Gulf Coast Oil Spill Investigation Report

STATEMENT OF
MICHAEL R. BROMWICH
DIRECTOR
BUREAU OF SAFETY AND ENVIRONMENTAL ENFORCEMENT,
UNITED STATES DEPARTMENT OF THE INTERIOR
BEFORE THE
HOUSE COMMITTEE ON NATURAL RESOURCES
FULL COMMITTEE OVERSIGHT HEARING ON THE "BOEMRE/U.S. COAST GUARD JOINT INVESTIGATION TEAM REPORT"

October 13, 2011

Mr. Chairman and members of the Committee,

I very much appreciate the opportunity to be here today to testify about the findings of the Bureau of Ocean Energy Management, Regulation and Enforcement (BOEMRE) and the U.S. Coast Guard's joint investigation into the explosions and fire onboard the Deepwater Horizon. As you know, the explosions and fire led to multiple deaths, serious injuries, and the release of an estimated 4.9 million barrels of oil into the Gulf of Mexico. I will summarize the findings, conclusions, and recommendations of the BOEMRE panel of investigators ("the Panel") who served on the BOEMRE-USCG Joint Investigation Team (JIT). I want to note that this report validates many of the important reforms to offshore regulation and oversight that we have already implemented in the wake of Deepwater Horizon, but it also underscores the need for government and industry to continue to identify, adopt, and implement practices that will ensure that domestic oil and gas production proceeds safely and responsibly.

Introduction
At approximately 9:50 p.m. on the evening of April 20, 2010, as the crew of the Deepwater Horizon rig was finishing its work on the Macondo exploratory well, an undetected influx of hydrocarbons into the well (commonly referred to as a "kick") escalated to a blowout. Hydrocarbons flowed onto the rig floor through a mud gas vent line and ignited in two separate explosions. A fire began on the rig and the flowing hydrocarbons continued to fuel the fire on the rig, which continued to burn until it sank on April 22. Eleven men died on the Deepwater Horizon, many more were injured, and over the next 87 days, almost five million barrels of oil flowed into the Gulf of Mexico.

The JIT was formed on April 27, 2010 by a convening order of the Departments of the Interior and Homeland Security to investigate the causes of the Deepwater Horizon explosion, loss of life, and resulting oil spill, and to make recommendations for safe operations of future oil and gas activities on the U.S. Outer Continental Shelf (OCS). The JIT held seven sessions of public hearings, received testimony from more than 80
witnesses and experts, and reviewed a large number of documents and exhibits pertaining to all aspects of the investigation. Evidence-gathering included the salvage of the blowout preventer (BOP) stack and portions of the drill pipe and riser.

The final report includes two volumes: Volume I includes findings on five aspects of the disaster under Coast Guard jurisdiction – and I will defer to my colleague, Admiral Salerno, to explain this content. My testimony today will focus on Volume II of the report, which details the findings of the BOEMRE panel regarding the causes of the Macondo well blowout and the resulting explosion and fire aboard the Deepwater Horizon. Based on the evidence it collected and analyzed, the Panel concluded that BP, Transocean and Halliburton's conduct in connection with the Deepwater Horizon disaster violated a number of BOEMRE's offshore safety regulations. The Panel has also developed recommendations for the continued improvement of the safety of offshore operations.
Before I go on, I'd like to recognize the massive effort by members of my staff and the Coast Guard that went into this investigation and the issuance of this report. They conducted a thorough investigation, and we have published a report that will be a lasting legacy to their tireless efforts.

Findings of the BOEMRE Panel
The Panel identified the causes of the blowout as well as various failures that occurred before and on April 20, 2010. It concluded that the central cause of the blowout was failure of a cement barrier in the production casing string, a high-strength steel pipe set in a well to ensure well integrity and to allow future production. The Panel's findings, conclusions, and recommendations address a full range of issues, including well design; cementing; possible hydrocarbon flow paths during the blowout; temporary abandonment of the Macondo well; kick detection and rig response; ignition source and explosion; the failure of the Deepwater Horizon blowout preventer to arrest the blowout; regulatory findings and conclusions; and company practices.
The loss of life at the Macondo well on April 20, 2010, and the subsequent pollution of the Gulf of Mexico through the summer of 2010 were, in part, the result of poor risk management, last minute changes to plans, failure to observe and respond to critical indicators, inadequate well control response, and inadequate emergency response training by companies and individuals responsible for drilling at the Macondo well and for the operation of the Deepwater Horizon.

Well design, cementing, and flow path
At the time of the blowout, the rig crew was engaged in temporary abandonment procedures designed to secure the well after drilling had ceased and before the Deepwater Horizon left the site. In the days leading up to April 20, BP made a series of decisions that complicated cementing operations, added incremental risk, and may have contributed to the ultimate failure of the cement job. These decisions included:

• the point at which they decided to stop drilling;
• the decision to only have one cement barrier in the well during temporary abandonment operations;
• the decision to set a lock-down sleeve; and
• the decision to use certain material as "spacer" (fluid between the drilling mud and the water).
BP failed to communicate these decisions and the increasing operational risks to Transocean. As a result, BP and Transocean personnel onboard the Deepwater Horizon on the evening of April 20, 2010, did not fully identify and evaluate the risks inherent in the operations that were being conducted at Macondo.
As mentioned above, the Panel found that a central cause of the blowout was failure of the cement barrier in the production casing string. The failure of the cement barrier allowed hydrocarbons to flow up the wellbore, through the riser and onto the rig. This is the immediate cause of the blowout. The precise reasons for the failure of the production casing cement job are not known. The Panel concluded that the failure was likely due to:
• swapping of cement and drilling mud (referred to as "fluid inversion") in the shoe track (the section of casing near the bottom of the well);
• contamination of the shoe track cement; or
• pumping the cement past the target location in the well, leaving the shoe track with little or no cement (referred to as "over displacement").

Notably, BP and Halliburton failed to perform the production casing cement job in accordance with industry-accepted recommendations, as defined in the American Petroleum Institute's Recommended Practice 65.
The cement failure allowed the flow of hydrocarbons through the riser and onto the rig. The Panel identified three possible paths by which hydrocarbons could have flowed up the well to the rig during the initial stage of the blowout: (1) up the production casing annulus cement barrier and upward through the annulus and the wellhead seal assembly; (2) up the production casing and related components from above the top wiper plug located on the float collar at 18,115 feet; or (3) up the last 189 feet of the production casing (the shoe track). The Panel concluded that the hydrocarbons flowed through the shoe track and up through the riser to the rig.
Problems at the Macondo well: temporary abandonment, kick detection, and emergency response

BP and Transocean encountered a number of problems during drilling and temporary abandonment operations at the Macondo well – including kicks, stuck pipe, lost returns of drilling fluids, equipment leaks, cost overruns, well scheduling and logistical issues, personnel changes and conflicts, and last minute procedure changes. These problems led rig personnel and others to refer to Macondo as the "well from hell."

Even when faced with anomalous readings, data, and other indications, the rig crew failed to detect the flow of hydrocarbons until it was too late. On April 20, BP and Transocean personnel onboard the Deepwater Horizon missed the opportunity to remedy the cement problems when they misinterpreted anomalies encountered during a critical test of cement barriers called a negative test. The negative test attempts to simulate what will occur at the well after it is temporarily abandoned and to show whether barriers, such as the cement job, will hold against pressures from the reservoir .

The rig crew conducted an initial negative test on the production casing cement job that showed a pressure differential between the drill pipe and the kill line, which is a high pressure pipe leading from the BOP stack to the rig pumps. This was a serious anomaly that should have alerted the rig crew to potential problems with the cement barrier or with the negative test. After some discussion among members of the crew and a second negative test on the kill line, the rig crew explained the pressure differential away as a "bladder effect" (or annular compression), a theory that later proved to be unfounded. Around 7:45 p.m., after observing for 30 minutes that there was no flow from the kill line, the rig crew concluded that the negative test was successful. As a result, at that point, the rig crew most likely concluded that the production casing cement barrier was sound. At this point, rig crew members moved forward with temporary abandonment procedures, unaware of the failed cement job and the looming influx of hydrocarbons.

However, the cement in the shoe track barrier had in fact failed, and hydrocarbons began to flow from the reservoir into the well. Despite a number of additional anomalies that should have signaled the existence of a kick or well flow, the crew failed to detect that the Macondo well was flowing until 9:42 p.m. By then it was too late – the well was blowing drilling mud up into the derrick and onto the rig floor. If members of the rig crew had detected the hydrocarbon influx earlier, they might have been able to take appropriate actions to control the well.

Ignition source and the explosion
A number of additional missteps after the rig crew realized what was happening contributed to the explosion, fire, and the loss of life. On April 20, 2010, at around 9:40 p.m., powerful pressures from the well caused mud to flow up from the well. Drilling mud spilled on the rig floor as the well began to blow out. But instead of diverting the flow overboard, the crew responded to the situation by diverting the flow to the rig's mud gas separator, part of the diverter system to which the crew could direct fluids coming up from the well. The mud gas separator could not handle the volume of hydrocarbons; it failed and discharged a gas plume above the rig floor. The gas quickly ignited, causing the first explosion on the rig at 9:49 p.m. Approximately ten seconds later, a second larger explosion occurred and the fire onboard the rig spread rapidly. Shortly after the second explosion, the rig lost power and experienced a total blackout.

The Panel found evidence that the configuration of the Deepwater Horizon general alarm system and the actions of rig crew members on the bridge of the rig
contributed to a delay in notifying the entire crew of the presence of very high gas levels. A critical 12 minutes elapsed between the time that the high gas alarms sounded and the general alarm sounded. The general alarm was not configured to sound automatically when the high gas alarms were triggered. Transocean personnel do not appear to have been adequately trained for this type of situation – which required quick and decisive action. Quicker reactions might have saved lives.

Failure of the blowout preventer
As you know, the failure of the BOP stack to seal the well allowed the well to continue to flow after the blowout. The forensic examination of the BOP determined that the forces of the blowout caused the drill pipe to buckle and move to the side of the wellbore. As a result, although it was activated, the blind shear ram could not completely shear the drill pipe and seal the well. A gap in the wellbore resulted, which allowed continued flow of hydrocarbons through the riser to the rig.

The Deepwater Horizon's BOP stack, a massive, 360-ton device installed at the top of the well, was designed to allow the rig crew to handle numerous types of well control events. However, on April 20, the BOP stack failed to seal the well to contain the flow of hydrocarbons. The explosions likely damaged the Deepwater Horizon's multiplex cables and hydraulic lines, rendering the crew unable to activate the BOP stack. The BOP stack was equipped with an "automatic mode function," which upon activation would trigger the blind shear ram (BSR), two metal blocks with blades on the inside edges that are designed to cut through the drill pipe and seal the well during a well control event.

The Panel concluded that there were two possible ways in which the BSR might have been activated: (1) on April 20, by the automatic mode function, immediately following loss of communication with the rig; or (2) on April 22, when a remotely operated vehicle triggered the "autoshear" function, which is designed to close the BSR if the lower marine riser package disconnects from the rest of the BOP stack. Regardless of how the BSR was activated, it did not seal the well.

A forensic examination of the BOP stack revealed that elastic buckling of the drill pipe had forced the drill pipe up against the side of the wellbore and outside the cutting surface of the BSR blades. After buckling, the off-center drill pipe was not in a position that would allow the BSR to completely shear the drill pipe and seal the well. The buckling of the drill pipe, which likely occurred at or near the time when control of the well was lost, was caused by the force of the hydrocarbons blowing out of the well; by the weight of the 5,000 feet of drill pipe located in the riser above the BOP forcing the drill pipe down into the BOP stack; or by a combination of both. As a result of the failure of the BSR to completely cut the drill pipe and seal the well, hydrocarbons continued to flow after the blowout.

Regulatory findings and conclusions
The JIT found that BP, as well as its contractors Transocean and Halliburton, violated BOEMRE's regulations. BOEMRE has the authority to cite all companies conducting activity on the OCS relating to lease activities for regulatory violations, including contractors. Here, there is clear and compelling evidence that Transocean and Halliburton (BP contractors) violated a number of BOEMRE regulations – and those violations obviously had dire consequences. We believe the issuance of citations for such regulatory violations upholds the principles of accountability, specific deterrence, and general deterrence.

The JIT found ample evidence that the companies committed the following violations:

• 30 CFR § 250.107 – BP failed to protect health, safety, property, and the environment by (1) performing all operations in a safe and workmanlike manner; and (2) maintaining all equipment and work areas in a safe condition;
• 30 CFR § 250.300 – BP, Transocean, and Halliburton (Sperry Sun) failed to take measures to prevent the unauthorized release of hydrocarbons into the Gulf of Mexico and created conditions that posed unreasonable risk to public health, life, property, aquatic life, wildlife, recreation, navigation, commercial fishing, or other uses of the ocean;
• 30 CFR § 250.401 – BP, Transocean, and Halliburton (Sperry Sun) failed to take necessary precautions to keep the well under control at all times;
• 30 CFR § 250.420(a)(1) and (2) – BP and Halliburton failed to cement the well in a manner that would properly control formation pressures and fluids and prevent the release of fluids from any stratum through the wellbore into offshore waters;
• 30 CFR § 250.427(a) – BP failed to use pressure integrity test and related hole-behavior observations, such as pore pressure test results, gas-cut drilling fluid, and well kicks to adjust the drilling fluid program and the setting depth of the next casing string;
• 30 CFR § 250.446(a) – BP and Transocean failed to conduct major inspections of all BOP stack components; and
• 30 CFR § 250.1721(a) – BP failed to perform the negative test procedures detailed in an application for a permit to modify its plans.

Company practices
BP, as the designated operator under BOEMRE regulations, was ultimately responsible for conducting operations at Macondo in a way that ensured the safety and protection of personnel, equipment, natural resources, and the environment. Transocean, the owner of the Deepwater Horizon, was responsible for conducting safe operations and for protecting personnel onboard. Halliburton, as a contractor to BP, was responsible for
conducting the cement job, and, through its subsidiary Sperry Sun, had certain responsibilities for monitoring the well. Cameron was responsible for the design of the Deepwater Horizon BOP stack.

Prior to the events of April 20, BP and Transocean experienced a number of problems while conducting drilling and temporary abandonment operations at Macondo, which reflect shortcomings in company practices in areas including worker training, adherence to schedules and budgets, and management of personnel changes and conflicts. These problems included:

• Recurring well control events and delayed kick detection. At least three different well control events and multiple kicks occurred during operations at Macondo. On March 8, it took the rig crew at least 30 minutes to detect a kick in the well. The delay raised concerns among BP personnel about the Deepwater Horizon crew's ability to promptly detect kicks and take appropriate well control actions. Despite these prior problems, BP did not take steps to ensure that the rig crew was better equipped to detect kicks and to handle well control events. As of April 20, Transocean had not completed its investigation into the March 8 incident.
• Scheduling conflicts and cost overruns. At the time of the blowout, operations at Macondo were significantly behind schedule. BP initially planned for the Deepwater Horizon to move to BP's Nile well by March 8, 2010. In large part as a result of this delay, as of April 20, BP's Macondo operations were more than $58 million over budget.
• Personnel changes and conflicts. BP experienced a number of problems involving personnel with responsibility for operations at Macondo. A recent reorganization changed the roles and responsibilities of at least nine individuals with some responsibility for Macondo operations. In addition, the Panel found evidence of conflicts between the BP drilling and completions operations manager and the BP wells team leader, as well as a failure to adequately delineate roles and responsibilities for key decisions.

At the time of the blowout, both BP and Transocean had extensive internal procedures in place regarding safe drilling operations – but evidence collected by the Panel shows gaps in compliance with those procedures. BP required that its drilling and completions personnel follow a "documented and auditable risk management process." The Panel found no evidence that the BP Macondo team fully evaluated ongoing operational risks, nor did it find evidence that BP communicated with the Transocean rig crew about such risks.

Transocean had a number of documented safety programs in place at the time of the blowout. Nonetheless, the Panel found evidence that Transocean personnel themselves questioned whether the Deepwater Horizon crew was adequately prepared to independently identify hazards associated with drilling and other operations. Everyone
on board the Deepwater Horizon was obligated to follow the Transocean "stop work" policy that was in place on April 20, which provided that "[e]ach employee has the obligation to interrupt an operation to prevent an incident from occurring." Despite the fact that the Panel identified a number of reasons that the rig crew could have invoked stop work authority, no individual on the Deepwater Horizon did so on April 20.

Recommendations
The Panel found no evidence that Minerals Management Service (MMS) regulations in effect on April 20, 2010 were a cause of the blowout. Even so, the Panel concluded that stronger and more comprehensive federal regulations might have reduced the likelihood of the Macondo blowout. In particular, the Panel found that MMS regulations in place at the time of the blowout could be enhanced in a number of areas, including: cementing procedures and testing; BOP configuration and testing; well integrity testing; and other drilling operations. In addition, the Panel found that there were a number of ways in which the MMS drilling inspections program could be improved. For example, the Panel concluded that drilling inspections should evaluate emergency disconnect systems and other BOP stack secondary system functions. As discussed below, BOEMRE – which replaced MMS in June 2010 – has already implemented many improvements to safety standards for offshore operations.

The Report concludes with the Panel's recommendations, which seek to improve the safety of offshore drilling operations in a variety of different ways:

• Well design. Improved well design techniques for wells with high flow potential, including increasing the use of mechanical and cement barriers, will decrease the chances of a blowout.
• Well integrity testing. Better well integrity test practices (e.g., negative test practices) will allow rig crews to identify possible well control problems in a timely manner.
• Kick detection and response. The use of more accurate kick detection devices and other technological improvements will help to ensure that rig crews can detect kicks early and maintain well control. Better training also will allow rig crews to identify situations where hydrocarbons should be diverted overboard.
• Rig engine configuration (air intake locations). Assessment and testing of safety devices, particularly on rigs where air intake locations create possible ignition sources, may decrease the likelihood of explosions and fatalities in the event of a blowout.
• Blowout preventers. Improvements in BOP stack configuration, operation, and testing will allow rig crews to be better able to handle well control events.
• Remotely operated vehicles (ROVs). Standardization of ROV intervention panels and intervention capabilities will allow for improved response during a blowout.
Based on the investigation, the JIT recommended specific regulatory changes, including:
• Making certain specific cementing requirements included in industry recommended practices mandatory – for example, prescribing a minimum hole diameter of 3.0 inches greater than the casing outer diameter; rathole mud density greater than cement; and mud conditioning volume greater than one annular volume.
• Regulations that require at least two barriers (one mechanical and one cement barrier) for a well that is undergoing temporary abandonment procedures.
• Revision of the incident reporting rule at 30 CFR § 250.188 to capture well kick incidents, similar to the March 8, 2010, Macondo well control event. Under current regulations, operators are only required to report "losses of well control" and are not required to report "well control" events such as kicks. The reporting of these events would allow the Agency to track well control events and kicks and evaluate trends that may indicate problems with a specific operator or contractor.
• Specific requirements for well monitoring and kick detection training.

Regulatory Reform

The JIT's findings reinforce and build upon many of the safety and oversight gaps that had already been identified, and significantly improved upon, since the Deepwater Horizon tragedy.
Recent reforms

In the immediate aftermath of the spill, BOEMRE recognized that existing regulations had not kept up with the advancements in technology used in deepwater drilling. In response, we quickly issued new, rigorous prescriptive regulations that bolstered offshore drilling safety. We also ratcheted up our efforts to evaluate and mitigate environmental risks. We introduced – for the first time – performance-based workplace safety standards similar to those used by regulators in the North Sea, to make operators responsible for identifying and minimizing the risks associated with drilling operations. We did this through the development and implementation of two new rules that raised standards for the oil and gas industry's operations on the OCS.

The Drilling Safety rule created tough new standards for well design, casing and cementing – and well control procedures and equipment, including blowout preventers. This rule requires operators to have a professional engineer certify the adequacy of the proposed drilling program. In addition, the new Drilling Safety rule requires an engineer to certify that the blowout preventer to be used in a drilling operation meets new standards for testing, maintenance and performance.

The second rule was our Workplace Safety rule, which requires operators to systematically identify risks and establish barriers to those risks in order to reduce the human and organizational errors that cause many accidents and oil spills. Under the rule, operators must develop a comprehensive Safety and Environmental Management Systems (SEMS) program that identifies the potential hazards and risk-reduction strategies for all phases of activity, from well design and construction through the decommissioning of platforms. Many companies had developed such SEMS systems on a voluntary basis in the past, but many had not. Because the rule required substantial work by many operators, we delayed enforcement of the rule for a year. Starting in November, we will begin to enforce compliance. Based on my discussions with our own personnel who have been gearing up to ensure compliance with the SEMS rule, and my meetings with individual operators, I am confident that the vast majority of operators will be ready with their SEMS programs by that date.

Just last week, we proposed a follow-up rule that further advances the purposes of the SEMS rule. It addresses additional safety concerns not covered by the original rule and applies to all oil and natural gas activities and facilities on the OCS. The proposed SEMS II rule includes procedures that authorize any employee on a facility to cause the stoppage of work – frequently called Stop Work Authority – in the face of an activity or event that poses a threat to an individual, to property or to the environment. As discussed earlier, the failure of the rig crew to stop work on the Deepwater Horizon after encountering multiple hazards and warnings was a contributing cause of the Macondo blowout. The proposed rule also establishes requirements relating to the clear delineation of who possesses ultimate authority on each facility for operational safety; establishes guidelines for reporting unsafe work conditions that give all employees the right to report a possible safety or environmental violation and to request a BOEMRE investigation of the facility; and requires third-party, independent audits of operators SEMS programs. We look forward to receiving public comments on the proposed rule, and our process of finalizing the rule will include a close review of the JIT's recommendations on regulatory reforms.

In addition to these important new rules, we have issued Notices to Lessees (or NTLs) that provide additional guidance to operators on complying with existing regulations. Last summer, we issued NTL-06, which outlines the information that must be provided in an operator's oil spill response plan, including a well-specific blowout scenario, aworst-case discharge scenario, and the assumptions and calculations behind these scenarios. Our engineers and geologists then independently verify these worst case discharge calculations to ensure that we have an accurate picture of the spill potential of each well.

We also issued NTL-10, a document that outlines additional informational requirements, including a mandatory corporate statement from the operator that it will conduct drilling operations in compliance with all applicable agency regulations, including the new Drilling Safety Rule. The NTL also confirms that BOEMRE will be conducting well-by-well evaluations of whether the operator has demonstrated that it has access to, and can deploy, subsea containment resources that would be sufficient to promptly respond to a deepwater blowout or other loss of well control.

Thus, operators must now have a plan – in advance – to shut in a deepwater blowout and capture oil flowing from a wild well. They must have a plan, they must have access to the equipment, and they must have arrangements – contractual or otherwise – that show their ability to make use of that equipment. Rather than improvising a containment response on the fly – with hits and misses – each operator needs to work through its containment plan in advance, and we have to approve its plan.

Moving forward
Our reforms since the Deepwater Horizon tragedy have been broad and swift, and themselves made deepwater drilling significantly safer. However, the JIT report is a sobering reminder that there remains more to be done. We must continue to analyze information that becomes available – including the findings and recommendations of the JIT's investigation – and to implement reforms necessary to make offshore oil and gas production safer, smarter and with stronger protections for workers and the environment. The process of making offshore energy development both safe and sufficient to help meet the nation's and world's energy demands will never be complete, and so it must be a continuing, ongoing, dynamic enterprise that remains responsive to new learning.

In the near future, we expect to make available for public comment additional proposals that will further enhance drilling safety and environmental protection. In order to ensure that we incorporate the very best ideas and best practices of the offshore industry and other interested stakeholders in offshore exploration, development and production – including the environmental community – we will proceed through a notice and comment rulemaking process that will begin with an Advance Notice of Proposed Rulemaking (ANPRM). It is our hope and expectation that at the end of this process, we will develop consensus proposals that will significantly enhance safety and environmental protection. While we have been anticipating the ANPRM for the past year, we thought that it was important to initiate the process after the release of the JIT's report, in order to ensure that commenters would be in a position to benefit from their insights.

As we evaluate the lessons learned from the JIT and move towards a sound and sensible rulemaking process, I believe that industry is uniquely poised to assess findings and test creative solutions. To that end, I hope that companies will take a hard look at this report, as well as other recent investigations, both to understand what went wrong,
and to think about what they can do to go above and beyond existing requirements, enhance safety, and ultimately help us to identify best practices that could be adopted across industry.

Thank you and I look forward to your questions.