U.S. C H E M I C AL S A F E T Y A N D H A Z A R D I N V E S T I G A T I O N B O A R D

INVESTIGATION REPORT EXECUTIVE SUMMARY DRILLING RIG EXPLOSION AND FIRE AT THE MACONDO WELL (11 Fatalities, 17 Injured, and Serious Environmental Damage)

DEEPWATER HORIZON RIG MISSISSIPPI CANYON 252, GULF OF MEXICO APRIL 20, 2010

REPORT NO. 2010-10-I-OS 04/12/2016

[This page left intentionally blank.]

Dedication

The CSB dedicates this report to the eleven men who lost their lives in the explosion and fire at the Macondo well on April 20, 2010. Jason Anderson Aaron Dale Burkeen Donald Clark Stephen Ray Curtis Gordon Jones Roy Wyatt Kemp Karl Kleppinger, Jr. Keith Blair Manuel Dewey A. Revette Shane M. Roshto Adam Weise

[This page left intentionally blank.]

Contents DEDICATION .............................................................................................................................................. 3

INCIDENT REVIEW ................................................................................................................................... 6 New Lessons ................................................................................................................................................. 7 Report Structure ............................................................................................................................................ 9 Investigative Approach ............................................................................................................................... 10 Investigative Challenges ............................................................................................................................. 11 Key Investigative Findings and Conclusions .............................................................................................. 12 Technical Factors ........................................................................................................................... 12 Human and Organizational Factors ............................................................................................... 13 Regulatory Factors ......................................................................................................................... 17 Recommendations Summary ...................................................................................................................... 22

Incident Review

On April 20, 2010, a multiple-fatality incident occurred at the Macondo oil well approximately 50 miles off the coast of Louisiana in the Gulf of Mexico during temporary well-abandonment activities on the Deepwater Horizon (DWH) drilling rig. Control of the well was lost, resulting in a blowout—the uncontrolled release of oil and gas (hydrocarbons) from the well. On the rig, the hydrocarbons found an ignition source and ignited. The resulting explosions and fire led to the deaths of 11 individuals, serious physical injuries to 17 others, 1 the evacuation of 115 individuals from the rig, the sinking of the Deepwater Horizon, and massive marine and coastal damage from a reported 4 million barrels of released hydrocarbons. 2 BP was the main operator/lease holder responsible for the well design, and Transocean was the drilling contractor that owned and operated the DWH. On the day of the incident, the crew was completing temporary abandonment of the well so that it could be left in a safe condition until a production facility could return later to extract oil and gas from it.

Abandonment activities would essentially plug the well. Earlier, a critical cement barrier intended to keep the hydrocarbons below the seafloor had not been effectively installed at the bottom of the well. BP and Transocean personnel misinterpreted a test 3 to assess cement barrier integrity, leading them to erroneously believe that the hydrocarbon bearing zone at the bottom of the well had been sealed. When the crew removed drilling mud 4 from the well in preparation to install an additional cement barrier, the open blowout preventer (BOP) 5 was the only physical barrier that could have potentially prevented hydrocarbons from reaching the rig and surrounding environment. The ability of the BOP to act as this barrier was contingent primarily upon human detection of the kick and timely activation and closure of the BOP. Removing drilling mud after the test allowed hydrocarbons to flow past the failed cement barrier toward the DWH. The hydrocarbons continued to flow from the reservoir for almost an hour without human detection or the activation of the automated controls to close the BOP. Eventually, oil and gas passed

1 The injury numbers presented here match those reported to the US Coast Guard as required by 33 C.F.R. § 146.30 on form CG-2692 Report of Marine Accident, Injury or Death. The 17 physical injuries represented here reflect the individuals that received immediate hospitalization as a result of the incident. The actual number of injured from the Macondo incident is somewhat ambiguous, as a number of additional individuals sought medical treatments in the weeks following the blowout. In December 2014, Transocean noted 63 bodily injury claims pending in the state and federal courts in Louisiana and Texas. [Form 10-K Annual Report, 2014, pp 100, http://phx.corporate- ir.net/External.File?item=UGFyZW50SUQ9NTcxMDc3fENoaWxkSUQ9MjcyMzk1fFR5cGU9MQ==&t=1 (accessed March 26, 2016)] 2 In re: Oil Spill by the Oil Rig “Deepwater Horizon” in the Gulf of Mexico, on April 20, 2010, 77 F. Supp. 3d 500, 525 (E.D. La. 2015). 3 A negative pressure test simulates the conditions that will be present in the well once it is abandoned. It is completed by displacing some of the drilling mud from the well and closing the BOP to isolate the bottom of the well from the pressure exerted by the fluids above the BOP. 4 Drilling mud acts as a primary barrier to control a well by pushing back against oil and gas from the well, thus preventing the hydrocarbons from entering the wellbore (or hole). Located at the sea floor, a BOP has multiple rubber components that a crew can close to seal the well.

above the BOP and forcefully released onto the rig. In response, the well operations crew manually closed the BOP. Oil and gas that had already flowed past the BOP continued to gush onto the rig, igniting and exploding. The explosion likely activated an automatic emergency response system designed to shear drillpipe passing through the BOP and seal the well, but it was unsuccessful. The Macondo blowout has illuminated the potential severity of consequences from a single offshore incident and has served as a catalyst for examining major accident risk management in the offshore drilling industry.

New Lessons The Macondo blowout was the subject of multiple official investigations and perspectives, including those by the National Commission, National Academy of Engineering, Department of Interior, Joint Investigation Team (US Coast Guard and Bureau of the Ocean Energy Management), Deepwater Horizon Study Group, BP, and Transocean. But the potential legal implications from the severity of the Macondo blowout limited the flow of information from BP and Transocean, both to the public and the entities investigating the incident. This became apparent as new documents and depositions controlled by the US District Court for the Eastern District of Louisiana were released under the Multi-District Litigation (MDL) docket and when Transocean complied with the CSB’s own subpoena requests years after they were originally submitted to the company. 6 Consequently, previous investigation reports represent insight limited by the information available at the time. For example, the major investigation reports, except Transocean’s, either were published before BOP testing was completed or did not have access to the full set of post-incident BOP data (Figure 1). Details that emerged in the final phase of BOP testing are imperative, as they reveal latent failures in the Deepwater Horizon BOP before it was deployed to the wellhead. Also, the 2013 MDL and Transocean records shed light on the operator/drilling contractor relationship between BP and Transocean as influenced by US offshore regulations. This relationship ultimately led to vaguely established safety roles and responsibilities that affected human performance and major accident risk management at Macondo. Finally, a 2016 trial provided testimony from rig personnel who previously evoked the Fifth Amendment right, revealing additional insights into the decisions and actions of the well operations crew leading up to the blowout.

Release of the MDL documents and Transocean’s compliance with the CSB subpoenas both began in 2013.

Figure 1. Timeline portraying the release of significant data, documents, and interviews in relation to the publication date of various Macondo investigation reports.

The CSB builds on previously published investigation reports by analyzing evidence that, in some respects, became available only following their publication, offering technical, human, organizational, and regulatory perspectives beyond those of previous reports. In effect, the CSB Macondo investigation identifies several safety gaps and noteworthy lessons: • Testing limitations masked latent failures of the Deepwater Horizon BOP, affecting its operation on the day of the incident, and these latent failures will continue to exist for similarly designed blowout preventers unless modifications are made to current standard industry testing protocols (Volume 2). • Pressure conditions in a well can cause drillpipe to buckle (or bend) in a BOP even after a crew has initially sealed a well, potentially incapacitating emergency functions of the BOP intended to cut drillpipe and seal the well (Volume 2). • Industry is challenged to effectively assess the human performance expectations and human factors implications of the barriers and safety systems meant to control or mitigate the hazards of safety-critical well operations (Volume 3). • Cognitive and social skills training, in conjunction with technical competencies, can be valuable for combating cognitive biases and other mental traps that may influence decision-making within complex systems (Volume 3). • Gaps between work-as-imagined by well designers, managers, or regulatory authorities and work- as-done by the well operations crew must be continually identified, managed, and minimized by building a resilient process that can sustain desirable operations during both expected and unexpected conditions (Volume 3).

• Obstacles continue to exist that limit sharing of lessons from incident investigations in individual companies and across both the operator/drilling contractor boundary and international geographical regions (Volume 3). • An equal focus and effort to collect, measure, and improve process safety performance indicators to that currently dedicated to personal safety statistics is necessary to reduce the potential for a major accident event (Volume 3). • Corporate board of directors’ oversight, shareholder activism, and US Securities and Exchange Commission (SEC) reporting requirements have the potential to influence an organization’s focus on major accident risk (Volume 3). • Incongruities among proclaimed values, actual practices, and unstated basic assumptions within an organization’s culture impacts its focus on safety, necessitating efforts to effectively assess, monitor and modify all three cultural components for safety change to occur (Volume 3). • Complexities of multi-party risk management between an operator and drilling contractor in the US offshore industry necessitate more explicit and established safety roles and responsibilities, as well as oversight (Volumes 3 and 4). • Several inadequate or missing regulatory attributes, if implemented within the US offshore regime, would put more onus on industry for managing major hazards and further empower proactive regulatory oversight and capacity (Volume 4). • Post-Macondo industry and regulatory gaps in managing safety-critical elements, human factors, process safety indicators, corporate governance, workforce engagement, and major accident risk management and oversight need to be filled (Volumes 2, 3, and 4).

Report Structure The CSB investigation of the Macondo incident covers technical, organizational, and regulatory factors that contributed to the April 20, 2010, event. Due to the span of issues examined, the report is divided into four volumes. Volume 1 recounts a summary of events leading up to the Macondo explosions and fire on the rig pertinent to the CSB’s incident analysis and provides descriptive information on drilling and well completion activities. Volume 2 explores several technical findings related to the functioning of BOP, a subsea system that was intended to mitigate or prevent a loss of well control. This volume examines the failures of the BOP as a safety-critical piece of equipment and explores deficiencies in the management systems meant to ensure that the BOP was reliable and available as a barrier on April 20. The CSB presents a technical examination of the BOP to discuss (1) key findings in functionality, availability, and reliability of the BOP as a well control device and safety-critical barrier and (2) gaps in the post-Macondo US regulations and good practice guidance. The CSB concludes that the functioning of the BOP is emblematic of an inadequate framework for managing safety critical elements in the US offshore sector. The Agency explores how other global offshore regions manage and regulate safety-critical elements to illustrate ways in which the US can further advance offshore safety.

Volume 3 explores human and organizational factors associated with the incident, including aspects of the decision-making by the well operations crew leading up to the blowout and subsequent explosions. This examination emphasizes the complexity and implications for process safety management because of the heavy reliance on people both directly and indirectly for barrier effectiveness. It presents both challenges and opportunities for managing these realities. A review of several previous Transocean incident investigations demonstrates restricted transmission of lessons learned globally, both intercompany and intracompany to raise awareness of needed industrywide information sharing improvements. Volume 3 then reviews process safety indicators, highlighting the need for (1) improved industry guidance for performance metrics of barriers and safety systems and (2) active monitoring of real-time barrier indicators meant to drive daily decisions and actions as well as slow moving management system indicators that require longer timescales for identifying trends. Furthermore, the challenges of managing risk in a multi-party work environment are discussed to demonstrate how the complexity of the operator- contractor relationship in the offshore industry can lead to vaguely defined safety roles for both parties if they do not explicitly define their responsibilities. While BP and Transocean had corporate polices for risk management and risk reduction, neither assumed effective responsibility for ensuring their implementation at Macondo. The volume also addresses stratetiges for ensuring boards of directors remain focused on potential major accident events by examining corporate governance good practice, as well as the influence shareholders, SEC reporting requirements, and the regulator might apply. These and other issues create the foundation for examining BP’s and Transocean’s safety cultures, which were negatively impacted by an insufficient focus on process safety. Volume 4 delves into the role of the safety regulator in overseeing offshore oil and gas activities. It discusses some of the deficiencies that existed at the time of the event, as well as the remaining challenges that exist today. The volume identifies key attributes of goal-setting, risk-reduction regulatory regimes around the world and discusses the limitations of the current US offshore regulatory system. Recommendations seek to give the US offshore regulator, specifically the Bureau of Safety and Environmental Enforcement (BSEE), enhanced capabilities to drive safety improvements to prevent major accidents.

Investigative Approach The CSB examines the Macondo incident from a process safety perspective, integrating into its analysis fundamental safety concepts, such as the hierarchy of controls, risk reduction to as low as reasonably practicable, and human factors. While these concepts are not new in the petrochemical world or in other offshore regions around the globe, they are not as commonplace in the US outer continental shelf (OCS). During its investigation, the CSB: • Conducted numerous interviews; collected almost one million documents from 24 companies and parties, including evidence from the National Commission on the BP Deepwater Horizon Oil Spill and the federal court multi-district litigation; gathered data from post-accident investigations activities, including testing of a critical piece of safety equipment (the BOP); and sponsored independent testing of an exemplar BOP component for further analysis. • Met with regulators, industry, and workforce representatives in the US, United Kingdom, Norway, Canada, Australia, and Brazil for information gathering purposes.

• Conducted two public hearings. The first, in Washington, DC, in December 2010, focused on international regulatory approaches used to prevent major accident events offshore. Former and current regulatory officials as well as workforce and industry personnel participated in panel discussions on the challenges and benefits of various regulatory models. The second, in July 2012, advanced the discourse on the specific topic of developing, collecting, and using safety performance indicators by high hazard industries, regulators, and stakeholders for major accident prevention. The CSB Chairman and Board Members heard testimony from leading regulatory, industry, and workforce representatives, and CSB staff released preliminary findings of the Agency’s Macondo investigation.7 • Worked with experts in petroleum engineering, corporate governance, safety performance indicators, sociology, human factors, public policy, regulatory enforcement, and organizational culture to assist with the analysis. Former and current heads of regulatory regimes in the US and internationally were also consulted for their expertise.

Investigative Challenges The CSB is an independent federal agency charged with investigating industrial chemical accidents. Its mission is to independently investigate significant chemical incidents and hazards and to effectively advocate for implementing its recommendations to protect workers, the public, and the environment. Like its sister agency, the National Transportation Safety Board, the CSB focuses more on national and industrywide issues beyond the confines of the existing regulatory framework rather than solely on company-specific policies. The CSB looks for new opportunities to improve safety, not just for the companies involved, but for the broader chemical industry and the regulators. While the CSB often faces roadblocks and delays, the Macondo case presented one of the most challenging experiences in Agency history. Unlike most CSB investigations that begin within 24 – 48 hours of an incident, the Agency’s inquiry into the April 20, 2010, Macondo event did not commence until July 2010, after receiving requests from Congress to analyze the incident in a manner similar to its inquiry into the 2005 BP Texas City refinery explosion. 8 This late start was the first of many impediments. While most of the involved companies, including BP, cooperated with the CSB investigation, one important company did not. Transocean, the drilling contractor with the most witnesses on the drilling rig, refused to acknowledge the Agency’s jurisdiction and failed to respond fully to subpoena requests for documents and interviews. The CSB pursued enforcement actions in federal court, a multi-year endeavor that expended significant Agency resources. 9 The CSB was also blocked from fully participating in portions of equipment testing, so it had

7 Transcripts for both events are available at the CSB’s website on the Macondo investigation, www.csb.gov. 8 The US Congressional Committee on Energy and Commerce called upon the CSB to conduct an investigation because the Committee “believe[s] CSB’s past work on BP puts it in a unique position to address questions about BP’s safety culture and practices,” making specific requests to explore several organizational issues that may be causal to the event. (Letter from Henry A. Waxman, Chairman, and Bart Stupak, Sub-Committee Chairman of the Energy and Commerce Committee, to CSB Chairman John Bresland, June 8, 2010). 9 Ultimately, a federal district court ordered Transocean to comply with the CSB subpoenas. United States v. Transocean Deepwater Drilling, Inc., 936 F.Supp.2d 818 (S.D. Tex. 2013). Transocean appealed this decision,

to examine the data ex post facto. The CSB’s limited ability to fully influence