Scientific basis for safely shutting in the Macondo Well after the April 20, 2010 Deepwater Horizon blowout

Abstract

As part of the government response to the Deepwater Horizon blowout, a Well Integrity Team evaluated the geologic hazards of shutting in the Macondo Well at the seafloor and determined the conditions under which it could safely be undertaken. Of particular concern was the possibility that, under the anticipated high shut-in pressures, oil could leak out of the well casing below the seafloor. Such a leak could lead to new geologic pathways for hydrocarbon release to the Gulf of Mexico. Evaluating this hazard required analyses of 2D and 3D seismic surveys, seafloor bathymetry, sediment properties, geophysical well logs, and drilling data to assess the geological, hydrological, and geomechanical conditions around the Macondo Well. After the well was successfully capped and shut in on July 15, 2010, a variety of monitoring activities were used to assess subsurface well integrity. These activities included acquisition of wellhead pressure data, marine multichannel seismic profiles, seafloor and water-column sonar surveys, and wellhead visual/acoustic monitoring. These data showed that the Macondo Well was not leaking after shut in, and therefore, it could remain safely shut until reservoir pressures were suppressed (killed) with heavy drilling mud and the well was sealed with cement.

Since the early days of the Deepwater Horizon crisis, BP had drawn up plans for ending the blowout of the Macondo Well by locking a new mechanical device capable of shutting in the flow from above on top of the failed blowout preventer. The use of such a device—a capping stack—was discussed among the government and BP scientists and engineers as equipment was being mobilized on the seafloor for Top Kill during May of 2010. When Top Kill failed, this capping stack became a leading contender for controlling the spill (discussion of well control efforts is in ref. 1).

In mid-June, a Well Integrity Team (WIT) was created to make recommendations to the government on whether a shut in of the Macondo Well could be safely undertaken and if so, under what conditions. The WIT consisted of the authors of this paper plus engineers from the Department of Energy National Laboratories: Sandia, Los Alamos, and Lawrence Livermore. Although the WIT analyzed both the geologic environment of the Macondo Well and the hydraulic and mechanical performance of engineered components of the well (wellhead, casing flow paths, rupture disks, etc.), this paper deals only with geologic aspects of well integrity. In this paper, we summarize the WIT’s assessment of the geologic risks of shutting in the Macondo Well and provide analyses of wellhead pressure and geophysical monitoring data during shut in. These analyses were essential for determining whether the capping stack, when closed, could remain safely shut until the well was killed. Geologic data analyzed by the WIT came from the Macondo Well and nearby wells (including relief wells) and consisted of in situ stress and fluid pressure measurements, geophysical logs, core, cuttings, and gas analyses, 3D and 2D seismic lines, seafloor bathymetry, water-column imagery, side-scan sonar surveys, and drilling records. Extensive discussions were also carried out with scientists and engineers from BP, industry experts, and other federal agencies and academia on lithologic and structural interpretations, reservoir and geomechanical analyses, oceanographic conditions, and well kill and cementing procedures.

Geologic Setting and Risks of Shutting In the Well

The Macondo (MC 252–1) Well is located ∼50 mi (80 km) east–southeast of the Mississippi River Delta in a region of the deepwater Gulf of Mexico experiencing very rapid sedimentation. The Macondo oil reservoir lies at a depth of about 18,000 ft (5,500 m) below sea level in channelized turbidite deposits (sandstones) of middle Miocene age (M56 unit) (Fig. 1A). The upper portion of the well, which received the attention of the WIT, penetrates poorly consolidated shale, mudstone, siltstone, sandstone, and marl of Pleistocene through late Miocene age. The rapid deposition of fine-grained, low-permeability sediments creates an overpressured scenario commonly encountered in the Gulf of Mexico (2, 3), with pore fluid pressure increasing steadily with depth at a rate substantially greater than the oceanic (seawater) hydrostatic gradient (Fig. 1C). These high pore pressures, when coupled with the low intrinsic shear strength of these clay-rich sediments, lead to very low differential stresses (4). Throughout much of the Macondo Well, the pore pressure is, thus, only ∼600 psi (4.1 MPa) less than the fracture pressure, which is the pressure at which the least principle stress is exceeded and a hydraulic fracture is formed (5). The fracture pressure, in turn, is only ∼500 psi (3.5 MPa) less than the overburden stress (Fig. 1C).

Fig. 1.

(A) Schematic lithologic section for the Macondo Well based upon analysis of data acquired during drilling (Source: BP). Depths are total vertical depth (TVD) below the Deepwater Horizon rig floor [75 ft (23 m) above mean sea level]. (B) Completion diagram for the Macondo Well showing outer nested casing and liner strings cemented in place during drilling and production casing cemented across the Macondo Reservoir (M56 sand, yellow). Possible oil flow paths during the blowout are shown in red, which were either inside the production casing, between the production casing and the outer casing/liner strings, or both. (Based on data from ref. 30.) (C) Approximate in situ pore pressure, fracture pressure, and overburden stress profile for the Macondo Well showing that pore fluid pressures at the Macondo site are overpressured relative to a seawater hydrostat. The blue line shows the approximate oil pressure in the wellbore corresponding to a capping stack pressure of 6,600 psi, which was observed several hours after the well was shut in (calculated for an oil pressure gradient in the well of 0.25 psi/ft). (Modified from ref. 31. Overburden stress and oil pressure gradient from BP.).

One of several possible pathways for hydrocarbon flow within the Macondo Well after the April 20, 2010 blowout was through the annulus between the production casing and the outer casing/liner strings (Fig. 1B). When Top Kill failed, BP engineers performed a rapid analysis of possible reasons why the large volumes of mud pumped down the well failed to halt the upward flow of hydrocarbons. One reason, postulated by BP, was that rupture disks in the 16-in well liner had burst during the initial explosion, allowing mud from the Top Kill to flow into surrounding formations. This situation might have been exacerbated through enlargement of the rupture disk housings by erosion after the blowout. If annular flow was occurring and any of the rupture disks in the 16-in liner had, indeed, failed, then shutting the well in at the capping stack would lead to an underground blowout (6) when pressure outside the 16-in liner exceeded the formation fracture pressure just below the 18-in liner shoe at 8,969 ft (Fig. 1 B and C). In this scenario, a hydraulic fracture would initiate at the 18-in liner shoe and propagate upward until it was either arrested by shallower geologic units (see below) or broached the seafloor. In the latter case, the consequences would be disastrous.

An underground blowout that broaches the seafloor can lead to large releases of hydrocarbons or other fluids into the ocean. Such releases would be very difficult to contain. A broach can occur at some distance from the wellhead, such as during the 1969 Santa Barbara blowout (7), the 2008 Tordis, North Sea incident (8), and the 1974 and 1979 Campion Field, Brunei blowouts (9). A broach can also occur close to the wellhead. In the Macondo case, this broach could lead to soft-sediment erosion along the outside of the cemented casing/liner strings, with serious implications for wellhead stability (1). Underground blowouts leading to surface broaches and extensive cratering have also been reported in association with drilling of geothermal energy wells (10) and steam flood operations in oil sands (11) and have been implicated in formation of the Lusi mud eruption in East Java (refs. 12 and 13 and references therein).

The WIT also analyzed 3D marine multichannel seismic reflection data that were acquired in 1999 and reprocessed by BP in 2008–2009 using prestack depth migration. Numerous seismic images taken from these data were examined to assess (i) the approximate geometry and volume of the Macondo Reservoir, (ii) the geometry and characteristics of faults near the well that might act as hydrocarbon pathways in the event of a lack of well integrity, and (iii) the geological formations surrounding the well, including the amount of shallow sand units, which might affect upward hydraulic fracture growth in case of an underground blowout.

Interbedded sandstones and shales, if sufficient in volume and lateral extent, can inhibit or arrest vertical hydraulic fracture growth through associated stress contrasts, low-strength interfaces, or fluid leak-off into the high-permeability sands (14–16). However, analysis of well logs, drilling records, and predrilling 3D seismic sections by the WIT indicated that the volume and lateral extent of sands penetrated by the Macondo Well were probably insufficient to significantly slow down the growth of a hydraulic fracture to the seafloor. Thus, for maximum safety, the WIT assumed a worst case scenario of unrestrained vertical hydraulic fracture growth when providing recommendations to the government on well integrity during shut in.

Well Integrity Test and Analysis of Shut-In Pressure

To evaluate the risks of an underground blowout and possible seafloor broach, the WIT recommended that BP be allowed to shut the Macondo Well in for a limited-duration well integrity test. After considering a variety of reservoir, wellbore flow/leakage, and hydraulic fracture propagation models, government and BP scientists agreed on a protocol for the test that would use wellhead pressure after shut in (as measured by accurate pressure gauges installed within the capping stack) as a proxy for the integrity of the well. If the pressure after shut in leveled off at less than 6,000 psi (41 MPa), the government and BP agreed that the well needed to be reopened within 6 h. The well in that case was thought to be clearly losing pressure somewhere below the seafloor, probably through burst and highly eroded rupture disks, and hydrocarbons were likely leaking into surrounding formations. However, if the well shut-in pressure exceeded 7,500 psi (52 MPa), then the test could continue for at least 48 h. In this case, the well was showing integrity, and it was likely that it could be safely shut in from above for a longer period. If the pressure was between these two values, the scientists and engineers would face a dilemma, with at least two possible explanations for the results. One explanation was that some of the rupture disks failed and that the well was slowly leaking into surrounding formations. Another explanation was that the reservoir was more depleted than originally anticipated, thus causing the shut-in pressure to be lower than expected. Both the government and BP agreed that, if the shut-in pressure leveled off between 6,000 and 7,500 psi, the well integrity test could safely last for 24 h, even with a slowly leaking well, to try to determine which of the above explanations was the correct one.

The government and BP seized on a fortuitously long window of stable weather in mid-July to install the capping stack, and the well integrity test began on the afternoon of July 15, 2010. The shut-in procedure consisted of a series of valve turns separated by 10-min rest periods to reduce the oil discharge rate to zero in a stepwise fashion. Several hours after the final turn of the valve was completed and the well was fully shut in, the pressure in the capping stack rose to about 6,600 psi (46 MPa) (Fig. 2). Although the pressure continued to rise slowly, it became evident that 7,500 psi (52 MPa) would not be reached, and the well integrity test result fell squarely in the uncertain middle range. BP interpreted the shut-in pressure to indicate a well with integrity that was tapping a reservoir that had been depleted more than originally anticipated and argued that the well should remain shut in after the initial 24-h test period. However, the government took an abundance-of-caution approach and reasoned that, because a leak was possible, the well should be reopened to the Gulf of Mexico after 24 h to avoid the risk of an underground blowout. The government decided that keeping the well closed beyond 24 h would require additional analysis to support the subsurface integrity of the well.

Fig. 2.

Wellhead pressure measured during and immediately after closure of the capping stack on the Macondo Well on July 15, 2010 as measured by pressure gauges installed on the capping stack (PT_3K_1 and PT_3K_2). The pink line denotes pressure simulated by the initial (square) reservoir model assuming a well with no leaks. (Modified from ref. 18 with permission of the National Ground Water Association, Copyright 2011.)

This additional analysis was carried out overnight from July 15 to July 16 in the form of independent reservoir modeling by the WIT to see if capping stack pressures measured immediately after shut in could be explained without invoking leakage below the seafloor. The US Geological Survey model MODFLOW (17) was used to simulate pressure buildup during the first 6 h of shut in. Although MODFLOW was originally designed to simulate the flow of groundwater in aquifers, it can also be used for simulating the flow of oil in reservoirs under single-phase and isothermal conditions. Details of the MODFLOW implementation are given in ref. 18. Because limited information was available about the lateral extent of the reservoir, it was assumed to occupy a square area centered on the Macondo Well and bounded by impermeable sides. This simplified representation was considered adequate, because the model would initially be used to simulate only the first 6 h after shut in. During this period, pressure recovery occurred in the close vicinity of the well, and the shut-in pressure was insensitive to the location of the reservoir boundaries. Reservoir and fluid properties values used in the model were supplied by BP during previous meetings and included reservoir permeability, porosity, compressibility, and volume in addition to oil viscosity and density. These property values are considered proprietary data and are not presented here.

The reservoir model was used to simulate the scenario in which the well had perfect integrity, with no leakage after shut in. Starting with an initial equilibrium condition, the model simulated 86 d of oil discharge from the Macondo Well at a constant rate of 55,000 bbl/d (8,700 m³/d), consistent with estimates available at that time from the Flow Rate Technical Group (19). At the end of 86 d, the shut-in procedure using the capping stack was simulated by six uniform step decreases in discharge rate to reach zero discharge. This simulated shut-in procedure was only intended to approximate the actual procedure, because the actual decreases in discharge rate were not known until after subsequent analyses were made using the rating curve of the choke valve within the capping stack.

Fig. 2 compares the measured and simulated pressures in the capping stack on July 15, 2010. The step-like rises in pressure correspond to successive turns of the valve to choke back the oil discharge rate. After full shut in was achieved with the final valve turn, the simulated shut-in pressure quickly approached the observed shut-in pressure of 6,600 psi (46 MPa). The close match between observed and simulated pressures indicated that there was a reasonable scenario in which the Macondo Well had full integrity (i.e., no leakage after shut in), but the oil reservoir had been significantly depleted during the blowout. Although the possibility of a leak could not be ruled out, the decision was made by the government to extend the shut in beyond 24 h, with reevaluation of that decision at regular intervals. At this same time, an intense geophysical surveillance effort (described below) was begun to monitor for signs of leakage from the well. Wellhead pressure and geophysical monitoring data were independently reviewed and discussed by BP and the government oversight team, initially at 6-h intervals and then at 12- and 24-h intervals, to determine if the well should remain shut in. If signs of leakage were detected, then the Macondo Well would be immediately reopened.

As shut in continued beyond 24 h, additional shut-in pressure data were used to update the reservoir model. After about 2 d of shut in, it became apparent that the initial model needed to be revised. A Horner plot analysis (20) of the pressure data (Fig. 3) indicated that the oil reservoir could be more appropriately modeled as a long, narrow channel instead of a square. This revised reservoir geometry was more consistent with the known geology of the Gulf of Mexico and the depositional setting of the Macondo Reservoir (21).

Fig. 3.

Horner plot (20) of wellhead pressure after closure of the capping stack on the Macondo Well until final well kill and cementing operations began August 3, 2010. The period of oil discharge (t_p) before closure is 86 d, and Δt is the elapsed time since full shut in on July 15, 2010. The bottom horizontal axis is plotted on a log scale that increases to the left, and therefore, time increases to the right (top horizontal axis). Diamond symbols show shut-in pressure measured by the pressure gauge PT_3K_2. The line shows the simulated shut-in pressure calculated by the revised model, in which the oil reservoir is represented by a long channel. (Modified from ref. 18 with permission of the National Ground Water Association, Copyright 2011.)

With the availability of additional shut-in pressure data every 24 h, the reservoir model was revised on a near real-time basis by adjusting the width and length of the reservoir channel and the location of the Macondo Well to improve the fit between simulated and observed shut-in pressures. The reservoir permeability and the formation compressibility were also adjusted, but these measurements remained within ranges typical of reservoir sands. The oil discharge rate used in the model was also revised from 55,000 to 50,000 bbl/d (from 8,700 to 7,900 m³/d), the most up-to-date estimate by scientists from the Department of Energy National Laboratories during late July of 2010. Model parameters were estimated using the program PEST (22), which enabled considerations of uncertainties in estimated parameters and projected shut-in pressures. With increasing availability of pressure data as shut in continued, the model was able to fit the shut-in pressures, and the uncertainty in projected pressure narrowed. The pressures simulated by the revised model closely match the observed pressures through August 3, 2010, when final well kill and cementing operations began (Fig. 3). The good fit between observed and simulated pressures throughout this shut-in period provided continued support for the idea that the Macondo Well had maintained its integrity.

Geophysical Monitoring During Shut In

An extensive geophysical monitoring plan was implemented to independently assess the integrity of the Macondo Well during shut in and place additional constraints on possible leakage rates into surrounding geologic formations. Monitoring was carried out by BP and their contractors as well as researchers from the University of New Hampshire and the National Oceanic and Atmospheric Administration (NOAA). It included acquisition of multichannel 2D seismic profiles, seafloor and water-column sonar surveys, wellhead visual monitoring with remotely operated vehicles, and wellhead acoustic/seismic monitoring. As discussed above, these data (along with the reservoir modeling results) were reviewed at regular intervals during shut in to decide if the Macondo Well should be reopened.

The feasibility of using seismic profiling to monitor for leaks below the seafloor was examined by fluid substitution modeling. At the request of the WIT, fluid substitution modeling was performed by BP for hypothetically 20-ft-thick (6-m-thick) sand with 28% porosity. This model would simulate the replacement of water by gas or oil within permeable sand, such as the M110 located just above the 18-in liner shoe (Fig. 1 A and B). Using in situ gas and oil properties appropriate to the Macondo Reservoir, models were generated representing sand layers filled with brine, oil, and gas. The oil- and gas-filled cases produced significantly lower P-wave velocities and densities than the brine-filled case. This analysis indicated that, if there were permeable sands at or above the 18-in liner shoe available to absorb hydrocarbons during an underground blowout, then the reflection seismic data should have recorded a decrease in acoustic impedance of that sand.

Before shutting in the Macondo Well, a contract was established between BP and a marine seismic reflection company for the acquisition and processing of repeated (i.e., time lapse) 2D seismic lines before and after the Macondo Well was shut in to look for signs of subseabed leakage. The first such line was recorded on July 13, 2010 by the vessel Geco Topaz 2 d before shut in. After shut in, a total of 28 additional 2D seismic lines were successfully recorded, processed, and interpreted. Because of the urgency of the task at hand, as many as four seismic lines were acquired per day along five different transects (Fig. 4A, Inset), with processing and interpretation typically completed in 24 h. Had the Macondo Well been leaking hydrocarbons below the seafloor, the time-lapse 2D seismic reflection data should have seen this leakage in the form of either an accumulation of oil and/or gas in sand layers (charge zones) or seismic indications of an upward migration of hydrocarbons. As shown by the example in Fig. 4, features that were sought but not found in these time-lapse seismic surveys included (i) increased seismic amplitudes associated with reversed-polarity reflections off a growing charge zone, (ii) diffraction patterns (seismic chimneys) from a rising column of hydrocarbons, and (iii) an increase in two-way travel time to a particular reflector (seismic pull down) resulting from sediment disruption and charging (examples in refs. 23–25). Careful comparison of the 29 2D seismic lines that were examined during the shut-in period with 2D and 3D seismic surveys acquired before shut in failed to detect these types of features on any of transects through the Macondo Well.

Fig. 4.

(A Inset) Location map showing transects for seismic lines acquired to test for leakage of the Macondo Well below the seafloor after closure with the capping stack. (A) 2D seismic section acquired by the vessel Geco Topaz along line 1 on July 13, 2010 (2 d before closing the capping stack and shutting in the well). Approximate horizontal and vertical scales are shown, with the latter derived from two-way travel time (twt) and a sediment velocity model. (B) Same as in A but acquired on July 19, 2010 (4 d after the well was shut in). Within each section, the projection of the Macondo Well and locations of the various liner/casing shoes are shown as a yellow line and triangles, respectively.

At the level of the 18-in liner shoe [8,894 ft (2,711 m) below sea level], the dominant frequency of the 2D seismic data acquired before and after the Macondo Well was shut in was 40 Hz, which was similar to the dominant frequency of the exploration 3D seismic data at equivalent depths. The average seismic velocity at this depth was estimated to be 6,240 ft/s (1,900 m/s), corresponding to a wavelength of 156 ft (48 m). Assuming a 1/8 wavelength detection threshold suggests that a seismic anomaly with a vertical thickness of ∼20 ft (6 m) or greater should have been detectable. At the same depth, the horizontal resolution (as given by the Fresnel zone after migration) is 39 ft (12 m), which is one common midpoint (cmp) in this data. It was estimated that a minimum of 3 cmp or ∼120 ft (37 m) horizontally were needed to detect and interpret an anomaly.

Using a horizontal detection threshold of 150 ft (46 m), which is slightly greater than 3 cmp, the WIT calculated the minimum volume of leaked hydrocarbons that could be imaged with seismic reflection. Two geometries were assumed for the lateral extent of hydrocarbons in the 20-ft-thick (6-m-thick) M110 sand: (i) a circular region centered on the well or (ii) an elliptical region with a 10:1 aspect ratio fed by a vertical hydraulic fracture located midway between two seismic lines. The amount of oil contained within such a region, subject to assumptions regarding the amount of gas dissolved in the oil and the water saturation, ranged from ∼6,000 to 14,000 bbl. Because no anomaly had been detected by the 11th day after shut in, the leak rate could be no more than ∼1,300 bbl/d. Thus, the conclusion reached was that the Macondo Well either had no leak at the 18-in liner shoe or had a leak less than ∼1,300 bbl/d, which is below the level of detectability with high-resolution seismic methods.

In late May and early June, scientists from the University of New Hampshire were deployed on the NOAA vessels Gordon Gunter and Thomas Jefferson in the vicinity of (but not over) the Macondo wellhead to map the distribution of the submerged oil plume. This plume survey was performed using conductivity, temperature, and depth sensors equipped with fluorometers, dissolved oxygen sensors, and water sampling bottles (26, 27). These vessels were also used to explore the feasibility of using split-beam 18- and 38-kHz fisheries sonars to acoustically map the deep oil plume and its impact on biological scatterers in the water column (28). Before shut in on July 15, numerous natural gas seeps were detected within the area surrounding the Macondo wellhead by the NOAA vessels. These natural seeps were manifest in split-beam sonar images as streams of gas bubbles extending from the seafloor to within several hundred meters of the sea surface, the closest being at a distance of ∼4 km east–southeast from the Macondo wellhead. After the wellhead was capped, the NOAA vessels Pisces, Gordon Gunter, and Henry Bigelow (with the same sonar systems onboard) were tasked with monitoring the area surrounding the wellhead out to a distance of several kilometers for indications of gas rising through the water column. These surveys were repeated throughout the shut-in period and intended to detect the first signs of an impending seafloor broach from the very gas-rich Macondo Reservoir oil. No seafloor broach was found, but the sonar mapping did discover acoustic targets emanating from the wellhead (Fig. 5). The acoustic behavior of these targets was characterized by intermittent emanations rising to a depth of ∼500–700 m below the sea surface and then disappearing. This behavior implied that the targets were hydrate-coated methane bubbles (29) and/or pieces of methane hydrate forming on and then breaking away from the wellhead cap. Subsequent visual inspection by remotely operated vehicles found the source of both the bubbles and the methane hydrate formation (which was also seen at the wellhead) to be a small leak from a flange-to-flange metal seal in the blowout preventer/capping stack assembly, which was judged to be inconsequential.

Fig. 5.

Track line of the NOAA vessel Pisces for July 26–29, 2010 shown superimposed on an oblique view of seafloor topography surrounding the Macondo Well. Three different NOAA vessels (Pisces, Gordon Gunter, and Henry Bigelow) provided near-continuous sonar coverage over and around the Macondo Well during shut in to look for evidence of gas emanations that might be related to leakage from the well, but only this track line is shown for clarity. The acoustic curtain shown reflects a small stream of gas bubbles rising from the Macondo wellhead on July 27, 2010 (discussed in the text). Depth contours are at 100-m intervals, and vertical exaggeration is 7×.

Wellhead seismic and acoustic data were also recorded during shut in by BP using a three-component geophone (8-Hz corner frequency) and hydrophone clamped onto the 36-in conductor casing just above the seafloor. It was thought that these data might reveal fluid flow either within the wellbore or behind casing or might detect brittle failure of casing or cement, thereby helping to diagnose the subsurface integrity of the well. Data from these sensors were analyzed during shut in by the Los Alamos National Laboratory and the US Geological Survey, and no anomalous seismic or acoustic signals were observed.

Conclusions

Based on the absence of significant subseafloor well leakage indicated by both hydrologic modeling of wellhead pressures and geophysical monitoring during shut in, it was concluded that the Macondo Well could remain safely shut in with the capping stack from July 15 to August 3, 2010, when kill and cementing operations were initiated from the top of the Macondo Well (1). These operations were followed by the intersection of the Macondo Well with the first relief well and subsequent execution of plug-and-abandon procedures on the Macondo Well, which were completed on November 8, 2010.

The ability of the WIT to function effectively and make useful scientific recommendations to government leaders during this time of national crisis required the following components. (i) An unprecedented level of collaboration and coordination among scientists, engineers, and emergency response officials from public and private sectors. (ii) Clear protocols for information requests to minimize disruptions to BP and their subcontractors, with a well-defined chain of command for decision-making processes. (iii) Very rapid analysis of diverse datasets, often in a matter of hours, including concise synthesis and communication of results to key decision makers. (iv) Posting of government scientists at BP headquarters to verify critical observations and discuss mitigation options and possible outcomes. (v) Continual access to personnel with the training and expertise needed to deal with critical scientific and technical issues both on- and off-site. (vi) Excellent access to company data, analyses, and mitigation plans for use by government oversight teams and their collaborators.