Probe leaves questions about blowout preventer


WASHINGTON — The hydraulic system that powered the blowout preventer at BP’s failed Macondo well may never have had the capacity to stop last year’s Gulf of Mexico spill or any other such emergency, investigators say.

But that possible deficiency – and other findings about the equipment used as a safeguard on thousands of wells – may never get a full airing.

A government-run examination of the device ended in March, and a second round of testing was open only to the Justice Department, the oil spill victims and the three companies connected to the Deepwater Horizon disaster.

“It’s only fair to the industry that they know what happened,” said Gordon Aaker, president of Kingwood-based Engineering Services.

He said too many questions about the Macondo blowout preventer remain for the companies that use similar devices to be confident of avoiding a repeat of the disaster on April 20, 2010.

Engineering Services took par­t a four-month government-led examination of the blowout preventer, or BOP, on behalf of the Chemical Safety Board, an independent agency that also is probing the disaster.

That probe was meant to aid a federal investigation into the root cause of the explosion that killed 11 workers and the resulting oil spill that dumped 4.9 million barrels of crude into the Gulf last year.

To lead the testing, the government hired forensic analysis firm Det Norske Veritas, which concluded in March that cutting rams on the blowout preventer were unable to slash through and seal pipe that had buckled and been pushed askew by flowing oil and gas.

BP sought additional tests, and a federal judge okayed the plan. But the court barred anyone who wasn’t a party in broad oil spill litigation — including the Chemical Safety Board and its investigators — from the second phase of testing that ended late last month at a NASA facility in New Orleans.

Lawyers at the Justice Department concluded that they would not assert CSB’s jurisdiction in court, amid uncertainty about whether the agency was authorized to probe the incident.

Company representatives and other stakeholders are set to do a final walk-through of the testing site today.

It is unclear whether findings from the second phase of testing will be included in a report expected late this month from a federal investigation team or will be made public in any other forum.

Parties to the probe won’t say explicitly whether they will release the information or seek to prevent its release.

A spokeswoman for the federal agency that oversees offshore drilling would not say whether regulators would obtain the data, which could be used in updating government standards for blowout preventers.

“The process of making offshore energy development both safe and sufficient to help meet the nation’s and world’s energy demands will never be complete. It is a continuing, ongoing dynamic enterprise,” said Melissa Schwartz, a spokeswoman for the Bureau of Ocean Energy Management, Regulation and Enforcement. “We will continue to monitor relevant reviews, studies and investigations for information that could inform future rule-making or increase safety enhancements.”

With testing complete, companies are fighting over the fate of the blowout preventer. Transocean, which owned the Deepwater Horizon rig, told a federal judge that it should take possession of the hulking 300-ton device. But BP wants the government to hold on to the equipment.

Det Norske Veritas’ report from the initial four-month examination of the device left unanswered questions, including precisely why a key component called the upper annular failed to seal around drill pipe at the Macondo wellhead on the ocean floor.

Had that annular sealed, it might have kept gas from traveling up a mile of pipe to the Deepwater Horizon, where it ignited.

“One of the most important parts of the phase two testing was to assess the condition of the upper annular and why it failed to close,” Aaker said. “Because that, ultimately, is why (11 men) died. If that thing had closed, it would have saved lives.”

Investigators at Engineering Services also want to know more about the hydraulic system that powered the blowout preventer’s automatic shut-in systems. They have questioned whether the system ever had enough pressure stored in containers called accumulator bottles to drive shear rams through the 6 5/8-inch-diameter drill pipe that was used at the site.

While the stored pressure met existing industry standards and federal regulations, it was substantially lower than indicated on drawings for the rig. Engineering Services investigators said a higher pre-charge pressure would have been relatively easy to set and would have provided an energy reserve for the unexpected.

Without enough pressure, any automatic shut-in activation of the BOP risked a partial, incomplete shearing of the pipe and a gusher like the one in April 2010 – whether the BOP was activated by a surge of oil in the well or another trigger.

For instance, a blowout preventer can be triggered automatically if the BOP loses its hydraulic and power connections with the rig.

Engineering Services’ analysis of a formula provided in 2008 by Cameron International, the Houston-based company that made the BOP, concluded that an operating pressure of 4,200 pounds per square inch is needed at the moment cutting rams push through the pipe.

But a regulator on the Deepwater Horizon’s BOP limited the delivery pressure to the blind shear rams to 4,000 psi.

Additionally, based on Engineering Services’ calculations, the shearing rams probably would have received just 3,700 psi of hydraulic pressure at the moment they confronted the pipe, 500 psi short of what Cameron recommended in 2008 as a “high reliability” value.

Cameron’s 2008 formula updated previous guidance the company had issued in 2001. At that time, Cameron documentation simply said blowout preventers outfitted like the one on the Deepwater Horizon were capable of cutting 6 5/8-inch thick drill pipe weighing 27.6 pounds per foot.

Bill Ambrose, managing director for Transocean’s North American division, insisted that the hydraulic pressure stored in the accumulator system was sufficient to power the shearing rams.

“It did have enough energy to operate the system as designed,” Ambrose said.

A spokesman for Cameron declined to comment.

Jennifer Dlouhy

26 Responses

  1. Deepwater Driller says:

    Bob – well said. There is simply too much press out there about the multiple failures that caused the blowout, but not enough about the ‘failure’ of BP to properly secure the well. To me, that was the real ‘failure’ here. Not the things that were done, but those that were not. Even the commission report failed to cover this aspect properly.

    The conditions for cementing were very poor, and they should never have relied on that cement as their only primary barrier, especially in the short time they waited on it to cure. Even had they run a CBL log, it would not have reached below the landing collar, meaning it would not have given information about the quality of the cement in the shoe track, and below the reservoir to the casing shoe (the flowpath of the oil from reservoir into the casing).

    Also, i think it is a travesty that Weatherford paid 75MM to BP for the float equipment ‘failure’. The float equipment is only a cementing tool, and is to prevent backflow of cement into the casing while it is still liquid (due to differential pressure of the heavier cement). It is NOT designed nor intended to prevent hydrocarbon flow into the casing. So for weatherford to pay out to prevent litigation, when their equipment was not intented to prevent a blowout, is just a copout. The cement job itself was reported to be ‘by the book’, meaning that they did not have flow of cement after the job since the cement and mud density were similar. Therefore the open floats would not have contributed to the inability of the cement to stay static and set properly (there were many other factors present that would have prevented it from setting, such as contamination of the small volume, insufficient waiting on cement time, etc).

    BP did not perform the conversion of float equipment properly anyway – the flowrate to convert (close) the valve was too low, and they tried many times.

    In these downgraded conditions (cementing and float equipment), they should have taken even more precautions – instead they took shortcuts. It would have cost about 2-3 million to put the additional required barriers in place.

  2. Bob says:

    BOPs as designed worked fine. Chevron just cut some pipe on one of their jack ups off Angola with oil base mud and gas going to the crown. Functioned perfectly if not above and beyond the call of duty. Get off the BOPs, check out the humans that put BOPs in situations that are not for any BOP as designed.

  3. Deepwater Driller says:

    Jennifer –

    Just for my knowledge, could you explain what the phrase: “whether the BOP was activated by a surge of oil in the well or another trigger.” was intended to mean exactly?

    I interpret this paragraph as saying that insufficient accumulator pressure could increase risk of a blowout whenever an automatic activation of the BOP occurs, whether it is activated by a surge of oil in the well or another trigger. It then mentions an example of ‘another trigger’ in the following paragraph, describing the deadman function.

    Is this not suggesting that a “surge of oil from the well” is one potential trigger for automatic activation of the BOP?

  4. Jennifer Dlouhy says:

    Digger Dug:

    You are entirely right. The pipe primarily used during drilling at the site was 6 5/8 inches in *diameter*. Apparently after the casing was run, and at the time of the April 20 explosion, a 5.5-inch diameter pipe was used.

  5. Jennifer Dlouhy says:

    Deepwater Driller:

    Indeed, the reference you questioned is not at all in reference to a surge of oil.

    Here, “any automatic shut-in of the well” refers to the device being triggered by AMF, for instance if the hydraulic and power connections between the BOP and the rig were severed. Interestingly, back in the 90s, I’m told there were a rash of cases where there were mechanical disturbances to risers – including a submarine hitting one in the North Sea – that could have caused this.

    Of course, the BOP can also be triggered by crew or automatically (by AMF) if the rig drifts too far from the well it is drilling.

    The CSB investigators’ assertion is that any triggering of the BOP’s AMF during drilling could have risked a partial, incomplete shearing of the pipe and a gusher — and that’s regardless of any deficiencies in the well itself and before any arguably risky abandonment activities, misread pressure tests or other possible problems that led up to the April 20 blowout.

    Also, to be fair, I don’t think this article at all blames the blowout preventer for the blowout. If anything, this story raises investigators’ concerns about a potential vulnerability earlier in the life of the Macondo well — when it was being drilled and before the temporary abandonment process began — because of the pre-charge pressure in the accumulator system on the BOP at th esite.

    As the presidential spill commission members have opined, complex systems fail in complex ways, and every investigation of the April 20 spill thus far has pinpointed a number of possible problems that don’t involve the BOP. That doesn’t mean the BOP functioned as folks clearly would have hoped – nor does it mean they can’t be improved.

  6. Deepwater Driller says:

    Tom – I’m not so sure this is what this paragraph is suggesting. It specifically refers “any automatic shut-in of the BOP” being hindered by insufficient working pressure. And then offers two methods for this automatic shut-in: “activated by a surge of oil or another trigger” (such as the deadman mentioned in the following paragraph, which is accurate.

    I don’t interpret the ‘activated by a surge of oil’ part as being a crew reaction. Plus the activation by the crew is not automatic. Otherwise why not just say ‘activated by the drill crew”?

  7. Deepwater Driller says:

    Just to clear up something else that is inaccurate about this ‘article’:

    “Without enough pressure, any automatic shut-in activation of the BOP risked a partial, incomplete shearing of the pipe and a gusher like the one in April 2010 – whether the BOP was activated by a surge of oil in the well or another trigger.”

    The BOP is not activated byt a ‘surge of oil in the well’. How on earth would this happen? Mud and other fluids are routinely circulated past the BOP in normal operations, so there is no way that it can automatically be activated by a ‘surge’ of anything. It is primarily activated by a human (normally the driller, but redundant control systems are in place in the toolpusher’s office, bridge, etc.). Then as mentioned if power (hydro and/or electrice) is lost to the BOP, the deadman functions.

    And a final comment – why would they not share results of the additional study with the public? We are all ‘victims’ of the oil spill, although i certainly contend that the families of those 11 are the primary ones. I would think that the families would want any information that could prevent another macondo to be shared. And for the companies involved in litigation, if the results of the studies end up in court, wouldn’t it be public record anyway? We need transparency here folks.

    • Tom Fowler says:

      Deepwater Driller
      By “surge of oil” I think she means the rig crew reacting to a surge (as seen via various topside instruments) and activating equipment to get the well back under control.

  8. Deepwater Driller says:

    I’m tired of reading articles like this that blame the BOP for the blowout. This is supporting BP’s claim from day 1 that the cause of this accident was the ‘failure’ of the BOP. I’ve been using the ‘airbag’ analogy that trailer trash mentions. If you crash your car, and because of the damage from the crash, the airbags don’t activate, is the manufacturer at fault for your injuries? Wouldn’t it be more logical to investigate the cause of the crash itself and place the blame there?

    In Macondo’s case, the ‘crash’ (blowout) was caused by a poor barrier philosophy, whereby proper wellbore barriers were not present in the well during abandonment operations. This was not a situation where all reasonable and practical precautions were taken, and an extremely unlikely scenario occured where all of those measures failed at once. There were plenty of steps that could have been taken, commonly done in well construction, that simply were not. Those include: a bridge plug/retainer above the final casing shoe, with additional cement on top, placing heavier mud below the planned surface plug depth so that the well remained overbalanced during/after the seawater displacement of the upper casing/riser, and setting a cement retainer below the surface plug (with mud still in the riser/casing), then setting the surface plug above that (preferably in mud, but even in seawater there would have been an additional barrier in place prior to the displacement).

    Any one of these steps would have prevented (or significantly reduced the severity of) the blowout. Any two of them would certainly have done prevented it.

  9. Mike says:

    Blowout preventers must be redesigned in the future to force centralization proximate to BSRs.

    In the interim, the best means to avoid incinerating drilling crews and devastating the environment in the Gulf is to keep BP as far away from the North American continent as practically possible.

  10. Digger Doug says:

    The article referred to the pipe as being 6 – 5/8 inches thick. That was likely the dameter of the pipe, not the thickness.

  11. Johnson says:

    Were the pipe rams logged as ‘closed and locked’ in the Norske Veritas’ report, does anyone know?

  12. Brian Wilkin says:

    A government run inquiry yields more questions? Really?

  13. Trail Trash says:

    Lots of focus on the BOP, but let’s not loose sight of the fact that 11-people were dead before the BOP shear rams were ever activated. The failure of the BOP caused the rig to sink and the resulting oil spill, but not the deaths. The first response to a well kick is to shut it in and circulate it out, not activate the shear rams.

  14. Trail Trash says:

    olddispatcher, the flowing pressure inside the drill pipe would not have been a factor. It would have been less than the pressure of the drilling mud inside the drill pipe during normal operations. Also, from what I can understand, the shear rams did cut the drill pipe, but the displacement of the pipe from center caused the seal to fail and the flow eroded out around the side of the blade. So it was not a lack of cut, but the lack of a clean cut.

  15. Johnson says:

    Ken, did you mean Pipe rmas instead of casing rams? The flow came from inside the interior of the last casing / hanger string, no? Casing rams would be irrelevenat in this scenario….?

  16. olddispatcher says:

    I think Ken has a point here. The BOP might have worked very well when it came to shearing a pipe that is filled with oil, but if the oil is flowing at 1000 psi (or whatever it was) then could the ram shear a pipe with amount of internal pressure?

    Or…. Could it shear to a close, which is what this is really all about. If the ram did not pinch off the pipe to a close then how many bbls were flowing with the pipe only 80% or whatever closed?

    I, of course, don’t have any answers to this, but it appears there are a lot of lessons to be learned here. I have seen the original valve from the Spindletop well and one look is all you need to understand why it blew out. Valves were improved after that. I am sure valves will be improved after this.

  17. Trail Trash says:

    yonny, I’m not a BOP technician, but it doesn’t sound like the lower activation pressure will be a major issue. I suspect Transocean used the regulator for operational reasons and not anykind of cost savings. The position of the pipe within the BOP seems to be the primary cause of failure. Still, anything which deviates from the manufactured specs will be scrutinized. The increased drilling depths are not a direct factor either. The hydraulic pressures in the BOP are isolated from the water pressure. However, the increased reservoir pressure of deeper formations demands thicker casing strings and some have questioned whether we are exceeding the capabilities of current BOPs.

  18. Ken says:

    Stupid media…. upper annular failed cause it was never designed to hold back that much pressure. Pipe shear rams didnt shear because they were never designed to shear off center pipe. The BOP worked as designed.

    Please stopy muddying the waters and trying to sell papers and just stick to the facts.

    You want a real story, figure out why the casing rams were closed but didnt seal off the well. Very big unanswered question.

  19. yonny says:

    Trail–I have a question for you if you don’t mind. Is there any advantage, operational, fiscal or just overall, to lowering the pressure to the rams? Or would this just be a non-concern operationally? I am just guessing but at the depths this well was at and going deeper would not the increased pressure of those depths make it more critical to maintain the manufacturers recommendations for peak performance? Thanks.

  20. Trail Trash says:

    Peter, I assume you mean how many times have BOPs performed successfully in shutting in a blow out. That is hard to quantify because blow out conditons can vary greatly. I’ve heard other people say “thousands of times”, but everyone on an offshore rig understands that BOPs are not 100% guaranteed to shut in every blow out. According to MMS records, of 89,189 BOP pressure test, only 62 failed. That is a failure rate of less than 1%. So from a mechanical prespective, they are realiable. Under blow out conditions, lots of bad things can happen.

  21. Peter says:

    I’d like to know how many times BOPs were successful. If they had been utilized 200 times in the last 3 decades adn succeeded every time with the same specs, then to me, it’s kind of hard to blame the BOP. Now, on the other hand, if there had been other BOP failures, well, that’s a different story.

  22. honestabe says:

    One of the most important aspects of incident investigation is to prevent further occurrence but once lawyers, politicians or the justice system becomes involved, this learnings become less valuable and skewed towards special interest. One of the worst things the justice department did was open a criminal investigation. People with the most knowledge of what happened began evoking the fifth amendment. Companies began keeping info internal to protect their exposure to liabilities. Safety should be a transparent aspect of all industries but unfortunately in major accidents, there is much interfere and the losers are the people who work in the highest risk areas of these industries. The many Macondo investigations with various causes from each entity protecting its interest, is not helping anyone except the lawyers.

  23. Trail Trash says:

    BOPs are like air bags in a car. It’s important to have them, it’s important that they funtion properly, but you never want to have to use them.

  24. ntangle says:

    Too much time elapsed before the deadman triggered.
    No, the flow momentum was too strong to stop.
    No, the pipe wasn’t fully sheared because it was skewed.
    No, there wasn’t enough pressure stored in the accumulators.
    I’m so confused.