- Best Practices
- Safety Performance
Alexander L. Kielland capsize (North Sea, 1980)The semi-submersible "flotel" (floating hotel) Alexander L. Kielland capsized on 27 March 1980 while bridge connected to the steel jacket Ekofisk Edda platform. The flotel lost one of its five legs in severe gale force winds, but not an extreme storm.
The accident started with one of the bracings failing due to fatigue, thereby causing a succession of failures of all bracings attached to this leg. It was discovered during the investigation that the weld of an instrument connection on the bracing had contained cracks, which had probably been in existence since the rig was built. The cracks had developed over time, and the remaining steel was less than 50%. When the leg came loose, the rig almost immediately developed a severe listing.
Within 20 minutes of the initial failure it capsized completely, floating upside down with just the bottom of the columns visible in the sea.
Both the escape and evacuation operations were far from orderly and had only limited success. Only one lifeboat was in fact launched successfully, one was totally unavailable due to the listing, and others were smashed against the platform during launching in high waves. The final death toll was 123 fatalities and 89 survivors.
This accident was the first instance in the Norwegian offshore operations where an official commission of enquiry was appointed to investigate a severe offshore accident. Attention was mainly focused on the cause of the failure, but considerable attention was also paid to the evacuation and rescue operations that had revealed extensive shortcomings.
Ixtoc I Blowout (Gulf of Mexico, 1979)In 1979, the Sedco 135F was drilling the IXTOC I well for PEMEX (Petroleos Mexicanos), the state-owned Mexican petroleum company when the well suffered a blowout. The well had been drilled to 3657m with the 9-5/8" casing set at 3627m.
According to reports, mud circulation was lost, so the decision was made to pull the drill string and plug the well. Without the hydrostatic pressure of the mud column, oil and gas were able to flow unrestricted to the surface, which is what happened as the crew were working on the lower part of the drill string. The BOP was closed on the pipe but could not cut the thicker drill collars, allowing oil and gas to flow to surface where it ignited and engulfed the Sedco 135F in flames. The rig collapsed and sank onto the wellhead area on the seabed, littering the seabed with large debris such as the rig's derrick and 3000m of pipe.
The well was initially flowing at a rate of 30,000 barrels per day, which was reduced to around 10,000 bpd by attempts to plug the well. Two relief wells were drilled to relieve pressure and the well was eventually killed nine months later on 23 March 1980. Due to the massive contamination caused by the spill from the blowout (by 12 June, the oil slick measured 180km by 80km), nearly 500 aerial missions were flown, spraying dispersants over the water. Prevailing winds caused extensive damage along the US coast with the Texas coast suffering the greatest. The IXTOC I accident was the biggest single spill before the occurrence of Macondo accident, with an estimated 3.5 million barrels of oil released.
Piper Alpha Explosion (North Sea, 1988)With 167 fatalities Piper Alpha is the deadliest accident in the history of the offshore oil and gas industry. The Piper field is located about 120 miles north-east of Aberdeen and the platform initially produced crude oil, while in late 1980, gas conversion equipment was installed allowing the facility to produce gas as well as oil. A sub-sea pipeline, shared with the Claymore platform, connected Piper Alpha to the Flotta oil terminal on the Orkney Islands. Piper Alpha also had gas pipelines connecting it to both the Tartan platform and to the separate MCP-O1 gas processing platform. In total, Piper Alpha had four main transport risers: an oil export riser, the Claymore gas riser, the Tartan gas riser and the MCP-01 gas riser.
On 06 July 1988, work began on one of two condensate-injection pumps, designated A and B, which were used to compress gas on the platform prior to transport of the gas to Flotta. A pressure safety valve was removed from compressor A for recalibration and re-certification and two blind flanges were fitted onto the open pipework. The dayshift crew then finished for the day.
During the evening of 06 July, pump B tripped and the nightshift crew decided that pump A should be brought back into service. Once the pump was operational, gas condensate leaked from the two blind flanges and, at around 2200 hours, the gas ignited and exploded, causing fires and damage to other areas with the further release of gas and oil. Some twenty minutes later, the Tartan gas riser failed and a second major explosion occurred followed by widespread fire. Fifty minutes later, at around 2250 hours, the MCP-01 gas riser failed resulting in a third major explosion. Further explosions then ensued, followed by the eventual structural collapse of a significant proportion of the installation.
167 men died as a result of the explosions and fire on board the Piper Alpha, including two operators of a Fast Rescue Craft. 62 men survived, mostly by jumping into the sea from the high decks of the platform. The – about 100 – recommendations from the Inquiry practically re-shaped offshore safety legislation and practices.
A number of factors contributed to the severity of the incident:
- the breakdown of the chain of command and lack of any communication to the platform's crew;
- the presence of fire walls and the lack of blast walls - the fire walls predated the installation of the gas conversion equipment and were not upgraded to blast walls after the conversion;
- the continued pumping of gas and oil by the Tartan and Claymore platforms, which was not shut down due to a perceived lack of authority, even though personnel could see the Piper burning.
Ekofisk B Blowout (North Sea, 1977)This accident was North Sea's biggest oil spill. The Ekofisk Bravo blowout occurred on 22 April 1977 during a workover on the B-14 production well, when about 10,000 feet of production tubing was being pulled. The production christmas tree valve stack had been removed prior to the job and the BOP had not yet been installed. The well then kicked and an incorrectly installed downhole safety valve failed. This resulted in the well blowing out with an uncontrolled release of oil and gas. The personnel were evacuated without injury via lifeboats and were picked up by a supply vessel.
The initial flow was estimated at 28,000 bpd with a calculated total release of 202,380 bbls. Up to 30 to 40% of the oil was thought to have evaporated after its initial release and the Norwegian Petroleum Directorate reported a total spill estimate between 80,000 bbls and 126,000 bbls.
The well was capped after seven days on 30 April 1977. Rough seas and higher than average air temperatures aided the break-up of much of the oil. Later investigations reported no significant environmental damage and no shoreline pollution. There was also no significant damage reported to the platform.
The official inquiry into the blowout determined that human errors were the major factor which led to the mechanical failure of the safety valve. These errors included faults in the installation documentation and equipment identification and misjudgements, improper planning and improper well control. The blowout was significant because it was the first major North Sea oil spill. Also significant was that the ignition of the oil and gas was avoided and that there were no fatalities during the evacuation.
Adriatic IV Blowout (Mediterranean Sea, Egypt, 2004)On 10 August 2004, the Adriatic IV was on location over the Temsah gas production platform, off Port Said, Egypt in the Mediterranean. The rig was drilling a natural gas well when a gas blowout occurred during drilling ops. Reports state that there was an explosion followed by fire, which was initially contained on the jack-up. For reasons unknown, the fire then spread to the Petrobel-run platform where it continued to rage for over a week before being brought under control. More than 150 workers on the jack-up and platform were evacuated with no casualties, due in part to the prior recommendation that production activities be ceased as a precautionary measure. Global Santa Fe (GSF) reported the Adriatic IV as sunk and not salvageable. The platform, owned jointly by BP, Italy's ENI and Egypt's General Petroleum Corporation was damaged beyond repair and Egypt's petroleum minister ordered its destruction. Less than a year after the accident, production at the Temsah field was back on-stream at full production rates.
Montara Blowout (Timor Sea, Australia, 2009)This accident was the worst occurring in the offshore industrial sector in Australia and resulted in the third worst sea pollution in the Australian history. On 21 August 2009, during drilling operations at the Montara Wellhead Platform an uncontrolled release of oil and gas occurred from the H1 well. All 69 personnel at the Wellhead Platform were safely evacuated. On 1 November the leaking well was successfully intercepted, however during operations to complete the "well kill", fire broke out on the West Atlas rig and the Montara Wellhead Platform. On 3 November 2009, the fire was extinguished.
Located in the Timor Sea, the Montara Wellhead Platform is 254 kilometres northwest of the Western Australian coast and 685 kilometres from Darwin. The Montara Wellhead Platform is approximately 157 km from the Ashmore Reef National Nature Reserve & Cartier Island Marine Reserve. For a period of just over 10 weeks in fall 2009, oil and gas continued to flow unabated into the Timor Sea, and patches of sheen or weathered oil could have affected at various times an area as large as 90,000 square kilometres.
The source of the uncontrolled release (well blowout) is largely uncontested. It is clear that the cementing work to seal the well in April 2009 was not performed according to state-of-the-art practices followed in the petroleum industry, so when drilling operations restarted in August 2009 a blowout occurred. The Inquiry has determined that the most likely cause was that hydrocarbons entered the H1 Well through the 9 5/8" cemented casing shoe and flowed up inside of the 9 5/8" casing.
The Inquiry in determining what caused the uncontrolled release found that the primary well control barrier of the H1 well (9 5/8" cemented casing shoe) failed. The Inquiry further noted that the initial cementing problems were compounded by the fact that only one of the two secondary well control barriers – pressure containing anti-corrosion caps – was installed.
Macondo Blowout (Gulf of Mexico, 2010)On 20 April 2010, the Macondo well blew out, costing the lives of 11 men, the beginning of a catastrophe that sank the Deepwater Horizon drifting rig and spilled over 4 million barrels of crude oil into the Gulf of Mexico. The spill disrupted an entire region's economy, damaged fisheries and critical habitats, and brought vividly to light the risks of deepwater drilling oil and gas.
At approximately 9:45 p.m. CDT, on April 20, 2010, methane gas from the well, under high pressure, shot all the way up and out of the drill column, expanded onto the platform, and then ignited and exploded. Fire then engulfed the platform. Most of the workers escaped the rig by lifeboat and were subsequently evacuated by boat or airlifted by helicopter for medical treatment; however, eleven workers were never found despite a three-day Coast Guard search operation, and are believed to have died in the explosion. Efforts by multiple ships to douse the flames were unsuccessful.
After burning for approximately 36 hours, the Deepwater Horizon sank on the morning of 22 April 2010. The leak lasted for 87 days and resulted in an unprecedented environmental disaster.
The root technical cause of the blowout was that the cement that BP and Halliburton pumped to the bottom of the well did not seal off hydrocarbons in the formation. Factors that increased the risk of cement failure at Macondo include: First, drilling complications forced engineers to plan a "finesse" cement job that called for a low overall volume of cement. Second, the cement slurry itself was poorly designed and tested, while the temporary abandonment procedures, finalized only at the last minute, called for rig personnel to severely "underbalance" the well before installing any additional barriers to back up the cement job. The results of the negative pressure test conducted on April 20 and clearly showing that hydrocarbons were leaking into the well were misinterpreted by the well site leaders and Transocean personnel. Transocean and Sperry Drilling rig personnel then missed a number of further signals that hydrocarbons had entered the well and were rising to the surface during the final hour before the blowout actually occurred. By the time they recognized a blowout was occurring and activated the Blowout Preventer (BOP) it was too late for that device to prevent an explosion. Furthermore the preventer itself was inadequately designed (single blind shear ram, unable to cut through tool joints) and operating.
The underlying cause of the accident was a bad safety culture of the operator (BP) and its contractors (Transocean, Halliburton). The investigation reports (Commission Report to the President and Chief Counsel's Report) reveal a series of organisational and safety management failures that led to the accident. Amongst them we can stress:
Lack of adequate hazard identification – in particular addressing risks rising from the frontier conditions and from changes to well design and conditions
- Inadequate level of detail in procedures
- Lack to timely recognise and react to early warning signals
- Lack of communication
- Lack of clear leadership, especially lack of a culture of leadership responsibility
- Lack of the ability to learn lessons from other accidents and recent near-misses.
- Lack of appropriate training of personnel, especially in reacting to emergency situations.
- The need to separate leasing from safety oversight regulatory functions
- The need for a shift towards a risk-based performance approach, similar to the "safety-case" approach used in the North Sea
- The need of authorisation, review and approval of the safety case, as well as performance of inspections
- The need for improved international safety standards
- The need for increased transparency, reporting of incidents and near-misses for the purpose of lessons learning.
- The need for increased capabilities and better planning for emergency response.