done in an emergency situation (like loss of well control) or how to handle continued flow. This can also be seen as oversight on the part of the regulation bodies, the operators and the contractors for lack of detailed specification in emergency situation. This is still the case in present offshore industry.

18

(E) MUD GAS SEPARATOR (MGS)

Figure 4: DEEPWATER HORIZON MUD GAS SEPARATOR [3]

The MGS is used in removing gas from the drilling mud. The gas when separated is vented out in a safe location. This helps in removing potential source of flammable gas/mixture on the rig. This barrier is highly applicable in present offshore industry but due to the pressure it was subjected to, in case of the Deepwater Horizon, it was overwhelmed and this resulted in gas vented on the rig and under the deck. The MGS should not be used in diverting hydrocarbon because it has a goose-necked vent and will probably vent the gas onto the rig thereby creating a potential hazard on the rig.

(F) FIRE AND GAS SYSTEMThese are systems which can help in detecting or monitoring the presence of combustible gas in classified areas. This is an important barrier because it helps in preventing possible ignition of combustibles on the rig. With respect to the Deepwater Horizon, out of the 27 combustible gas detectors (CGD), only 13 had automated response while the remaining had only visual and audible alarms. The distribution of the CGDs on the Deepwater Horizon is shown in the table below:-

Table 1- CGDs on Deepwater Horizon [1]

AREA #CGDThird Deck 0Second Deck 5Main Deck 13Helideck 0Drill Floor 9TOTAL 27

19

The automated actions were meant to prevent gas ingress through the HVAC system by closing fire dampers and shutting down the ventilation fans in different fire zones.The design of the gas detection system on the Deepwater Horizon lacks the redundancy levels associated with a high reliability design because it was based on one single CGD at each location.The fire and gas detectors on some parts of the Deepwater Horizon are manually triggered and the drillers or the tool pushers could not shut down the HVAC system to the engine rooms because they were presumably focusing efforts on controlling the well.

(G) BLOWOUT PREVENTER (BOP)The failure of the BOP to isolate wellbore before and after the explosion and fire is a critical factor in the Macondo accident.It was observed that the BOP emergency mode did not seal the well. The BOP is an important barrier which helps in preventing hydrocarbon ingress into the riser.Inability of the annular preventer to seal the annulus could be attributed to some factors which included – insufficient hydraulic pressure resulting from rig crew action to initiate the closure of multiple BOP function in rapid succession, placing an excessive demand on the hydraulic power supply system. The loss of electrical power, communication and hydraulic pressure following the explosion and fire, made is difficult to execute ESD.The automatic mode function of the BOP also failed due to faults that would have been corrected or discovered if effective maintenance of the BOP is done regularly.The BOP is important equipment in the offshore industry and therefore its maintenance should be careful monitored to make sure that all is done according to specifications. Risk assessment of some critical equipment like the BOP should be done and necessary actions taken to prevent similar situation from happening.

20

Chapter 5Major Accident Risk Management Lessons Learnt and Conclusion

5.1 LESSONS FROM PIPER ALPHA ACCIDENTThe Major accident risk management lesson learnt from both cases will allow a better assessment of the risk involved before other accidents occur. The Pipa accident has led to understanding of different factors such Human failure, operational failure and technical errors (e.g. work to permit failure, control sysyem, poor communication, organizational error etc) discussed earlier that led to the two tragedy. For Pipera. The Oil fire was not available when needed due to the fact that it was switched to manual mode.b. Permit to work system failed as a barrier.c. The barrier function designed to maintain integrity of the process system failed.d. Barrier function designed to prevent ignition failed.e. The function designed to reduce cloud and spill size failed as a barrierf. The function designed to prevent to escalation failed as a barrier.g. The function designed to prevent facilities failed as a barrier.

Secondly, it has also contributed to updating the probabilities of the different element of the actual failure mode that occurred.From risk management point of view, the severity of the accident is such that it cannot be ignored by oil and gas companies worldwide and certainly number of control measure will be implemented based on these in other platforms to prevent reoccurrence.Also, it is are generable to many other industries and other industrial processes , denial of the risk ,unrecognized (and unnecessary ) coupling in the design ,insufficient redundancies in the safety systems, difficulty in managing tradeoff between productivity and safety and tendency to stretch maintenance operations when production increase are all problems common to many industrial facilities.

5.2 LESSONS FROM MACONDO ACCIDENTThere are lots of lessons learnt following the Deepwater Horizon accidentThe BP investigation team has given many recommendations based on their findings. The lessons learnt from the accident could help in preventing similar accident in the future. From our evaluation of the report, some of the lessons learnt from the Macondo accident are as follows:

- There should be reduced reliance on manual/human intervention in activation of safety systems. This is because the reliability of the systems could be limited by the capability of individuals to respond in a stressed environment. This was the case in the Deepwater Horizon.

21

- An advanced deepwater control training program that supplements current industry and regulatory training.

- HAZOP review of surface gas and drilling fluid systems; this should also include surface system hydrocarbon vents, reviewing suitability of locations and design.

- There should be reduction in simultaneous operations which can affect monitoring of the well or affect any other sensitive process on an offshore or onshore installation.

- Risk assessment/analysis should be integrated in the design phase of complex offshore vessels or equipment and emphasis should be placed on the redundancy of safety critical components. In the Deepwater Horizon, the redundancies of the combustible gas detectors were probably overlooked.

- Success and failure criteria for any critical procedure/test should be clearly defined by the operator and/or the regulating bodies or the contractors.

- Finally, there should be effective communication between various stakeholders on any offshore or onshore facility. Also abnormal situations should not be overlooked; rather expert opinion should be sought always.

5.3OTHERSFormal Safety Assessment (FSA)This involves the identification and assessment of hazards over the whole life cycle of a project from the initial feasibility study through the concept design study and the detail design to construction and commissioning, then to operation, and finally decommissioning and abandonment .The Technique used include hazard operability (HAZOP) studies quantitative risk assessment (QRA); fault tree analysis; Human factor analysis; and safety audits. The need for FSA arises because the combination of potential hardware and human failures are so numerous that a major accident hardly ever repeats itself. A strategy for risk management therefore addresses the entire spectrum of possibilities.

5.4CONCLUSIONThe Piper Alpha and Deepwater Horizon/ Macon do accident may have happened; fatalities and injuries may have been recorded. The worst oil spill may have happened but the lessons learnt from the disaster will be of immense help in eliminating/mitigating similar hazard in future. It can however be concluded that;

“A complex and interlinked series of mechanical failures, human judgments, engineering design, operational implementation and team interactions came together to allow the initiation and escalation of the Deepwater Horizon accident. Multiple companies, work team and circumstances were involved over time.” (5)

In conclusion, the causes of both accidents can be categorized into three, namely Human failure, Technical failure and the Organizational failure. And the risk management lesson learnt from them can be adapted to future platforms to prevent recurrence of such incidents.The risk assessment of both cases can also be a good step towards improving and updating risk management models for similar platforms and other industrial plants. Such

22

models, in turn will allow assessment of the cost effective of the different safety measures that can be envisioned based on the two experiences.LIST OF FIGURES AND TABLE

FIGURE 1 - Bow – Tie for Piper AlphaFIGURE 2 - Illustration of Swiss cheese model of hazards analysis based on Deepwater Horizon reportFIGURE 3 – Bow-Tie Diagram For Macondo AccidentFIGURE 4 – Deepwater Horizon Mud Gas SeparatorTABLE 1 - CGDs on Deepwater Horizon

Reference (piper alpha)

1. 1 J.T. Stansfeld, The Safety Case (Lloyd’s Regis-ter Technical Association, Paper No 3, Session 1994–95), pp 4–7.

2. The Hon. Lord Cullen, The Public Inquiry into the Piper Alpha Disaster, Vols. 1 and 2 (Report to Parliament by the Secretary of State for Energy by Command of Her Majesty, November 1990).

3. 3. J. R. Petrie, “Piper Alpha Technical Investigation interim Re-port” (Department of Energy, b Petroleum Engineering Division, London England, 1988)

4. 4.http://marine.wartsila.com/Wartsila/global/docs/en/power/media_publications/energy_news/22/safety_issues.pdf

Reference (Macondo)5. .http://www.bp.com/liveassets/bp_internet/globalbp/globalbp_uk_english/

incident_response/STAGING/local_assets/downloads_pdfs/Deepwater_Horizon_Accident_Investigation_Report.pdf

6. http://environmentalgeographyblog.blogspot.com/2010/09/bp-oil-spill-content-of-accident.html

23