I recently worked with a client on a presentation concerning
the Deepwater Horizon disaster – an epic
tragedy in 2010 that claimed the lives of 11 men, injured 17 others and poured
4.9 million barrels of oil into the Gulf of Mexico. The financial costs to BP have
totaled about $60 billion, not counting the long-term loss of more than a
quarter of BP’s market capitalization. It remains the worst off-shore oil spill
in US history.
Revisiting the details of what happened, and why, was both
tragic and fascinating. It was a
reminder that despite all our technological prowess and cutting-edge this-and-that,
the forces of nature are humbling. Even when those forces are in the form of long-dead
dinosaurs buried 5 miles under the sea. It is also a reminder that catastrophes
like this are almost never the result of a single point of failure: usually
multiple safety systems, human and otherwise, fail in an event of this
magnitude.
The Deepwater Horizon disaster began on April 20, 2010, at
approximately 9:38 pm CDT, when the Macondo well began surging hydrocarbons
into the drill riser. The reverse flow of drilling mud, gas and oil started
slowly, then erupted into a geyser that ignited and burned for two days,
ultimately sinking the Deepwater Horizon.
Drilling into the Past
The task of the Deepwater Horizon, a giant floating ship
in the form of a drilling platform, was audacious. Owned by Transocean, the
Deepwater Horizon was tasked with drilling the Macondo well, leased by BP. The
drilling took place about fifty miles off the coast of Louisiana, at an ocean
depth of a mile. But the prize – a vast potential reserve of oil and gas – lay
much deeper; about three-and-a-half miles under the sea floor. The operators
were drilling four-and-a-half miles beneath them, into an ancient world that
they could never see.
The task of drilling the well was complex and tedious. It
involved repeated cycles of installing lengths of drill pipe – almost five miles’ worth – to achieve the
desired depth. During the drilling process, a combination of seawater and
specially formulated drilling “mud” was pumped through the drill bit to remove
debris and to keep the well pressure at appropriate levels to prevent
hydrocarbons from flowing up into the well bore. Along the way, at various
intervals, drilling was stopped and the well bore was “cemented in” with steel
casing. The cementing process was critical – if the cement failed, hydrocarbons
could leak into the annulus – the space between the drill pipe and the casing –
or potentially into the casing itself, leading to a blowout.
A blowout preventer (BOP) supplied by Cameron was thought
to be the ultimate failsafe. More than 160 feet high, the BOP sat on the sea
floor and had multiple systems intended to seal the well and prevent a blowout.
They included an upper annular closure, a lower annular closure and a blind
shear ram. The annular closures were designed to seal around the drill pipe.
The blind shear ram was a hydraulic ram of last resort – a set of cutting
blades designed to cut through the steel drill pipe and seal the well entirely.
The BOP even had two “dead man” switches – intended to operate the blind shear
ram in the event of a loss of hydraulic power, electricity and communications.
All of this technology ultimately failed.
The Blowout
At the time of the disaster, the Macondo well was in the
process of being temporarily “abandoned” by the Deepwater Horizon. Having
drilled the well, the Deepwater Horizon’s final job was to seal it with
concrete and leave for its next drilling job. When BP was ready to produce oil
and gas from the well, it would send in a production platform to reopen the well.
But the Macondo well had been a problem for BP and
Transocean. Multiple delays and unforeseen issues had put the project more than
50 days behind schedule – at a cost of $1 million per day to BP. Workers had
reportedly named it the “well from hell.” As they were preparing to leave,
things got worse.
Because the well was being drilled in relatively weak
geological strata, BP and its cementing contractor Halliburton elected to use a
lighter “foamed” cement in the lower portions of the well. The final step was
to pour a concrete plug or cap at the bottom of the well using a stronger and
heavier liquid cement. Multiple investigative reports suggest that the foamed
cement failed, and that the heavier liquid cement never made it to the bottom
to plug the well.
Despite questionable results from a negative pressure test
intended to determine whether the well was properly sealed, officials on site
decided the well integrity was satisfactory, and operators began the process of
removing the heavy drilling mud and replacing it with seawater. At that point, hydrocarbons
began flowing up through the casing, through the BOP and up into the riser at
the surface.
By the time the crew realized what was happening, the
Deepwater Horizon was enveloped in a cloud of combustible hydrocarbons. A
methane detection system sounded an alarm, but only shut down some of the potential
ignition sources. Gas – odorless and colorless – entered the air intakes for the massive
diesel engines that powered the Deepwater Horizon. This initially caused the
engines to overspeed – popping light bulbs and overpowering the electrical
system – and then stop. Seconds later, explosions occurred on two of the
generators, igniting the firestorm that ensued.
Multiple Points of Failure
Numerous investigations followed. Each of the major
investigative reports views the events through a slightly different lens, but
fundamentally there is broad agreement on the technical causes. Some of the published reports are highly critical of BP’s risk assessment process and decisions made by BP on the basis of cost or time savings. BP’s own comprehensive report on the incident identifies eight key findings that
caused or contributed to the catastrophe, which are largely echoed echoed elsewhere:
- The
failure of the cement barrier to isolate the hydrocarbon
- The
failure of check valves inside the casing to prevent the backflow of
hydrocarbons into the well bore
- Improper
interpretation of a critical negative pressure test, leading to the erroneous
conclusion that well integrity had been established
- Failure
to recognize the influx of hydrocarbons in the well until they reached the
riser
- Inadequate
well control response by the crew
- Diversion
of the blowout to the mud gas separator resulted in gas venting onto the rig
- The
fire and gas detection system failed to prevent ignition
- The
BOP emergency mode did not seal the well
Each of these issues is detailed in the BP report (and
others), and other investigative reports emphasize or de-emphasize particular
aspects. But it is undisputed that the Deepwater Horizon catastrophe was a
result of multiple failures – system, technological and human.
The Aftermath
Families lost loved ones and many others were scarred by
the events. The recent Deepwater Horizon movie was based on a New
York Times article that detailed some of the heroics and human toll. Seven
years later, BP is still fending off lawsuits – at this point, primarily
actions by institutional shareholders relating to alleged securities
violations. Multiple environmental assessments have detailed the impacts to the
Gulf of Mexico. The financial costs to BP and other involved parties have been
staggering.
The history of human technological progress is one of spectacular
advances and catastrophic failures. As we continue to race forward at breakneck
speed, it is critical and humbling to reflect on events of the past -- in the
hope that future catastrophes can be avoided or minimized, but with the painful
awareness that we will likely have future lessons to learn.
Publish by Thomas Cook
