An analysis of the sequence of events on the 20th April which led to the disaster on Deepwater Horizon
By Bill Campbell, Retired HSE Group Auditor, Royal Dutch Shell.
Operating Blind in Deepwater
Only minutes before the blowout on Deepwater Horizon on 20th April everything was reported as being in order. The negative pressure test of the integrity of the well had been good and the displacement of seawater after this test was going fine.
But just 25 minutes after this reassuring message was passed to the senior toolpusher, mud started to overflow from the well onto the drill floor. With only seconds to act and do the right thing mistakes were made which allowed gas to be ingested into areas of the rig where sources of ignition were present. Actions that could have been taken to prevent the ignition of the gas were not taken and four minutes after the blowout commenced most of the crew, on or near the drill floor, were killed in the first explosion.
How all this could have happened on a modern deepwater exploration rig, with an experienced crew, and with sophisticated means at their disposal to monitor the well continually is covered in this article.
21.20 hours: Minutes from Disaster everything was fine
At 21.20 hours the senior toolpusher called the toolpusher at the drill floor to ask how the negative pressure test had gone. The toolpusher responded that the test result was good and that the displacement of seawater from the well was going fine.
In reality however, this confidence was misplaced and would prove fatal. The negative pressure test results had been misinterpreted and as a result hydrocarbons had been flowing into the well from the reservoir for some time.
21.38 hours: Hydrocarbons pass BOP and enter Riser
18 minutes after the reassuring message was given from the drill floor it is estimated that the hydrocarbons had passed the top of the well flowing past the BOP located on the seabed and entered the riser. It had only 5000 feet to flow to reach the surface.
As the oil with its associated gas in solution flowed to the surface the gas would have vaporised as the internal pressure dropped with the gas expanding exponentially as a consequence of this pressure drop. The gas, acting as a propellant, would have accelerated the mud and oil forward with ever increasing velocity.
21.42 Hours: Mud overflows onto the drill floor
Just minutes after the hydrocarbons were estimated to have passed the BOP to enter the riser, and just 22 minutes after the initial assurances were given to the senior toolpusher that things were going fine, the mixture of oil, mud, and gas reached the surface. Mud initially overflowed onto the drill floor but within seconds was being projected an estimated 200 feet into the air.
As all hell breaks loose, mistakes are made
Taken it would appear, completely by surprise, the drill crew may have thought that they were experiencing yet another kick that could be controlled, and took another fatal decision. Rather than maintaining the surge flow via the surge diverter (designed for that very purpose), and which was correctly aligned to route fluids overboard in such emergencies, they instead manually intervened to direct the flow to the mud gathering system. This low pressure and flow system was overwhelmed and the gas in the mud stream was then vented from this system directly onto the rig. Only 25 minutes after the earlier reassuring call received by the senior toolpusher he was now told that the well was blowing out.
Attempts were made from the drill floor to close the BOP but these failed. Two minutes later the gas alarms started to go off with gas rapidly dispersing throughout the rig and within another two minutes the first explosion occurred followed 10 seconds later by a second explosion.
How could this have happened?
What makes this story so incredulous is that this was a modern rig. It had an experienced crew who had previously experience kicks with what was a troublesome well and had been asked by the Regulator to proceed with caution. As an exploration rig drilling operating in deepwater it had sophisticated systems to monitor inflow into and outflow out from the well but yet they the drill crew were apparently totally unaware that a blow-out was developing for 60 minutes or so before mud started flowing onto the drill floor.
The well monitoring system was also designed to measure gains or losses of mud in the active mud pits by constantly measuring pit levels during well operations. Alarm settings on these pit levels could be adjusted by the mudlogger so that if certain criteria were exceeded these alarms would provide early warning to the logger and the Driller that something was amiss. The monitoring of the well as described here was a mandatory requirement of the TransOcean Well Control Manual. So just how could the Driller and mudlogger be unaware that the reservoir fluids had been flowing into the well for some time with all these precautionary measures in place. What went wrong?
The answer to this lies in the detail of the BP report supported by testimony given by Sperry-Sun (whose systems monitored and retrieved considerable data from ongoing well operations this data being available in real-time onshore as well as offshore and who employed the mudloggers) to the joint Inquiry board.
For many hours the crew were operating blind
After the completion of the positive pressure test and before commencement of the negative pressure test a number of simultaneous operations commenced on the rig that influenced the safe and effective monitoring of the well. The Sperry-Sun engineer gave a detailed post mortem explanation of data held in the memory banks of their systems to the Joint Inquiry Board. The data indicated to him that for most of the day, and with respect to the monitoring of the well, the drill crew and mudlogger had been in his words operating blind.
Operations carried out simultaneously with the integrity testing of the well prevented well monitoring at critical times
The die was apparently cast when at 13.28 hours Deepwater Horizon started offloading drilling mud to the M/V Damon Bankston. The mudlogger was apparently concerned about this and told the assistant driller that mud pit levels could not be monitored during offloading.
In reply, the assistant driller told the mudlogger that notice would be provided when offloading ceased but according to testimony given to the Inquiry by Sperry-Sun, and as stated in the BP report, this did not happen.
At 1600 hours up to 17.50 hours another simultaneous operation took place related to the cleaning out of the trip tanks. During this period recorded flow data from the well was unreliable.
Offloading to the vessel ceased but the mudlogger was not aware of this
At 17.17 hours offloading ceased but the mudlogger was not notified and therefore no actions were taken to re-install the well monitoring system and its associated alarms. With no effective well monitoring ongoing the negative pressure test was completed by 1955 hours. This test involved a controlled underbalancing of the well. The BP report estimates that continual flow into the well from the reservoir started around this period when the seawater used to underbalance the well was being circulated out. Thereafter, and up to the time when the mud started spewing out into the drill floor, no monitoring of the well by the mudlogger, or it appears any other competent person, took place.
Herein may lie the explanation of why the drill crew were so taken by surprise it would seem being totally overwhelmed by the events in those crucial minutes and seconds prior to the explosion.
With only seconds to Disaster eleven men need not have died if appropriate actions had been taken
Even at this late stage in the evolving catastrophe, and despite the failure of the BOP, 11 men need not have died. At 21.47 hours the first of many gas alarms sounded. This was still 125 seconds before the gas was ignited when ingested into the Power Generation engine rooms No 2 and 3. These were the on-line Generators and in these switch-rooms and engine spaces there were unfortunately, many sources of ignition.
The rig as designed allowed gas to enter areas where sources of ignition were present no automatic systems were available to prevent this
Although there were combustible gas detectors in the air intakes to these rooms, the operation of these detectors (by design) took no executive action to shut down the power generation or the associated ventilation systems, including the closure of the fire dampers. These areas were simply not protected against gas ingress.
To protect such areas in the event of a gas accident, manual intervention was necessary, but none was taken
On the drill floor there was apparently a means to manually shutdown these unprotected areas where sources of ignition were present with the instruction to be used in a gas accident. The BP report indicates this facility was not used, the drill crews attention not surprisingly being focussed on the emergency.
In testimony to the joint Inquiry, the officer on watch in the bridge, whose principal duties appeared to be related to marine aspects such as the rigs dynamic positioning system observed the gas detectors going into alarm and accepted these alarms. She instigated the general platform alarm and made a number of public address announcements but took no action to trip the power generation and thus shutdown the ventilation to non-hazardous areas such as Engine rooms and associated switch-rooms. It was not clear to me in listening to her testimony whether the facility to do this was located on the bridge but I suspect it was. The chief mate, or master of the vessel, was also on the bridge with her but he also took no actions as described here.
If Power Generation had been tripped manually the explosion could have been avoided
If action had been taken to trip and thus shutdown power generation at this crucial time when the initial gas alarms sounded it is likely that the explosion could have been avoided. There is an important point to be made here for persons who in the future after deepwater drilling commences again have to assess the hazards of operating in deepwater.
Operation of the BOP may not have prevented the explosion
Even if the BOP had operated perfectly the explosion was unavoidable given the action taken. If the BOP had functioned as designed the environmental disaster would have been averted. However, there was circa 5000 feet of riser above the BOP (the riser being for all intents and purposes a vessel containing hydrocarbons under pressure with a volume in excess of 2000 cubic feet) which was open to atmosphere at the surface. This would have created the same gas cloud conditions when the flow was diverted to the low-pressure mud gathering system, as it was.
If the BOP had closed, the only way the explosion could have been avoided is if the flow had remained aligned to a surge diverter. Under such conditions the gas would have been dumped into the atmosphere and being mainly methane (lighter than air) would have rapidly dispersed with the wind taking it away from the rig, if the rig was upwind of the diverter outlet. To cater for wind directions this exploration rig had two surge diverters, port and starboard.
Why was there no automatic actions taken by the gas detection system to trip Power Generation
There is another important point to be made here for persons who in the future after deepwater drilling commences again have to assess the hazards of operating in deepwater. Following the deaths of 167 persons on Piper Alpha some 22 years before this incident it became a requirement in the UK that on detection of gas at circa 20% of the explosive limit Power Generation was to be tripped to reduce sources of ignition. Further areas such as the Engine Rooms on Deepwater Horizon (testimony indicates the seat of the explosion) were to be protected from ingress of gas by the automatic tripping of ventilation systems to these areas and the closure of ventilation inlets and outlets. On Piper Alpha the explosion had resulted from gas being ingested into an area where sources of ignition were present.
None of these measures existed on Deepwater Horizon.
Conflict of interest between Hazards loss of Power Generation on Deepwater Rigs means loss of dynamic positioning
Mobile drilling rigs operating in shallow water up to 500 feet or so are secured on location by a number of chains anchored to the seabed. These rigs have automatic chain tensioning systems to keep the rig on location within given design criteria taking into account the likely weather and sea conditions under which the rig would be expected to carry out routine operations. If there were a loss of power generation on these rigs the vessel is held on location and would not drift under the influence of current, tide or wind. So loss of Power Generation does in itself not cause a hazard to the rig. However the Deepwater Horizon, operating in water depths of 5000 feet plus did not have such an anchoring system. It had some 42mW of installed power generation capacity which provided adequate redundancy such that there would be a reliability of this supply to the rig dynamic positioning system required to continually hold the rig on its exact location within designated design criteria.
A recognised hazard for this type of vessel is loss of power generation, for whatever reason. Under these conditions the vessel will drift and the Emergency Disconnect System (EDS) would require to be operated to disconnect the riser from the BOP. If the EDS system operated as designed the rig would be left drifting still connected to its riser with the obvious hazards associated with this. As the BP report suggests this is likely the reason why designers were reluctant to trip Power Generation automatically on confirmed gas detection. In essence you had two critical safety related issues that were in conflict with each other.
On the 20th April, and this raises questions about planning and what was discussed at the morning meeting with the onshore management, apparently too few crew attempted to do too much with simultaneous activities impinging on the safe completion of each other. All this on a rig that had had serious problems with this well including gas releases and that had been advised to exercise caution by the Regulator. What effect did the visit of the VIPs have, for at critical times there appears from the BP report to have been inadequate supervision at the work-site during critical stages of the operation. The VIP visit was perhaps a distraction that could have been avoided on this busy day.
On Deepwater Horizon inexplicably, despite the negative pressure test indicating beyond reasonable doubt that there was influx into the well, and due it seems to human error and confusion, allied with deviation from fundamentals this test was assumed to be successful when it was not. All that subsequently happened stemmed from this assumption with a sequence of events leading to disaster.
In my opinion this event is not so much about the well as designed but the well as installed. Installing a well is similar to any other civil engineering project in that what is installed has to be tested or commissioned before it is put into use, just as you would test a vessel or pipeline designed to contain hydrocarbons under pressure. Wells, which are discovered to have a problem during integrity tests indicating for example a connection between the well and the reservoir, are worked over to rectify the problem and in a few hours after remedial activities have been undertaken, the integrity testing is re-commenced. The Joint Board of Inquiry no doubt will highlight some factors that give some sort of explanation for the error of judgement re the negative pressure test. For example that there was no detailed test procedure, that the way the test was to be carried out changed in midstream, and that there is actually no test criteria for what represents a successful negative pressure test. And all this compounded by the fact that for a prolonged period, and in deviation of the rules of and procedures laid down by TransOcean, the well was not adequately monitored for many hours prior to the disaster. There were also no detailed procedures or training given to the crew on how to handle the emergency that took them by surprise on the drill floor that fateful day. That this was negligent on the part of TransOcean is indisputable. It may be argued, in future criminal proceedings to have amounted to gross negligence on the part of TransOcean the owner and operator of the rig, we will have to wait and see.