Riser Disconnect and Blowout – Incident Investigation

This accident investigation report refers to the accidental riser disconnect and subsequent uncontrolled flow during drilling operations which occurred on Mississippi Canyon Block 538 in February 2000. The Ocean Concord (semi-submersible mobile offshore drilling unit) was in the process of running a liner on drill pipe when the lower marine riser package (LMRP) was inadvertently disconnected from the blowout preventer (BOP) stack. The disconnect resulted in the discharge to the sea of approximately 806 barrels of synthetic mud from the riser and 150 barrels of synthetic mud and 150-200 barrels of crude oil from the wellbore.

The rig was in the process of running 1350 feet of 9 7/8 inch liner as planned in order to drill. The liner was being run on 5 inch drill pipe and was approximately 1000 feet off the borehole bottom when the Riser Connector Unlatch button was inadvertently activated and the LMRP disconnected from the BOP stack. At the time of the disconnect, the 5 inch drill pipe was located across the BOP stack. The applied tension in the riser tensioning system lifted the LMRP off the BOP stack, resulting in the discharge of 806 barrels of Novaplus synthetic mud to the seafloor. The decrease in the hydrostatic pressure caused by the loss of the riser mud column resulted in a pressure underbalance in the open hole section of the well and the subsequent discharge of mud and wellbore fluids to the sea.

At the same time in the offshore installation manager’s (OIM) office the subsea engineer (SSE) was installing the panel guards on the Riser Connector function button on the remote panel at 1410 hours on February 28, 2000. The remote panel cover was open and the face of the panel was pulled out at the time of the incident. The SSE inadvertently contacted the LMRP disconnect button while he was drilling mounting holes in the BOP panel. The SSE was unaware of the LMRP disconnection until he heard the alarms sounding, indicating low accumulator pressure. The SSE stated during the Serious Incident Review (SIR) meeting that he did not follow any lockout/tagout procedures to de-energize the BOP control panel prior to working on the panel. The light bulbs for the LMRP latch/unlatch functions were burned out at the time of the panel modifications.

During the incident investigation the subsea engineer stated that he did not realize it was possible to lock out the remote panel until after the incident. Furthermore, the subsea engineer had never been to well-control training. He had worked for another contractor as a roughneck and had trained with both subsea engineers on the Concord. The SSE stated that additional training may have helped him prevent this incident. The OIM stated that this was the SSE’s second hitch on his own on the Concord. The subsea engineer also stated that he knew that if the riser unlatched that there would be a loss of mud from the riser, but he did not know that the well would flow. The SSE also stated that he did not consider “any such risk prior to the job” of installing the panel guards.

At 1430 hours (approximately 20 minutes after the disconnect), rig personnel attempted to lower the LMRP to re-establish connection on the BOP stack but were unable to build system pressure to latch the connector. The bottom of the 9 7/8 inch liner was pulled back into the 11 3/4 inch liner at this time. The U.S. Coast Guard was contacted and the request to use dispersant was made. Two fast response skimming units (FRU) were mobilized to location.

At 1530 hours, full oil flow was observed (via subsea camera) at the LMRP connection. Rig personnel energized the top packer on the 9 7/8 inch liner to isolate the liner from any flow. The oil flow slowed to a trickle and stopped. Non-essential personnel were evacuated at this time.

From 1550 to 1750 hours, the LMRP was lowered over the BOP and several attempts were made to stab over the BOP stack with no success. Finally the problem was found to be the blind/shear ram function – not allowing system pressure to build.

The rig was not equipped with a secondary system capable of securing the well in the absence of the primary BOP controls. At 1815 hours, the rig personnel attempted to latch the LMRP but they could not verify the connector latch because of poor visibility. At 1850 hours, the rig personnel closed the #3 Variable Bore Rams (VBR) on the BOP stack and received good indication of this function. The wedgelocks on the rams were then activated. Flow ceased from around the riser connector and the well was secured.

Approximately 150-200 barrels of crude oil were released to the sea. Approximately 40 barrels of highly emulsified crude were recovered with the FRU’s. Damaged was incurred to the BOP/LMRP connector. The LMRP connector collet showed signs of washing.

The investigation report concluded that the causes of the accident were:

• The failure of the subsea engineer to properly lockout/tagout the remote BOP control panel in the OIM’s office.
• The failure of the company to properly train the subsea engineer in lockout/tagout procedures and in company’s Permit-To-Work system.
• The failure of the OIM to conduct a job hazards analysis of the panel guard installation.
• The OIM should not have allowed any BOP control system modifications while well formations were exposed.
• The lack of a secondary system capable of securing the well in the absence of the primary BOP control. The BOP stack was not equipped with remote operated vehicle (ROV) hot stab capability on the rams.
• The lack of communication among all responsible parties regarding the critical nature of the operations being performed at the time.

As a result of this incident:

• A Safety Alert was issued because of the routine nature of the activity and the potential for similar incidents with catastrophic consequences.
• As a Condition of Approval, secondary well security capability is requried for all well operations utilizing subsea BOP stacks. This became effective October 24, 2000.

Source: BSEE