 | Drumbeat: June 4, 2010 | The Oil Drum | BP's Deepwater Oil Spill - Capping the Riser - Part 1 (Cap on, but leaks) - and Open Thread 3 |  |
Lessons Left Unlearnt From 2003 Gulf of Mexico Near-Spill
Posted by JoulesBurn on June 4, 2010 - 7:30am
In May 2003, the Transocean drillship Discoverer Enterprise, under contract from BP, was getting ready to pull out of a nearly-completed development well for the Thunderhorse project in the Gulf of Mexico, about 40 miles south of the current (2010) spill at the Macondo prospect. For some reason, the ship was dragged off its position such that the riser reaching down 6000 feet to the well at the seafloor was snapped off in two places. In this case, a blind-shear ram blow out preventer (BOP) did its job, sealing off the well below and preventing what could have been the largest U.S. oil spill. As it was, the only thing spilled was the drilling mud remaining in the various riser pieces dangling from the ship, buried in mud, or stuck vertically into the seafloor. After rehabilitating the well and then taking stock of the fact that the unthinkable could have happened, BP and Transocean apparently decided not to think about it too much more.
But after reading through some MMS reports, it seems that near-misses happen a lot. Oops.
Don't Push That Button!
Drilling a well in thousands of feet of water from surface vessel is tricky business, and accidents do happen. For a good survey of the various ways in which blowouts can occur, see this rather extensive report. Also, the US Minerals Management Service (MMS), which oversees oil and gas extraction in the northern Gulf of Mexico, makes available on its web site reports of assorted accidents. A number of cases involve the riser becoming disconnected from the wellhead and spilling drilling mud into the water. It can be necessary to do this intentionally, or as part of an automated sequence, if the drillship cannot maintain its position directly above the well within some tolerance due to weather or strong currents. For example, here is one incident from 2005:
On July 5, 2005, an unplanned riser disconnect was initiated on the Ensco 7500 semi-submersible rig, which had been engaged in exploratory drilling activities, because of unfavorable sea and wind conditions associated with an approaching tropical depression. While the riser volume was being displaced with seawater in preparation for the disconnect operation, the rig was no longer able to maintain station adequately enough to complete the operation. As a result, the riser was disconnected from the Lower Marine Riser Package (LMRP), at which time 710 barrels of synthetic-based mud was released from the riser into the GOM. At the time of the disconnect, there were no open hole hydrocarbons exposed below the casing depth.
Here is a case where the disconnect became necessary due to bad data:
On December 2, 2007 at approximately 1300 hours with well completion operations in process, the Dynamic Positioning Operator (DPO) was performing a routine preventive maintenance procedure for the Dynamic Positioning (DP) system when the riser Emergency Disconnect Sequence (EDS) was activated. The disconnect was below the Lower Marine Riser Package (LMRP) where it connects to the BOP stack on top of the wellhead and resulted in the discharge of approximately 550 barrels of Sodium Bromide brine into GOM waters.
For this procedure, DP functional control was transferred from the primary console to the secondary console and the primary console was subsequently shut down. DP functional control using the secondary console was observed to be normal. The primary console was restarted approximately three minutes later and the data backup function was initiated by the DPO. This function transfers control data from the online master console, at this time the secondary console, to other DP consoles to ensure correct synchronization between all consoles. The data transfer from secondary console to primary console was completed but some of the data transferred was corrupted and the DPO did not observe this. Functional control was then transferred from the secondary console to the primary console. The DPO recognized there was a discrepancy for the rig position shown on the both the primary and secondary consoles.
In an attempt to correct the error, the DPO performed a second Initialize Backup function from the now master console, the primary console. This caused corrupt data to be transferred back to secondary console which now gave both the primary console and secondary console corrupt control data. The DPO, along with the Captain, observed the difference between the primary and secondary consoles and began trying to identify the fault. This was done by changing position references, transferring control capability between the control consoles, and enabling/disabling different position reference sensors. This resulted in another position reference sensor inadvertently becoming the master reference sensor and reset the apparent rig position such that the rig began to move further away from location when the DP system was trying to correct the rig position by moving the rig back on location.
This led the DP system to chase after an erroneous position causing the rig to move outside its watch circle and exceed the riser angle limit, thus leading to the initiation of the EDS by the DP system which took approximately 58 seconds to complete. The process was initiated at the Driller Control Panel after confirmation was given by the DPO. The ROV was launched to inspect the wellhead, subsea tree, and BOP stack. The rig was moved to a safe location for the DP system to be analyzed and corrected.
This sequence of events is rather comical. But better still are the cases due directly to human error (although other humans contributed with poor design). Here is one:
The Ocean Concord was in the process of running a liner on drill pipe when the lower marine riser package (LMRP) was inadvertently disconnected from the blowout preventer (BOP) stack. The disconnect resulted in the discharge to the sea of approximately 806 barrels of synthetic mud from the riser and 150 barrels of synthetic mud and 150-200 barrels of crude oil from the wellbore.
Some findings:
- The SSE [Subsea Engineer] was installing the panel guards on the Riser Connector function button on the remote panel at 1410 hours on February 28, 2000.
- The remote panel cover was open and the face of the panel was pulled out at the time of the incident.
- The SSE inadvertently contacted the LMRP disconnect button while he was drilling mounting holes in the BOP panel.
- The SSE was unaware of the LMRP disconnection until he heard the alarms sounding, indicating low accumulator pressure.
- The SSE stated during the Diamond SIR meeting that he did not follow any lockout/tagout procedures to de-energize the BOP control panel prior to working on the panel.
- The light bulbs for the LMRP latch/unlatch functions were burned out at the time of the panel modifications.
The following information was provided to the panel by Diamond from their post-accident SIR meeting:
- The SSE stated that he did not realize it was possible to lock out the remote panel until after the incident.
- The SSE had never been to well-control training. He had worked for another contractor as a roughneck and had recently trained with both subsea engineers on the Concord. The SSE stated that additional training may have helped him prevent this incident. The OIM stated that this was the SSE’s second hitch on his own on the Concord.
- The SSE stated that he knew that if the riser unlatched that there would be a loss of mud from the riser, but he did not know that the well would flow. The SSE also stated that he did not consider "any such risk prior to the job" of installing the panel guards.
Here is yet another problem involving a Sea Surface Engineer pushing buttons by mistake. It can be found in the MMS reports here. The incident date was January 19, 2000.
The rig's subsea engineer was function testing the blind shear rams. The weekly function test was performed from the remote blowout preventer (BOP) panel in the offshore installation manager's office. Instead of testing the blind shear rams, the engineer inadvertently pushed the LMRP button on the panel which unintentionally activated and disconnected the lower marine riser package (LMRP). The control panel buttons for the lower marine riser package (LMRP) did not have enough security to prevent activating the wrong function. It was determined that 2,400 barrels of 60% synthetic-based drilling mud (SBM) leaked into the Gulf of Mexico. It is estimated that the lost SBM contained approximately 1,440 barrels of synthetic base oil.
Based on the block (822), this would be an early well in the Thunderhorse field. However, the first well in that block wasn't completed until 10 months later, based on the development history of the field.
Thunder Horse 2 was drilled in Block 822. It reached its total depth of 29,060ft in November 2000. The well was drilled by the Discoverer Enterprise in 6,300ft of water, 1.5 miles south-east of the discovery well. It encountered 675ft net of pay in three primary intervals.
The discovery well Thunderhorse 1 was completed in 1999 in a different block, leading to the strong probability that this well is indeed Thunderhorse 2 -- and that it took another ten months to finish. This document seems to confirm this identification (see Appendix Table H-2), indicating the drilling started in December 1999. In any case, it brings us back to the broken riser incident we started with as the drillship involved above was also the Transocean Discoverer Enterprise. BP's currently underperforming Thunderhorse endeavor seems to have had a storied beginning as well.
Failure to Disconnect
Here is a brief MMS report on the riser break incident:
The spill occurred at Mississippi Canyon (MC) 778, latitude 28.19 degrees N. and longitude 88.49 degrees W. It occurred as the Discoverer Enterprise was pulling out of the wellhole with bottom location at MC 822. At the time of the incident, conditions were 2-3 ft seas with a 1.9 knot current. The drilling vessel was in the process of pulling of of the hole when it experienced wave action heaving and jarring. The riser parted in two places at approximately 3,200 ft an 5,087 ft. water depths. There was a release of 2,450 barrels of 58% Accolade synthetic-based drilling mud (SBM). It is estimated that the lost SBM contained approximately 1,421 barrels of Accolade synthetic base oil .
I found more details, also apparently from MMS, here.
While drilling in approximately 6,000 feet of water, a drillship recently experienced a catastrophic failure of the marine riser. The drillship was equipped with a dual derrick, and dual activity was being conducted at the time of the incident. On the forward rotary, where the marine riser was installed, the rig crew was in the process of pulling out of the hole from total depth. On the aft rotary, the rig crew was in the process of running 20-inch casing for an adjacent well. The failure of the flanged marine riser occurred when drillpipe had been pulled a couple hundred feet off-bottom. At that time, the rig experienced a heave motion followed by a strong jarring action. The ROV, which had been launched to observe the running of the 20-inch casing, was dispatched to examine the marine riser.
When the ROV reached approximately 3,200 feet of water, it was determined that the riser had separated between riser joint 39 and 40 and was unloading the synthetic-based mud that was in use at the time. The drillpipe was observed to be intact at this depth. As the ROV traced the drillpipe deeper, it was found penetrating the lower section of buoyant riser that was free-standing from the seafloor to approximately 1,000 feet from the mudline. The remainder of the riser was found scattered on the seafloor surrounding the wellhead and BOP stack.
As the ROV scanned the BOP stack, it was determined that the riser was cleanly parted about one foot above the lower marine riser package. There was no flow observed from the well. When the riser parted, the "dead man" system activated, and all fail safe valves, casing shear rams, and lower blind shear rams were closed. The drillpipe was successfully sheared by this activation. At a later point, the ROV used a hot stab to activate a second set of upper blind shear rams to provide another barrier on the wellbore. Although the well control equipment functioned as designed, the parting of the marine riser resulted in a release of an undetermined amount of synthetic based mud.
The subject accident is currently under investigation by MMS. Upon its completion, the investigation report, as well as a possible follow-up Safety Alert, will be made available to the public. Your attention is directed to our conditions of approval for Applications for Permit to Drill involving the use of subsea BOP stacks. The approval outlines our requirements for the shut-in capability of the well in the event of an unplanned disconnect of the lower marine riser package or the parting of the marine riser. It should be noted again that, in this incident, the "deadman" system functioned properly and prevented the release of well bore fluids into the water column.
Shown below is a comparison of the Lower Marine Riser Package (LMRP) for the 2003 Thunderhorse well (with the riser "parted") with that for the 2010 BP Macondo well after the bent riser was cut off with a saw. In the case of the former, the LMRP was disconnected from the BOP using the hot stab panel. For the Macondo well, this must not have been possible, since the "Containment Cap" to collect the oil was apparently designed to be sealed around the existing LMRP.
 |
 |
| Left: LMRP for BP Thunderhorse, 2003. Right: LMRP for BP Macondo, 2010 | |
The Afterspill, and What Could Have Been
The final MMS report on this incident was rather inconclusive as to why the riser was ripped apart.
Fate and Effects of a Spill of Synthetic-Based Drilling Fluid at Mississippi Canyon Block 778
In particular, the Loop Current in the Gulf of Mexico was exonerated:
The Loop Current did not directly affect the MC 778 drill site on May 21, 2003. Currents were weak in the upper 1,100 m (3,609 ft). Current speeds below 1,100 m (3,609 ft) are not known because measurements taken by the operator and made available to MMS did not extend from 1,100 m (3,609 ft) to the seafloor at 1,841 m (6,040 ft).
However, one report on this incident, excerpted in the TAMU spreadsheet, reads as follows:
At the time of the incident, conditions were 2-3 ft seas with a 1.9 knot current. The drilling vessel was in the process of pulling of of the hole when it experienced wave action heaving and jarring. The riser parted in two places at approximately 3,200 ft an 5,087 ft. water depths.
What differentiates this incident (along with many other cases of riser separation) from the 2010 Macondo spill is that the BOPs did what they are supposed to in 2003. Most importantly, the blind-shear BOP engaged, cutting through the drillstring and closing off the well.
What if this hadn't happened? BP definitely thought about this, and worked with the NOAA Office of Response and Restoration to consider the potential impact.
The top connector of the BOP was damaged, with one joint leaning against the BOP, dangerously close to the control lines ....
Loss of well containment would result in more oil spilled in a week than occurred during the whole of the T/V Exxon's Valdez oil spill.
From: COMBINING MODELING WITH RESPONSE IN POTENTIAL DEEP WELL BLOWOUT: LESSONS LEARNED FROM THUNDER HORSE
NOAA performed modeling to gauge the consequences of such a large spill in deepwater, but many unknown parameters prevented definitive conclusions. Indeed, the realization of the scenario with the Macondo spill has provided many surprises with regards to the fate of the oil and gas.
Heck of a Job, BP
Other paperwork which emanated from the near-spill seems less contemplative, but rather more inwardly focused on what went right in a corporate sense. First, we have an article in the Society of Professional Engineers (SPE) journal, which is available in this preview:
Thunder Horse Drilling-Riser Break—The Road to Recovery
Here are the "Major Learnings":
- Show Leadership Commitment.
- Implement Project-Management Practices Quickly.
- Secure the Right External Technical Expertise.
- Get the Right Support Staff.
- Get People in the Right Places.
- Plan How To Communicate Internally and Externally.
Also, BP funded a study by the School of Psychology at the University of Aberdeen, King’s College, Aberdeen, Scotland.
Following the initial message from the rig to the Operations Manager, an Incident Management Team (IMT) was assembled in the Houston office. The IMT immediately began to assess the situation, take steps to give instructions to the rig to assess and control damage, and to plan a longer-term response. The IMT was faced with a challenging situation, one which had never been experienced before especially in such depths of water. Fortunately neither injuries, nor environmental leakage had occurred. A number of separate sub-teams were established and tasked with dealing with issues such as Operations, Riser recovery, Blow Out Preventer (BOP) operability, Well integrity, Well re-entry, and Relief well planning. The task for the IMT was to assess and respond to any potential threat to people, wildlife or the environment, to secure the remaining riser section, to recover scattered riser pieces (on the sea bed), and eventually to re-attach the pipes connecting the rig to the well-head. After a period of 68 days, with a financial cost of $100,000 per day, the rig was re-attached to the well head and the well was stabilised without any leakages to the environment
From: INCIDENT COMMAND SKILLS IN THE MANAGEMENT OF AN OIL INDUSTRY DRILLING INCIDENT
The Missing Memo
While such self-reflection is useful, recent events suggest that something is missing. The difference between a cost of $6.8 million plus 68 days delay, and a cost of untold $billions plus environmental disaster, was the last line of defense, the blowout preventer. In the 2003 spill, and in many similar cases, the fact that the blind-shear BOP functioned as intended is not a sign that the system worked, for a truly fail-safe system would be where the last line of defense from disaster is never reached. MMS did note the alarming trend in this 2005 memo:
Human Engineering Factors Result in Increasing Number of Riser Disconnects
A significant number of accidental riser disconnects have been experienced in deepwater operations during the last five years. Each event had the potential for causing serious well-control issues.
So here we are five years later, and we finally hit paydirt with a failed BOP and a spill for real. We can ponder about what would have transpired if the oversized wire cutters would have worked on the Deepwater Horizon, stopping the Macondo spill before it started. A few internal studies by those involved. Another MMS report of a drilling mud leaking from a severed riser. Louisiana fishermen still working.
Snip.
Contact
- Content: editors at theoildrum dot com
- Tech support: support at theoildrum dot com
License
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.
Very good reporting on an important issue. Kind of puts the odds of a serious accident occurring in a different light!
great work JB.. this does put a very different spin on the whole situation.
the industry cannot claim that this is a bolt from the blue that they could not have anticipated or prevented. the series of near misses and frequent reliance on the BOP in other serious incidents does indeed mean that it was only a matter of time before something like this occurred.
it also casts a lot of doubt on the performance of the regulators. with so many incidents and near misses, the regulators should have been pushing much harder for substantial changes to reduce the odds of a serious incident.
might also be worth mentioning the Montara Oil Spill off NW Australia in August last year.. while very little attention has been paid to it and the investigation is still to be completed, it sounds very similar. Loss of well control, explosion and fire, failure of the BOP to contain the leak and more than two months of oil and gas leaks forming a 100km+ oil spill offshore until the intervention wells cemented the job closed.
so, who's up for reducing their reliance on oil?
"it also casts a lot of doubt on the performance of the regulators"
Same story in the finance world where it is a revolving door between regulators, banksters and government.
Buying regulators and government is the most cost effective thing.
It seems to me that the fall of the berlin wall was in a sense a catalyst for this attitude. Although there was always I'm sure some erosion of the functions of the regulators when the industry could get away with it, after the changes in the eastern block, there was this sense of euphoria, that "capitalism could do no wrong". The talk against "big government" became louder, and the need to reduce regulation etc. All impediments to free enterprise and healthy captitalism.
That's my impression too. Naomi Klein also suggests it in 'Shock doctrine'
They didn't learn because they never pay the full cost of clean up. In contrast to the oil industry's response, the Prince William Sound locals did learn from the experience:
From: http://krillroye.blogspot.com/
Part of the reasoning behind Mark’s early departure for Alaska was to participate in periodic formal training for major oil spill response. Twenty years ago, with the 63’ TRITON, Mark worked extensively in Prince William Sound during the response to the EXXON VALDEZ disaster. Out of that debacle grew an extensive emergency response system which includes, among other assets, a number of commercial fishing vessels and their crews. Periodic special training, drills and exercises are held to assure response readiness, competence and safety.
So it was with lament and terrible irony that the BP disaster in the Gulf of Mexico transpired nearly coincidentally in time with this spring’s training. Special equipment, well adapted boats, and trained crews in Prince William Sound were unfortunately well beyond reach of the disaster in the gulf. We could only commiserate with fishermen and residents there because we knew only too well their pain, frustration and feeling of hopelessness, having all been through it before. We had received the same hollow reassurances and promises, in nearly identical words. Twenty years later only some have been compensated, and even those inadequately.
More maddening, however, was that the lessons of the Exxon debacle seem not to have gone beyond Prince William Sound. Entirely new organizational structures evolved from that spill. Regional citizen oversight, highly organized response structures, pre-positioned equipment, specialized training, and even ship escort grew out of the 1989 disaster. The BP Gulf of Mexico disaster seems a throwback to 1989, with no oversight, poorly organized response, inadequate equipment---all of the aspects of the Exxon spill that motivated such changes in Prince William Sound.
"Heck of a Job, BP"
OMG! I just logged back on to TOD and turned on CNN. It looks like all hell has broken loose, at the BOP and on the open threads on TOD.
How is it that a non-oilco layman engineer like me can predict every mistake that BP has made, yet the "best-of-the-best" jusy keep f'ing up. The clueless comments just keep coming, and BP has this tiny little tube spraying dispersant on this geyser of oil, like pissin' on a forest fire. J'sus F'in' C!
Back to the garden. Things make sense there.
sorry, /rant
"conditions of approval for Applications for Permit to Drill involving the use of subsea BOP stacks. The approval outlines our requirements for the shut-in capability of the well in the event of an unplanned disconnect of the lower marine riser package or the parting of the marine riser."
I wonder if the same approval conditions apply to this well. A big part of being capable of shutting in is that you can do it without fluid coming up the outside of the casing. If the formation can't handle it then you need to choke it back to what can be handled and do a controlled release on the remainder, which would require an operator on the choke manifold. and how exactly is that done with a disconnected, or sunk rig? The casing design on the Maconda limits wellhead pressure to 8 K psi, and the same could possibly hold true for the relief well. Doesn't sound to me like this is capable of being shutin.
From these reports one can see the Blow Out Preventer, which has evolved from over 80 years of oil field experience, is the "save all" in drilling offshore.
This article raises one big question:
Why would BP not make every effort to ensure BOP's proper testing of function? We have reports of low batteries (might not operate valves), questionable accumulator pressure (not sufficient to operating rams), and modifications (this unit was used on previous well drilling operations) that were not fully documented.
BP took shortcuts to save a few hundred thousand $$$, now will end up paying several billion $$$ for their mistakes on Deepwater Horizon. Sounds like upper management not keeping track of what lower management is doing. Their share price will fall allowing some other company to make a hostile takeover of BP.
Too bad for all those pensioners that rely on BP investment for retirement living. Their financial security may be ruined too.
I posted some thoughts about this here:
http://www.theoildrum.com/node/6539#comment-639197
and the comment below is of interest.
Thanks for the link. I did not read the open thread much today.
Your idea of some subsea repairs of BOP sound reasonable, like battey change outs, accumulator recharging or replacement, control valve replacement, etc. These repairs with BOP at wellhead might be less costly in the long run too.
Awesome post chronicling near disasters in the GOM. So this is a "one-in-a-million" event. Clearly this was a "near certain" event. I don't say this lightly, recognizing the economic impact, but a temporary moratorium on offshore drilling doesn't seem excessive. I also personally resolve to reduce my consumption of oil hydrocarbons by at least 25%.
From these reports one can see the Blow Out Preventer, which has evolved from over 80 years of oil field experience, is the "save all" in drilling offshore.
I am not knowledgeable about the current constructs of the BOPs, but in all the figures I've seen only a single set of Blind Shears is present. Several reports indicate that the shear is not capable of cutting through a drill string and collar, yet there is no backup to cover that? Why hasn't there been a second set placed at a position so that if actuated one set will sever the drill string and close the well? Seems 80 years of experience has led to complacency.
A second point: it was mentioned someplace that this BOP was tested before placement, and there is a supposition that a "test set" of Blind Shears was used - then remained in the unit when deployed. Why a test set? If the testing can compromise/damage the existing set, they need to be redesigned to operate more than a single time.
Oh yeah - I suppose I'm one of those pensioners now; my 401K at Fidelity had several oil stocks in its portfolio. Guess I'll go have a beer and drown my sorrows; looks as if my 250ft. motor yacht will have to wait a while. ;^) Cheers!
mb -- I obviously can't tell you what BP was thinking in regards to BOP effectiveness. But I can tell you how I (and just about most who I've worked with) view the BOP. It is not THE PRIMARY system that keeps a well from blowing out. It's a last ditch Hail Mary Pass. You count on it when all else fails. But the "all else" part of the equation are safe drilling practices. Very few hands on the rig involve themselves with the BOP. They are focused on safe drilling practices and monitoring the well for problems. From the unconfirmed reports the well didn't blow out due to BOP failure. It blew out due to poor decisions made with regards to operations. The rig blew up because the BOP failed.
To be more clear: had the BOP functioned properly the well would have still flowed oil/NG up the well bore. Think of this as a contained blow out. The BOP failure led to an uncontained blow out. In fact, they could have prevented the blow out without activating the BOP. Had they realized early on that the well was flowing they could have closed all the return lines and prevented the venting of the oil/NG to the drill floor. Then they could have pumped heavy mud down and killed the flow. As described before this is a standard procedure. Such "kill" events are more common than the public realizes. If the well doesn't exploded there's no news coverage.
BP certainly made operational decisions with an eye on cost control. All operators do the same. But it gets back to "judgment calls". It would appear some poor judgment calls led to the blow out. But the entire event could have been avoided IMHO had they been closely monitoring the mud returns as they displaced the riser/csg. I wouldn't even call that a bad judgment call. It was simply neglecting to conduct a rather standard and proven method of keeping a well safe. Again IF THE EARLY REPORTS ARE CORRECT, the failing to detect the mud flow was THE ultimate failing IMHO. And this failure was not a cost savings effort. It would not have cost BP $1 more for the assigned personnel to monitor the mud returns. They just didn't do it. Just a guess but when the hearings/trials are conducted I suspect a major focus will be on the attitude towards such safe guards. Not just by the hands on the rig but also the signals those personnel got from BP/Transworld management. It won't be black and white. Mostly anecdotal I suspect. But the hands on the rig rely heavily on the attitude of the operator as to how safely they conduct themselves. In my current position I make such judgment calls often. The hands who have worked with me for a while know what I expect from them. And when I get new hands I sit them down and make it very clear what I expect: accidents will happen for a number of reasons. But when one does they better be damn sure the cause wasn't that they were in a hurry or trying to save money. When I ever I issue an order the very last thing I say is: "Don't hurt anyone". Every time...without exception. Drilling hands and subcontractors get chewed on all the time about costs overruns. They want to get another contract from that operator. If the operator establishes an atmosphere where cost control will be a major determining factor in the award of future contracts then it's easy to see why some hands will start making bad choices and taking unnecessary risks. Human nature is what it is whether you're the CEO of BP or a drilling floor hand.
These men knew what was happening. They were all working like hell to save their crew, the rig, the well. There are reports that the derrickhand was in the mudroom when the well blew out, so somebody was looking at the mud returns. And they were probably doing a hundred things at once trying to get the well back under control.
The failure to shut in the well when Schlumberger advised to do so was the point of no return in my view, but it wasnt the only bad call.
The decision to displace 16 plus ppg mud with 10 ppg seawater compounded the problem.
Failing to repair the annular when it tested bad was a huge mistake.
Building a BOP stack without a set of rams cabable of shearing collars or joints was borderline criminal, if thats what happened.
And then extinguishing the fire-that was a catastrophic but understandable rookie mistake.
Maybe having the bosses on the rig made every hand focus on something other than safe operations. Even a little mistake can have huge repercussions with hookweights in the millions and psi in the many thousands.
The real issue is, like most things, peril is ever present and outsiders have no idea. Compound the nature of the oil business with "self regulation" and you have an inevitable blowout. Its not a one in a million event.
The only reason big oil is out so deep in the US GOM is money. The royalties and bonuses in the US are the lowest in the world. There are lots of people handy and a huge market nearby. Big oil needs big assets-and big returns. Not many places a company can invest a marginal $150mm or so and book a $2 billion asset. If oil were $10 or $100 they would be there.
There's plenty else I'm not sure about but I remain 100% convinced this did not happen.
RM, while I understand exactly your point that the emergency function of the BOP is a last-ditch Hail Mary when best practice for well control has failed (or not been followed), is is just not true that you don't depend on the BOP, as its normal functions as the primary valve to control fluids entering or leaving the well are essential for all drilling, cementing and testing operations. One or both of the annulars were damaged and there were hydraulic leaks. They were having to overpressure the lower annular to get the annulus to seal during the testing that was going on (my understanding) and it may well be that when they were trying to get the well under control the normal functions were so compromised that they were unable to do so. Because the normal and emergency functions overlap it could also be that the emergency function was also compromised - so when it came to that point there was no Hail Mary to throw.
In a difficult and risky operation where failure to control a flowing well will result in a situation that defies the capability of existing technology to shut the well in (deepwater environment) it is not reasonable to say that because we don't expect a catastrophe to occur (because if people just do their tasks competently and follow SOP they won't have a problem) that it is ok to have an safety system compromised or incompetent. We can see what the consequence of having to wait for relief wells is.
IP -- I think I follow you but not sure. But the BOP is not the primary control for controlling fluid movement in the well. I think that's your point. Wells are shut in all the time and killed without activating the BOP. IMHO the BOP is actually a terrible way to stop well flow. Look at the malfunction and consequences we are watching today: drill pipe caught in the rams so the well couldn't be sealed off. If matters have gotten so bad you have to activate the BOP you've probably already lost the battle. It certainly has happened but I have no experience with a blow out that was stopped by BOP activation. But I've seen many wells shut in and killed with the primary controls after a kick was detected coming at them. It would really scare the hell out of most to know just how often this happens. Certainly not a "one in a million" occurrence as Tony would describe. Or put it this way: there is an entire industry of kill schools/certifications that companies spend a great deal of money every year sending their hands to. There are computer simulators used in this training. Would they have that training if they didn't think they would have the opportunity to use it? And every kill procedure starts exactly the same way: after you've decided a well is kicking follow this procedure, etc, etc, etc. And how do you know the well is kicking: the mud returns tell you. And if you're not watching the returns then you don't know. And if you don't know then you have no reason to go to the kill sheet. And if you figure it out too late you can't gain control and the well blows out. And someone usually dies. It really is that simple.
You may well be right about normal kill procedures being ineffective. I also have a suspicion that you may be very correct in that the well kick damaged the primary and BOP fucntion so fast that neither was useful. I've been on wells that kicked very hard and even though we were able to keep it from blowing out the high pressure NG had to be sent down a flare line and burned. If not you could blow out your primary control system and have the flare in your face instead of 120' away.
RM -of course I am just trying to digest the information I have been exposed to. My understanding is that the choke and kill lines (controlled through BOP hydraulics - yes?), annulars, pipe rams, and blind shear are all used extensively to control the circulation of fluids (mud, cement, seawater), during normal drilling and testing operations - not correct?
The fact is if the BOP functioned as it should have for a deep water well, this well would not now be spewing 12,000 to 20,000 barrels of oil/day into the GOM. This is a fact regardless of human activity up to the point the riser started ejecting seawater and gas and then exploded.
I recognise your experience on drilling rigs and know that if someone with your skills had been present the BOP would not have needed activation of shear rams or other flow stopping features. The Deepwater Horizon rig never would have gotten to that point.
But, the BOP is meant to cover human errors and other control system errors which CAN and WILL happen on the drill rig floor somewhere at sometime.
But again, testimony from Transocean Senior Toolpusher even named the person who was being paid to monitor the returns at the time. As I said before Miles Ezell was adamant they had not been stood down. When asked if someone could have stood him down without him knowing he replied "Not by anyone who is alive anyway." So presumably all BP personnel also thought that the mud returns were being monitored as well. Unless I'm missing something.
tow -- get use to this argument. We'll probably hear a lot along these lines when the formal hearings begin. Whether you're drilling, running csg, adding drill pipe, displacing the riser or just sitting there picking your nose there is one primary indicator that a well is kicking: mud is flowing back up out of the well with the mud pumps off. On every well that has ever blow out or taken hard kick someone was responsible for watching mud returns. And in many cases that someone wasn't doing it for anyone of a variety of "excuses". Ezel can say no one ordered the hand to stop watching mud returns. He might even be able to show written orders that this hand was to be monitoring mud returns at the time. I've been on many rigs shifting into shut down mode. And it's always the same for the subcontractors: clean your stuff up, pack up and get on the damn boat...NOW! Every hand on the rig knows TPTB are checking their watches every 10 minutes. You want to work for that company again and you do what you know is expected of you. And that isn't always what the "official orders" say. I mentioned before my policy for monitoring mud returns: in addition to the hands that normally do it I also have my company man walk out and check it. And that's just when we turn the pumps off when adding another joint of drill pipe. Not when we're in riskier situation. Most company man think such efforts are below their pay grade. That's their choice. Just as it's mine to run them off. My rule is really simple: you put the safety of the hands/rig above money. Or you don't work for me. I know it might sound contrite to some but it is the attitude of management that determines how safe the hands work. If money is very important to the operator then all the hands know it. And everyone wants to come back for another hitch.
I've heard every excuse in the book for mud returns not being monitored at a critical point. And my response will always the same: get off rig. I don't have a clear picture of the players involved. It might well be that the hand responsible for monitoring mud returns was killed. It will sound harsh and it's certainly premature. But reading between the lines it sounds like the scapegoat(s) are being lined up. And we all know it's rather difficult for the dead to defend themselves.
Rock, the guy he named survived but did not give testimony to the Hearing when he was scheduled to. No press reports say why. I did wonder if Ezell added the curious "by anyone alive" bit because he knows that the person he named is saying (pure speculation on my part) the reason he wasn't monitoring was , claimed to be, due to an instruction by someone now dead. As you say pretty hard to give your version of events when dead.
But I might be (and probably am) totally off with that speculation.
One thing about Ezell's testimony that stuck with me - he was going to stay and help with the operation, felt he should, but someone he trusted very much said "don't worry, we can handle it, get some rest". I think he had some unease about the situation - things weren't really going smoothly, but the "I'll call you if I need you" put him off. When that call came it was too late.
Yes and he poignantly also said, had it not been for the BP VIP tour earlier in the evening, he'd have probably stayed on the rig floor anyway and would have died in the explosion himself.
Last time I checked, the driller's console has a recording chart which monitors mud pit levels electronically. The toolpusher's office can, too. So, the "hand" that monitors the returns is known as the "driller". It's not like you can sit down in the mud pits and monitor the level with your eyeballs. The mud is constantly agitated mechanically as well as sloshing on a floating rig. There is a wire yardstick level in the pits, but have fun reading that to closer than three inches.
Also, when you state that a kick is usually controlled using the primary shut in system, what do you mean? The first thing that is closed upon discovering returns is the Hydril (annular) which is very much a part of the BOP. The pressure in the annulus is then read on the choke manifold.
The annular preventer on a stack of this size (internal diameter) is only good to 10k psi. The pipe and blind rams below are rated at 15k psi.
Actually, the Annular is part of the LMRP. The LMRP is latched onto the BOP. Had they been able to disconnect from the hole the LMRP would have unlatched from the BOP and the rig would have moved away.
Howdy Rockman,
Thanks for the informative post. However, the main article details instances where riser connectivity was suddenly lost. Would your recommendations allow rig workers to deal with the problems that came about when corrupted ship-position data resulted in an unplanned disconnect? Once the riser snaps, it seems to me that the BOP is entirely the resource of last resort. For that reason, isn't it in the interest of the company to have redundant BOPS? You might not need full BOP functionality. It might be sufficient to have a "Top BOP" with the usual functionality and a "Bottom BOP" that just has the gear to sheer through the lines and seal the well. Mostly, you want redundant systems to cut off oil flow if the riser is lost.
Again, thanks very much for all your posts.
geo -- I really have zero experience with riser detachment. But the BOP is below the riser sitting on the well head. I would like to think the BOP would function automaticly if communications with the rig are lost. Again, too far from geology for me to know the details. But one thing for sure: you lose the hydraulic head from the 5,000' of mud in the riser when it snaps off you're almost certain to see the well flow. At that point the only question is whether it going to be oil/NG coming up or formation water.
Excellent
A day that I don't learn anything is a wasted day and this post should cover today and tomorrow.
Agreeed!
One of the better pieces of investigative journalism I have read in a while.
Jon
Ditto, this was an excellent post.
Nice job Joules. Those of us who work with large dynamic physical systems for a living are hardly surprised that screw ups occur regularly. I've been through some of BP's north slope safety training which stresses the importance of reporting, learning from and correcting the situations that lead to near misses (of worker injury/death). Apparently BP's engineering/operations section didn't feel their realm followed the same statistical pattern (the fairly predictable relationship of so many near misses to so many reportable injuries to so many lost time injuries to so many deaths) that their personnel safety arm was so well aware of. Arrogant idiots. Of course BP hardly has a monopoly on that breed.
Riser disconnects or drops in deep water have been going on for for more than 10 years - and not only in the US. Here is one that I was aware of at the time. It occurred in Brazil off Campos, RJ, in, as I remember, more than 1000 meters (more than 3300') of water. Fortunately they had not hit the pay zone at the time and the BOP stack fired as it was designed to.
Hayward acknowledged in an interview published today that it is "entirely fair" to say his company wasn't prepared to fight a catastrophic deepwater oil spill, an event he called a "one in a million" chance.
Well, I guess that the chance of two such accidents happening is one in a trillion.
"Awfully bad luck old chap, must try harder next time"
Usefully calculating the probability of catastrophic failure of a rig or accurately calculating the probability of fixing this failure is incredibly harder in comparison to calculating globally the amount of oil left to be discovered. The latter almost seems trivial now. It all really dependent on how much prior data we have access to and of the validity of the model.
The only thing one can say is the probability of catastrophic failure is finite; while by not drilling, the catastrophic risk is zero since there is a mile of earth separating the oil reservoir from the bottom of the sea floor. Moving the locus of the critical failure point a mile up is the thing that most people seem to not consider. All the other technical considerations seem moot.
That is also why that probability of failure alone is not the bottom line. It is risk, which factors in the repercussions or implications of a failure which acts as the multiplier.
Since calculating the repercussions is equally as hard, getting a number for risk seems impossible. In investing, one might multiply a probability by the potential gain (or loss), but this is only useful if you have many investments such that the statistics work. And unless you are selling something short, you know what the maximum downside is. If shorting, you just declare bankruptcy, or get bailed out if you are TBTF.
Even if there were a way to estimate a probability for failure and put a pricetag on the potential damage, nobody would believe your numbers. The corporations would bring out their paid experts, and the CEOs would just have good severance packages in their contracts.
What I am interested in seeing is the complete failure tree. Was Macondo really improbable, or were there failure cascades that existed? I'm not optimistic that all possibilities were considered. It is amazing that a drillship costing hundreds of millions of dollars would be designed such that a person could inadvertently push a button that would disconnect the riser. Was there a lockout which prevented this if the drillstring was present? How about, at least, an audible alert message, saying "are you damn sure you want to do this??"
The abstract for this SPE paper on the Transocean Discoverer Enterprise explains a lot. See the word "safety" anywhere? In contrast, "efficiency" is used four times, and "cost" eleven.
Elsewhere in the comments, PriorityX linked to a paper that has pages and pages of Fault Tree diagrams for BOP reliability analysis.
http://www.theoildrum.com/node/6543#comment-640647
Lots of discussions about safety and business criticality but nothing on what I would call environmental criticality. As standard practice, safety and reliability are done as separate tasks.
I think you have a good point. The most extreme business critical failure leads to at worst bankruptcy, but then the environmental effects will propagate, as we are witnessing.
The report came out of Norway
I think that my point may have been misinterpreted. The risk is clearly a lot more than "one in a million". I suspect that the insurance companies work to something of the order of "one in a hundred". Judging by the number of deep wells around, it would seem that the probabilities should be even higher - I don't know the total number of comparable well so I am speculating here.
Another point. As I understand it, BP self-insures - it thinks that it is so big and rich that it can save money and time by doing so in-house. IMHO, self-insurance merely encourages managements to pick on the analysts/actuaries who come out with the most favourable figures. Having an insurance company is a little like having a devil's advocate - they look at the worst possible outcomes which guys in-house would not get promoted for doing.
I think that self-insurance should not be allowed on anything where the theoretical downside is that huge.
Another aspect of uncertainty inherent to ultra-deepwater drilling is the evolution of drilling technology which provides new opportunities for equipment and process failures as we exploit increasingly difficult prospects. Specifically, the future of ultra-deepwater drilling appears to be the adoption of dual-gradient drilling (DGD) using Riserless Mud Recovery (RMR) systems.
http://drillingcontractor.org/new-deepwater-riserless-mud-recovery-syste...
http://www.offshore-mag.com/index/article-display/1931523476/articles/of...
Although DGD in deepwater has its genesis in the 1990's (just search the internet or the MMS web site for substantiating documentation), the development of RMR for ultra-deepwater was contingent upon successful development of DGD using SubSea MudLift Drilling (SMD) technology:
http://www.aapg.org/explorer/2001/12dec/hydril.cfm
Elimination of drilling mud in the riser will no doubt reduce some costs and hazards currently associated with ultra-deepwater drilling, but a blow out preventer will still be the last fail-safe device; the first line will be manned by a highly trained work force participating in the oil-drilling industry -- from bolt-tighteners to CEOs. And "success-oriented" regulatory complacency will always be our Achilles' heel.
$6 to $8 Gas? Prices Will "Skyrocket" If U.S. Stops Drilling, Says Former Shell Exec
"The implications for the American consumer and our society and the domestic United States are very seriously at the front of what I think about," says our guest John Hofmeister, former president of Shell Oil and author of Why We Hate the Oil Companies.
http://finance.yahoo.com/tech-ticker/6-to-8-gas-prices-will-%22skyrocket%22-if-u.s.-stops-drilling-says-former-shell-exec-499176.html?tickers=bp,^gspc,^dji,uso,XOM,OIL,XLE
I think BP is evil and we have big problems. With that said, if the EPA says we used 1.6 billion gallons of fuel for recreational boating in the US in 2007 how much petroleum was introduced into the water? Factor of 1% left after combustion or true inboards and 75% goes to the atmosphere leaving 4 million gallons annual just from recreational boats.
Source: http://www.google.com/url?sa=t&source=web&cd=9&ved=0CE0QFjAI&url=http%3A...
Taken in Gulf Shores Alabama 6/4/2010 @ about 12N CDT. No visible oil or smell, but the crowds are definitely down.
I also have a video, though I think you have to be a contributor to post videos directly.
http://www.flickr.com/photos/babariley/4669916994/
The Prelude to Cheney’s Katrina
Of course the big hand made signs you see in news footage backgrounds basicly link BP and Obama...Cheney and Bush never get a mention. Wonder if they get Fox News down that way.
All those accidental disconnects sure cost somebody a lot of money. I wonder if, human nature being what it is, if someone somewhere decided that a few minor changes to the hardware could prevent another one of those silly disconnect events.
Although it's apparently false, I'm reminded of the recent US Stock Market Cliff Dive being caused by a trader typing in "billion" instead of "million" and then hitting the Enter key.
Or the ol' wrench down the missile silo incident. Wonder how heritage this equipment is. Even Clippy from MS Office doing some remonstration to these operators would be a step forward.
Excellent article, very informative.
I'll say! I was amazed by the fact that an LMRP disconnect could be initiated simply by pressing a button on the control panel.
Not even a toggle switch with safety cover as an arming switch that has to be thrown before pressing the button? Or how about a "press and hold for five seconds" button during which time an audible alarm sounds? Or both?
Or is this simply too much safety for the oil industry?
I have visited the Titan Missile Museum/Silo near Tucson and they demonstrate (with audience participation) the launch procedure for the missile (takes two keys, key switches are placed so it is impossible for one person to reach both, keys must be held in turned position for x number of seconds, etc). You don't need that level of security for this, but sheesh! *Press* - BOOM! LMRP away!
Hi JB,
Thanks, I think :-)
I went to the MMS site to do some research after reading your fine article and now, several hours later, am back with some links to reports available on the MMS site that I found interesting, and I hope many of you do too. It will take me a day to read through them, but it will be a welcome break from the well control thread (I think most of you know what I mean).
By the way, I found all these reports by using the search phrase "blow out preventer" on the MMS site.
The first report is interesting because it has numerous pictures of what really goes on inside the BOP, including many showing actual failures.
Assess the Acceptability and Safety of Using Equipment, Particularly BOP and
Wellhead Components, at Pressures in Excess of Rated Working Pressure
The next two reports are very interesting as they evaluate using surface BOPs on offshore drilling rigs.
RISK ASSESSMENT OF SURFACE VS. SUBSURFACE
BOP’S ON MOBILE OFFSHORE DRILLING UNITS
RISK ANALYSIS OF USING A SURFACE BOP
And finally, more in line with your article is a summary report of BOP incidents.
Reliability of Subsea BOP Systems for Deepwater
Application, Phase II DW 11/07/1999
The last report is a must read, IMHO. It was created in 1999, if anyone has a newer report, a link would be greatly appreciated!
Yes that last report is fairly thorough. Yet they talk about reliability in only two aspects, business critically (downtime, etc) and safety criticality. It seems like the environmental criticality has to play a role as well. By this I mean they do go overboard to make it safe for the workers by adding automation, but this same automation is then a killer when things go hay-wire.
Thank you for posting this. Your site has been the best source of news. I emailed one of the long MMS reports to a colleague, it was very useful.
What a mess. The idea of people jumping from a burning rig and a 20 something putting out the distress call (and being berated for it) shows there is a serious, serious, serious problem here.
Edit to my post above. I should have said the search phrase I used was NOT "blow out preventer". That gives the fewest results, followed by "blowout preventer", which gives more results, and then BOP which gives the maximum number of search results.
Thanks for the excellent links. Didn't sound like the operators were all that forthcoming with the info for that 1999 report, I can just imagine how hard it will be getting fresher stuff from them now.
BP now claiming 3600 BPD capture rate.
More accurately, they have claimed 1810 BBL in the first 12 hours of operation.
http://www.bp.com/extendedsectiongenericarticle.do?categoryId=40&content...
They are supposed to start producing through the choke and kill lines already in place. Maybe the combination will collect the majority of the oil. I sure hope so, two more months of this will be unbearable.
I'm saddened that such a crucial thread has gone unappreciated by many. Each oil recovery thread generates more than 10 times the comments that this one has. Yet, that is to be expected I suppose.
A cursory study of reports generated after the 1977 Ixtoc disaster, along with incident reports like the ones above, lead me to believe that offshore drilling will always have a risk of catastrophic environmental failure. Saying otherwise is like saying commercial aviation aircraft will cease crashing to the ground tomorrow because we understand every possible failure and have the technology to counter every failure.
The sad truth is the types failures we face in offshore drilling are not completely understood. The list is certainly lengthy, but it is not complete. Surprises will happen. Usually, they are controllable and adjustments can be made in the future to compensate for them. That still leaves us with the analogy of the airliner falling from the sky. A single unanticipated failure, or combination of failures, may have no solution. All aboard the airliner will die. Likewise, the well will leak uncontrollably for months.
The public rails about our inability to clean up oil and stop leaking oil wells. Why shouldn't they, they were never told the truth. We can no more increase our ability to clean up oil by a single order of magnitude, or engineer systems in advance to stop each atypical leaking well, than we can turn lead into gold. It just is not going to happen in the time frame we have left to pump oil offshore. We can reduce the risk some more just as the airline industry does each year, but risk will remain and it won't be insignificant.
Our government refuses to admit peak oil is here or just around the corner so not telling the truth about our capability to clean up oil and stop leaking oil wells makes some sort of perverse sense.
To the public it seems so simple to "suck up" leaked oil, to "plug" a well, or "capture" the oil leaking out of a pipe. Our regulatory agency, MMS, knew this is not true, Congress knew this was not true, the Administration knew this was not true. So why is it that the risk of offshore drilling with the current safety standards was deemed worth taking? Could steps have been taken based on previous reports that would have increased the safety margin to the point where this tragedy would not have happened?
That's for a later discussion.
Thanks for your support and your comments.
Let's see if we can attract some belated attention...
Britney Spears pregnant with Justin Bieber's love child!
LOL - you're killing me!! Stop it!