U.S. C H E M I C AL S A F E T Y A N D H A Z A R D I N V E S T I G A T I O N B O A R D

INVESTIGATION REPORT VOLUME 3 DRILLING RIG EXPLOSION AND FIRE AT THE MACONDO WELL (11 Fatalities, 17 Injured, and Serious Environmental Damage)

DEEPWATER HORIZON RIG MISSISSIPPI CANYON 252, GULF OF MEXICO

KEY ISSUES: APRIL 20, 2010

• HUMAN FACTORS • ORGANIZATIONAL LEARNING • SAFETY PERFORMANCE INDICATORS • RISK MANAGEMENT PRACTICES • CORPORATE GOVERNANCE • SAFETY CULTURE

REPORT NO. 2010-10-I-OS 4/17/2016

[This page left intentionally blank.]

Contents VOLUME 3 – INTRODUCTION .............................................................................................................. 15 Moving Beyond the Blowout Preventer...................................................................................................... 19 Volume Overview ....................................................................................................................................... 20

1.0 HUMAN FACTORS ..................................................................................................................... 21 1.1 Macondo Temporary Abandonment Personnel ............................................................................. 25 1.2 Macondo Temporary Abandonment Activities: Four Phases ........................................................ 26 1.2.1 Phase 1: Presetting of the Diverter System Route ............................................................ 27 1.2.2 Phase 2: Displacement of the Drilling Mud from the Drillpipe and Upper Wellbore ...... 27 1.2.3 Phase 3: Monitoring Pressure in the Underbalanced Well ............................................... 30 1.2.4 Phase 4: Displacement of the Riser .................................................................................. 33 1.2.5 Human Performance at Macondo ..................................................................................... 34 1.3 Phase 1 – Organizational Influence on Human Performance ........................................................ 35 1.3.1 Diverter Dual Role: Operational and Emergency Mitigation Device ............................... 36 1.3.2 Organizational Policy and Practice Influence Human Performance ................................. 38 1.3.3 Diverter System Design Required Multi-Step Process to Divert Fluids Overboard ......... 41 1.3.4 Needed Improvements in Detecting Gas Influx Prior to Reaching Riser ......................... 45 1.4 Phase 2 – Seemingly Insignificant Decisions can have Great Impact in Complex Systems ......... 47 1.5 Phase 3 – Evidence of Confirmation Bias ..................................................................................... 54 1.5.1 Potential Influence of Distraction and Fatigue ................................................................. 59 1.5.1.1 Fatigue ........................................................................................................... 60 1.5.1.1 Distraction ..................................................................................................... 63 1.6 Phase 4 – Troubleshooting, Multiple Activities, and Communication Gaps Obscure Well Conditions ................................................................................................................................................... 63 1.7 Competency and Non-technical Skills ........................................................................................... 66 1.7.1 Case Study for NTS: Pressure Discrepancies between Drillpipe and Kill Line ............... 70 1.7.1.1 Role of Mudlogger ........................................................................................ 72 1.7.2 Case Study for NTS: Conversation between Well Site Leader and Onshore Engineer .... 76 1.7.3 Integration of Non-technical Skills ................................................................................... 81 1.8 Work-as-Imagined Versus Work-as-Done: The Operator/Drilling Contractor Gap...................... 83 1.8.1 BP’s Development and Communication of the Temporary Abandonment Plan .............. 85 1.8.2 Gap between ‘Work as Imagined’ and ‘Work as Done’ at the Macondo Well ................ 91

1.8.3 Transocean Procedural Development Policies.................................................................. 93 1.8.4 Lack of Written Transocean Procedures and Work Instructions at Macondo .................. 95 1.9 Management of Change (MOC) .................................................................................................. 102 1.9.1 Management of Change: A Missed Opportunity ............................................................ 103 1.9.2 MOC Regulatory Requirements and Good Practice Guidance ....................................... 107 1.9.2.1 Regulatory Requirements for an MOC Safety Management System .......... 107 1.9.2.2 Multi-party MOCs are an International Concern ........................................ 109 1.10 Inadequate Requirements for Incorporating Human Factors in US Offshore Operations ........... 110 1.10.1 After Macondo, Limited US Offshore Regulatory Requirements Remain for Including Human Factors .................................................................................................................................. 111 1.10.2 Good Practice Techniques and Guidance on Human Factors ......................................... 112 1.10.3 International Offshore Regulatory Requirements and Guidance .................................... 114 1.11 Conclusion ................................................................................................................................... 117

2.0 ORGANIZATIONAL LEARNING FROM INCIDENT INVESTIGATIONS .......................... 119 2.1 Joint Incident Investigations and Challenges to Disseminating Lessons Learned Between Companies................................................................................................................................................. 119 2.2 Challenges to Disseminating Lessons Globally ........................................................................... 121 2.3 Expanding Beyond Immediate Causes and Implementing Change ............................................. 126 2.4 Effectiveness of post-Macondo SEMS Requirements for Incident Investigation........................ 127 2.5 Conclusion ................................................................................................................................... 131

3.0 SAFETY PERFORMANCE INDICATORS ............................................................................... 132 3.1 Process Safety Performance Indicators for High-hazard Work Environments ............................ 133 3.2 BP’s Selection and Use of Performance Indicators ..................................................................... 137 3.2.1 BP Corporate Policies Reflect a Focus on Production, Personal Safety, and Lagging Indicators 137 3.2.2 Individual Performance Plans Lacked Process Safety Metrics ....................................... 139 3.3 Transocean’s Selection and Use of Performance Indicators ........................................................ 143 3.3.1 Transocean Recognized Need for Process Safety Performance Indicators .................... 146 3.3.2 Transocean Bonus Awards Insufficiently Focused on Performance Relating to Process Safety and MAP ................................................................................................................................ 148 3.4 Advancing the Development and Use of Process Safety Performance Indicators....................... 149 3.4.1 CSB Efforts to Advance Understanding and Use of Process Safety Performance Indicators 150 3.4.2 Selection of Effective Performance Indicators ............................................................... 152

3.5 Process Safety Metrics Gleaned from the Macondo Blowout ..................................................... 157 3.5.1 Real-time Indicators for Safety Critical Elements .......................................................... 158 3.5.1.1 Well Kicks ................................................................................................... 159 3.5.2 Slow Moving Indicators for SMS Elements ................................................................... 160 3.5.2.1 Emerging MOCs Themes ............................................................................ 160 3.5.2.2 Cross Reference Indicators Between the Operator/Drilling Contractor ...... 164 3.6 Regulatory Requirements for Indicators Reporting ..................................................................... 165 3.7 Conclusion ................................................................................................................................... 166

4.0 INEFFECTIVE RISK MANAGEMENT APPROACHES AT MACONDO AND THE CHALLENGES OF THE MULTI-EMPLOYER OFFSHORE WORK ENVIRONMENT .................... 167 4.1 BP and Transocean Risk Reduction Goal: ALARP ..................................................................... 168 4.2 Contractor Safety Management Guidance Calls for Clear Definition of Roles and Responsibilities 170 4.3 Transocean did not apply its More Rigorous Corporate Risk Management Policies to the Deepwater Horizon and Macondo Well.................................................................................................... 171 4.3.1 Transocean Lacks Implementation Guidance for its Risk Management Tools .............. 173 4.3.1.1 Transocean Identified Risk Mitigation Tool Weaknesses Post Incident ..... 174 4.4 Post-Texas City Refinery Disaster, BP Developed but Macondo did not Benefit from the Robust Corporate Risk Management System........................................................................................................ 176 4.4.1 OMS Roll-out Lags Macondo Well Planning and Drilling—Related Safety Practices were not Effectively Applied at the Macondo Well .................................................................................. 178 4.4.2 Macondo Risk Analysis Lacked BP ALARP Requirements .......................................... 180 4.4.3 BP’s Major Accident Risk (MAR) Process was not Implemented ................................. 183 4.4.4 Absent Reporting Requirements ..................................................................................... 185 4.4.5 BP did not implement OMS-required Application to Contracted Rigs through Contracts and Bridging Documents .................................................................................................................. 187 4.5 BP Did Not Pursue Its 2008 Initiative to Engage GoM D&C Contractors in Risk and Barrier Management.............................................................................................................................................. 191 4.6 Conclusion ................................................................................................................................... 193

5.0 CORPORATE GOVERNANCE, THE INFLUENCE OF SHAREHOLDERS AND PUBLIC DISCLOSURE OF PROCESS SAFETY INFORMATION..................................................................... 195 5.1 Boards of Directors and Shareholders ......................................................................................... 197 5.1.1 What is Corporate Governance? ..................................................................................... 197 5.1.2 The Role of Shareholders and their Influence on Corporate Governance ...................... 198

5.1.3 Corporate Governance Risk Management and Sustainability ........................................ 201 5.1.4 The Business Case for Effective Process Safety Oversight ............................................ 204 5.1.5 The Need for Better Reporting Illustrated by Consequences Stemming from the Macondo Blowout 206 5.2 BP and Transocean: Corporate Governance and Communication of Process Safety and Major Accident Prevention Information .............................................................................................................. 209 5.2.1 A Case Study of Board Involvement Demonstrated in Shareholder Communications .. 209 5.2.1.1 BP Shareholder Communications Before and After BP Texas City ........... 210 5.2.1.2 BP Shareholder Communications Before and After Macondo ................... 212 5.2.1.3 Transocean Shareholder Communications Before and After Macondo ...... 214 5.3 Historical BP Corporate Governance Issues ................................................................................ 216 5.4 US Financial Regulation Absent Regarding HSE Reporting....................................................... 221 5.5 The Offshore Regulator’s Role – An International Perspective .................................................. 224 5.5.1 Norway: Management Findings from Audits and Investigations ................................... 225 5.5.2 United Kingdom: Guidance and Training....................................................................... 227 5.6 Conclusion ................................................................................................................................... 232

6.0 CULTURE FOR SAFETY: FOCUS AND RESPONSE ............................................................. 233 6.1 Assessing Culture and whether it Promotes Process Safety ........................................................ 234 6.2 Culture Assessments of BP and Transocean ................................................................................ 236 6.3 Influencing a Culture for Process Safety from the Top ............................................................... 238 6.4 Conclusion ................................................................................................................................... 241

7.0 VOLUME 3 CONCLUSION ....................................................................................................... 242

8.0 RECOMMENDATIONS ............................................................................................................. 244

Figures and Tables Figures Figure 1-1. Control panel (left) and partial close-up of control panel on the Deepwater Horizon found in the driller’s cabin and on the bridge of the rig. These controls were used to preset the diverter........ 27 Figure 1-2. On the left, the well as spacer material is pumped into the well, beginning to push drilling mud out of the riser. On the right, the intended well configuration for the negative test. .................. 29 Figure 1-3. Initial negative test configuration for the Macondo well called for only displacing the kill line (left), but the final configuration had both the kill line and the drill pipe displaced with sea water. . 31 Figure 1-4. Actual well conditions, with spacer positioned across the BOP, which likely lead to plugging of the kill line. ..................................................................................................................................... 32 Figure 1-5. During the final displacement of the well, the remaining drill mud above the drillpipe is replaced with seawater. ....................................................................................................................... 33 Figure 1-6. The diverter system on a rig can be routed to direct well fluids containing flammable gas to the mud gas separator (green) so that gas can be vented away from rig floor or drilling fluids can be directed routed overboard (red). ......................................................................................................... 37 Figure 1-7. Control panel and partial close-up of control panel on the Deepwater Horizon found in the driller’s cabin and on the bridge of the rig. ......................................................................................... 42 Figure 1-8. Control Panel Pushbuttons to preset route to MGS or overboard. ........................................... 43 Figure 1-9. Control Panel Pushbuttons to preselect the overboard route. ................................................... 43 Figure 1-10. Crew Activities during Temporary Abandonment beginning at 3:00 p.m. on April 20, 2010. ............................................................................................................................................................ 56 Figure 1-11. Crew activities and actions during final displacement of the riser. ........................................ 66 Figure 1-12. Intricate Communication Routes of Well Operations Personnel. .......................................... 73 Figure 1-13. Deepwater Horizon negative test Task Specific THINK Plan. .............................................. 98 Figure 1-14. Transocean Task Specific THINK Procedure addressing displacing a riser with seawater. 100 Figure 1-15. Illustration of the Hierarchy of Controls, including inherent safety strategies, for minimizing and eliminating hazards. ................................................................................................................... 113 Figure 3-1. Safety performance goals for BP employees that were a part of the Deepwater Horizon’s organizational structure..................................................................................................................... 141 Figure 3-2. Process Safety Indicator Pyramid as identified by the American Petroleum Institute and the International Association of Oil & Gas Producers............................................................................ 153 Figure 3-3. A Bowtie diagram model used by Statoil to track the health of specific barriers that are preventive or mitigative for major accident risks. ............................................................................ 158 Figure 4-1. Transocean’s Levels of Risk Management. The higher level risk management approaches were applied to activities with greater complexity and severity of risk. ........................................... 172 Figure 4-2. OMS Rollout at BP, 2006-2009. ............................................................................................ 179

Figure 4-3. May 2008 BP D&C Teams and Contractor Engagement from the Major Hazard and Risk Management Presentation to the D&C Leadership group. The presentation, two years before the Macondo incident, envisioned a detailed allocation of risk and barrier management responsibilities between BP and the contractor. BP did not implement the responsibility matrix approach. ............ 193 Figure 6-1. Visual representation of organizational culture, based on Edgar Shein's levels of culture. ... 235

Tables Table 1-1. Well Control Personnel on Board the Deepwater Horizon Rig on April 20, 2010, that are discussed in this volume.* .................................................................................................................. 25 Table 1-2. Identified human performance actions/decisions during the four phases of temporary abandonment leading up to the blowout. ............................................................................................ 34 Table 1-3. Selected steps from the M-I SWACO displacement procedure used at the Macondo well on April 20, 2010. .................................................................................................................................... 49 Table 1-4. Non-technical skill categories, definitions, and example behaviors associated with each. ....... 68 Table 1-5. Multiple Interpersonal Behaviors and Interactions amongst Well Operations Personnel Demonstrate Need for Non-technical Skills. ...................................................................................... 70 Table 1-6. Summary of communications between Mudlogger and Other Well Operations Crewmembers the evening of April 20, 2010. ............................................................................................................ 75 Table 1-7. Interview statements concerning conversation between the on-rig Well Site Leader (WSL) and the onshore drilling engineer (ODE); names have been replaced with title abbreviations. ................ 77 Table 1-8. Description of the development and communication of the Macondo TA program. ................ 89 Table 1-9. BP and Transocean instituted multiple changes to the temporary abandonment activities that had the potential to negatively affect well barriers without first assessing the hazards of those changes.............................................................................................................................................. 104 Table 1-10. A comparison of best practice elements of an MOC program, current BSEE MOC requirements, and BP and Transocean’s MOC programs in place at the time of the Macondo incident.............................................................................................................................................. 108 Table 2-1. Excerpts from the M.G. Hulme, Jr well control incident report that reflect WAI versus WAD conflicts............................................................................................................................................. 120 Table 3-1. Distinctions between Process and Personal Safety., , ............................................................. 136 Table 3-2. Indicator data collected for the Gulf of Mexico as reported in BP’s Maroon Book for 2009. 138 Table 3-3. Corporate Quality, Health, Safety and Environment (QHSE) Strategy and Target Goals Status as reported by Transocean. ............................................................................................................... 146 Table 3-4. COS definitions of SPI 1 and SPI 2 process safety events. ..................................................... 154 Table 3-5. Four indicators as defined by Statoil in 2001. ......................................................................... 157 Table 3-6. Summary of MOCs documented by Transocean for the Deepwater Horizon BOP. ............... 161

Table 4-1. Shore-based risk management tools as identified and described in Transocean’s Health and Safety Policies and Procedures Manual-Level. ................................................................................ 173

Acronyms and Abbreviations

ALARP As Low As Reasonably Practicable AMF Automatic Mode Function ANSI American National Standards Institute API American Petroleum Institute ASTM American Society for Testing and Materials BOEM Bureau of Ocean Energy Management BOEMRE Bureau of Ocean Energy Management, Regulation, and Enforcement BOP Blowout Preventer BSEE Bureau of Safety and Environmental Enforcement BSR Blind Shear Ram CCPS Center for Chemical Process Safety CEO Chief Executive Officer COS Center for Offshore Safety COSO Committee of Sponsoring Organizations CRM Crew Resource Management CSB US Chemical Safety Board DAFW Days Away From Work DAFWC Days Away From Work Case DAFWCF Days Away From Work Case Frequency DART Days Away from Work, Restricted duty, and Transfer situations DAWFC Days Away from Work Case Frequency DNV Det Norske Veritas DOI Department of Interior DWH Deepwater Horizon DWOP Drilling and Wells Operation Practice EDS Emergency Disconnect System EHS Environmental Health and Safety EPA Environmental Protection Agency ERM Enterprise Risk Management

ETP Engineering Technical Practices FAA Federal Aviation Administration FRC Financial Reporting Council GDP Group Defined Practice GHSER Getting HSE Right GRI Global Reporting Initiative HAZID Hazard Identification HAZOP Hazard and Operability Study HIPO High Potential Incident HPDO High Potential Dropped Objects HRO High Reliability Organization HSE Health Safety Executive HSSE Health, Safety, Security and Environment HTO Human, Technology and Organization IADC International Drilling Contractors Association INPO Institute of Nuclear Power Operations IOGP International Association of Oil & Gas Producers ITL Information to Lessee LCM Loss Circulation Material LMRP Lower Marine Riser Package LOPA Layers of Protection Analysis LOPC Loss of Primary Containment LTA Lost Time Accident LTI Lost Time Incident/Lost Time Incident rate MAE Mary Accident Event MAHRA Major Accident Hazard Risk Assessment MHRA Major Hazard Risk Assessment MAP Major Accident Prevention MAR Major Accident Risk MBI Marine Board of Investigation MBO Management by Objective

MGS Mud-Gas Separator MHRA Major Hazard Risk Assessments MIA Major Incident Announcement MMS Minerals Management Service MOC Management of Change MODU Mobile Offshore Drilling Unit MSHA Mine Safety and Health Authority NAE National Academy of Engineering NOPSA National Offshore Petroleum Safety Authority NOPSEMA National Offshore Petroleum Safety and Environmental Management Authority NPT Negative Pressure Test NRC Nuclear Regulatory Commission NSOAF North Sea Offshore Authorities Forum NTL Notice to Lessee NTS Non-technical Skills NTSB National Transportation Safety Board OCS Outer Continental Shelf ODE Onshore Drilling Engineer OECD Organization for Economic Co-operation and Development OIC Operations Integrity Case OIM Offshore Installation Manager OLF Norwegian Oil Industry Association OMS Operating Management System OOC Offshore Operators Committee OSH Occupational Safety and Health OSHA Occupational Safety and Health Administration PMAA Performance Monitoring Audit and Assessment PSA Petroleum Safety Authority PSM Process Safety Management QHSE Quality, Health, Safety and Environment RAT Risk Assurance Tool

RIF Recordable Injury Frequency SASB Sustainability Accounting Standards Board SCE Safety Critical Element SCTA Safety Critical Task Analysis SEC Securities and Exchange Commission SEEAC Safety, Ethics and Environment Assurance Committee SEMS Safety and Environmental Management System SHAPE Safety and Health in Amec Process & Energy SHE Safety, Health, and Environment SIC Serious Injury Case SID Standing Instructions to the Driller SINTEF Norwegian: Stiftelsen for industriell og teknisk forskning SIS Safety Instrumented Systems SMS Safety Management System SOP Standard Operating Procedure SPE Society of Petroleum Engineers SPI Safety Performance Indicator SPU Strategic Performance Unit TPSR Total Potential Severity Rate TRIR Total Recordable Injury Rate TSTP Task Specific THINK Procedure UK United Kingdom US United States USCG United States Coast Guard WAD Work as Done WAI Work as Imagined WBM Water Based Material WCID Well Construction Interface Document WLCPF Well Lifecycle Practices Forum WSL Well Site Leader

Volume 3 Human, Organizational, and Safety System Factors of the Macondo Blowout

Volume 3 – Introduction Volume 3 Overview In 1988, the offshore oil and gas industry experienced its deadliest accident when an explosion aboard the Piper Alpha Introduction oil production platform took the lives of 167 individuals. In its aftermath, a major incident investigation revealed a Chapter 1 – Human Factors number of issues concerning the management of major accident risk offshore. 1 Twenty-five years later, the Piper Chapter 2 – Organizational Learning from Incident Alpha disaster was described as “the lens through which we Investigations [the offshore industry] view our safety efforts.” 2 The Macondo incident serves to check the focus of that lens, as Chapter 3 – Safety Performance the blowout illuminates the increasing complexity of offshore Indicators operations, technologies, and drilling environments. To that end, the CSB’s investigation of the Macondo incident revisits Chapter 4 – Risk Management and some of Piper Alpha’s lessons and introduces new ones the Multi-employer Work related to human performance, organizational learning, safety Environment performance indicators, risk management coordination, and corporate cultures that promote safety. Chapter 5 – Corporate Governance and the Influence of The risk management policies of both BP and Transocean Shareholders promote an incident-free workplace. BP’s 2008 major corporate safety Operating Management System (OMS) Chapter 6 – Culture for Process framework states, “Our goals are simply stated: no accidents, Safety no harm to people, and no damage to the environment.” 3 In Transocean’s 2009 Health and Safety Policy statement, the Chapter 7 – Conclusion company commits to operating in an “incident-free workplace—all the time, everywhere.” 4 ExxonMobil, 5 Shell Chapter 8 – Recommendations

1 Department of Energy. The Public Inquiry into the Piper Alpha Disaster; Presented to Parliament by the Secretary of State for Energy by Command of her Majesty. November, 1990. 2 Oil & Gas UK. Health & Safety Report 2014; 2014; p 1. http://oilandgasuk.co.uk/wp- content/uploads/2015/05/HS087.pdf (accessed December 20, 2015). 3 Internal Company Document, BP. The BP Operating Management System Framework, Part 1, An Overview