Deepwater Horizon

The Deepwater Horizon accident resulted in 11 deaths and 700,000 T of crude oil dumped into the Gulf of Mexico causing the largest environmental disaster in United States history. We discuss briefly some of the most significant Technical, Organizational, Regulatory factors that caused or contributed to the gravity of the accident.^[1]

Water, crude oil, natural gas are under pressure in subsea rock and sediment.

An unplanned flow of these fluids is called a “kick”. A kick if uncontrolled can lead to a “blow-out” (uncontrolled release of flammable oil and gas from the well). Drilling mud is pumped down the hollow drill pipe to the drill bit, where it exits the pipe and then is flushed back up the borehole to the surface. The drill mud creates a barrier between the undersea oil and gas and the piping that leads to the rig.

If the mud barrier fails or is removed, the next line of defense is the blowout protector (BOP) located at the sea floor. The BOP is connected to the rig by a large diameter pipe called a riser. If a kick occurred, the BOP functions to prevent flammable oil and gas from traveling up the riser to the drilling rig.

This is done by sealing the annular space around the drill pipe. To do this the crew can manually close rams (right side below) and rubber devices called “annular preventers” (left side below).

If those devices should fail to work, the last resort is a set of metal blades which form a blind shear ram designed to cut the drill pipe and seal the well. It can be activated manually or by automated emergency systems.

What happened?

On the night of April 20, 2010 at 8:45 pm a kick occurred and oil and gas entered the well bore. Due to operational error^[2] the kick remained undetected.  Eventually the oil and gas travelled above the BOP to the Deep Water Horizon.

1. At 9:40 pm mud under pressure of the oil and gas suddenly blew out onto the rig.
2. Crew members responded by closing the upper annular preventers.
3. However this did not seal the well as intended.
4. Flammable gas and oil continued to flow.
5. Next the crew closed a pipe ram.
6. This successfully closed the annular space and sealed the well.
7. But oil and gas that were already above the pipe ram continued to flow upward towards the Deep Water Horizon.
8. At approximately 9:49 pm the flammable hydrocarbons found an ignition source and exploded.
9. As the oil escaped the pressure dropped in the annular space above the pipe ram.
10. But at the same time the pressure in the drill pipe climbed substantially. (The drill pipe was closed at the top but oil and gas continued to flow in from the reservoir below.) The large difference in pressure caused the drill pipe to buckle (see explanation below) inside the BOP.

This caused the pipe to displace outside the reach of the ram shear blades. This would eventually prove to be catastrophic.

Although there were also electrical installation errors, inadequate maintenance testing of the BOP redundant devices, and operational errors in detecting the kick, the final line of defense was defeated  in the design of the BOP which did not anticipate a phenomenon known as the “Effective Compression” as described below.

Why exactly did the drill pipe bend? 

Although a mechanism called “Effective Compression” was known, it had never previously been identified as a problem affecting drill pipes.

Although pipe may appear to be straight, in fact it has minute bends and irregularities invisible to the naked eye.

The side of a pipe segment that is bent outwards is longer and has more surface area. When there is a large difference in pressure between the inside and outside of the pipe as happened on April 20, 2010 the longer side of the pipe experiences a larger bending force. Eventually the force becomes large enough to bend the pipe.

Interesting maintenance and installation errors

Although the failure of the last defense against catastrophe is attributable to the inability of the the BOP shear ram to cut off the flow due to the effective compression phenomenon unanticipated  by the device’s designers, interesting errors in maintenance and installation suggest a systemic cultural and organizational problem that extended even to the critical operational errors at the root of the accident. These maintenance and installation errors are described in the following.

The explosion and subsequent loss of electrical and hydraulic power likely activated an automated system known as the “AMF dead man system” which closed the blind shear ram. The dead man system is activated by two redundant control systems on the BOP. 1. The yellow pod, and 2. The blue pod which work independently of each other to close the blind shear ram. If electrical power is lost as was the case, each pod contained two 9v independent backup circuits each powering two computers and a 27v battery backup circuit powering two solenoid valves. Here is a schematic of one of the two identical pods:

The blue pod had been miswired at some point prior to lowering of the BOP to the sea floor. This caused the pod’s 27 volt battery to drain, making it impossible to operate either solenoid for the blind shear ram on the night of the accident.

And within the yellow pod the solenoid for the shear ram had been miswired.

The two coils of solenoid in the yellow pod were designed to work in concert to generate a magnetic field strong enough to operate the valve. But the two fields opposed each other and would paralyze the solenoid valve.

Only a third unplanned failure allowed the solenoid valve to operate. On the night of the accident one of the 9v batteries had failed. The affected computer could not issue the command to operate the miswired coil in the yellow pod. If it were not for this failure the two coils would have generated opposing forces and the blind shear ram would never have been closed.

This should have cut the drill pipe and sealed the well, greatly reducing the impact of the accident. But because the drill pipe was buckled/bent and therefore off center it was only partially cut. With the failure of this last ditch measure there was nothing left to stop the massive oil spill and the destruction of the rig.

Cement Job

The cement job merits particular mention because it was probably among the most significant events in a long list of events that aligned in a way to produce the disastrous accident. After a well is drilled, engineers pump a foamed cement mixture in (replacing the drill mud) to seal the gap between the drill hole and the casing pipe, preventing reservoir oil and gas from escaping to the surface. Tests showed that the cement mixture used in the well was unstable.

At least one pressure test carried out before the blowout indicated a problem and should have, if heeded, given ample warning to prevent the ultimate disaster.

Conclusion

Although incidental to the cause and consequences of the disaster, the errors in installation and subsequent maintenance testing of the complex BOP safety device contain important lessons. It is noted that maintenance procedures, although inadequate since they did not include testing individual BOP functions (the various electric circuits for example)^[3], were nevertheless entirely compliant with regulatory norms. The question is often asked in relation to Reliability Centered Maintenance (RCM) analysis, “Should I conduct an RCM analysis even though we are adhering to all government mandated preventive maintenance tasks?” The answer in this and other cases^[4] is glaringly obvious. RCM requires a thorough analysis of the individual (hidden) functions, their failure modes, effects, and consequences. The mandated test performed on the Deep Water Horizon’s BOP only superficially tested overall function.

© 2014 – 2016, Murray Wiseman. All rights reserved.

1. ^[1]The original source material for this article can be found from the Chemical Safety Board and its Deepwater Horizon investigation described in an article from the New Orleans Times Picayune http://www.nola.com/business/index.ssf/2014/06/watch_how_the bp_deepwater_hor.html↩
2. ^[2]The well blowout began when the Deepwater Horizon (DWH) crew was in the final stages of  temporarily abandoning the well so that a production facility could return later to extract oil and gas. BP’s  temporary abandonment plan called for removing the upper portion of the drilling mud in the well before installing a surface cement plug. The decision proved fateful because both BP and Transocean personnel  on the DWH rig had misinterpreted test results concerning the cement integrity at the bottom of the well.  This error led the personnel to believe that the hydrocarbon bearing zone at the bottom of the well had  been sealed when it was not. Ultimately, the blowout preventer (BOP) was the only physical barrier that  could have potentially contained well fluids, but only if the crew or emergency systems could have successfully engaged it.  As the events of April 20, 2010 indicate, the BOP did not seal the well.↩
3. ^[3]The variety 0f redundancies within the BOP would have received particular attention in a RCM analysis. RCM categorizes these as “hidden functions” and requires thorough analysis. Such an analysis would have established a “failure finding interval” for determining the frequency for testing each hidden (redundant) function.↩
4. ^[4]The operators of Piper Alpha, the 1976 oil platform that exploded, also conducted all regulatory mandated procedures. In that case the mandated procedures themselves resulted in the defeat of the last line of defense, in that case a safety valve. Relying on adherence to the letter of government regulation is demonstrably inadequate.↩