Tweet
Regulators Failed to Address Risks in Oil Rig Fail-Safe Device
It was the last line of defense, the final barrier between the rushing volcanic fury of oil and gas and one of the worst environmental disasters in United States history.
Its very name — the blind shear ram — suggested its blunt purpose. When all else failed, if the crew of the Deepwater Horizon oil rig lost control of a well, if a dreaded blowout came, the blind shear ram’s two tough blades were poised to slice through the drill pipe, seal the well and save the day. Everything else could go wrong, just so long as “the pinchers” went right. All it took was one mighty stroke.
On the night of April 20, minutes after an enormous blowout ripped through the Deepwater Horizon, the rig’s desperate crew pinned all hope on this last line of defense.
But the line did not hold.
For days, technicians and engineers worked furiously to figure out why, according to interviews and hundreds of pages of previously unreleased notes scrawled by industry crisis managers in the disaster’s immediate aftermath.
Engineers sent robotic submersibles 5,000 feet deep to prod the blind shear ram, nestled in the bosom of a five-story blowout preventer standing guard over the Macondo well.
They were driven on, documents and interviews reveal, by indications that the shear ram’s blades had come within a few maddening inches of achieving their purpose. Again and again, they tried to make the blades close completely, knowing it was their best chance to end the nightmare of oil and gas billowing into the Gulf of Mexico.
“If that would’ve worked,” a senior oil industry executive said of the blind shear ram, “that rig wouldn’t have burned up and sunk.”
Much remains unknown about the failure of this ultimate fail-safe device. It continues to be a focus of inquiries, and some crucial questions will not be answerable until the blowout preventer is recovered from the sea.
But from documents and interviews, it is possible to piece together some of the decisions and events that came into play when the Deepwater Horizon most needed the blind shear ram.
Engineers contended with hydraulic fluid leaks that may have deprived the ram of crucial cutting force. They struggled to comprehend what was going on in the steel sarcophagus that encased the shear ram, as if trying to perform surgery blindfolded.
They wondered if the blades had by chance closed uselessly on one of the nearly indestructible joints that connect drilling pipe — a significant bit of misfortune, given a decision years before to outfit the Deepwater Horizon’s blowout preventer with just one blind shear ram when other rigs were already beginning to use two of them to guard against just this possibility.
But the questions raised by the failure of the blind shear ram extend well beyond the Deepwater Horizon.
An examination by The New York Times highlights the chasm between the oil industry’s assertions about the reliability of its blowout preventers and a more complex reality. It reveals that the federal agency charged with regulating offshore drilling, the Minerals Management Service, repeatedly declined to act on advice from its own experts on how it could minimize the risk of a blind shear ram failure.
It also shows that the Obama administration failed to grapple with either the well-known weaknesses of blowout preventers or the sufficiency of the nation’s drilling regulations even as it made plans this spring to expand offshore oil exploration.
“What happened to all the stakeholders — Congress, environmental groups, industry, the government — all stakeholders involved were lulled into a sense of what has turned out to be false security,” David J. Hayes, the deputy interior secretary, said in an interview.
Even in one significant instance where the Minerals Management Service did act, it appears to have neglected to enforce a rule that required oil companies to submit proof that their blind shear rams would in fact work.
As it turns out, records and interviews show, blind shear rams can be surprisingly vulnerable. There are many ways for them to fail, some unavoidable, some exacerbated by the stunning water depths at which oil companies have begun to explore.
But they also can be rendered powerless by the failure of a single part, a point underscored in a confidential report that scrutinized the reliability of the Deepwater Horizon’s blowout preventer. The report, from 2000, concluded that the greatest vulnerability by far on the entire blowout preventer was one of the small shuttle valves leading to the blind shear ram. If this valve jammed or leaked, the report warned, the ram’s blades would not budge.
This sort of “single-point failure” figures prominently in an emerging theory of what went wrong with the Deepwater Horizon’s blind shear ram, according to interviews and documents. Some evidence suggests that when the crew activated the blind shear ram, its blades tried to cut the drill pipe, but then failed to finish the job because one or more of its shuttle valves leaked hydraulic fluid.
These kinds of weaknesses were understood inside the oil industry, documents and interviews show. And given the critical importance of the blind shear ram, offshore drillers began adding a layer of redundancy by equipping their blowout preventers with two blind shear rams.
By 2001, when Transocean, now the world’s largest offshore drilling contractor, acquired the Deepwater Horizon, it had already begun equipping its new rigs with blowout preventers that could easily accommodate two blind shear rams.
Today, Transocean says 11 of its 14 rigs in the gulf have two blind shear rams. The company said the three rigs that do not were built before the Deepwater Horizon.
Likewise, every rig currently under contract with BP, which had been renting the Deepwater Horizon, comes with blowout preventers equipped with two blind shear rams, according to BP. While no guarantee against disaster, drilling experts said, two blind shear rams give an extra measure of reliability, especially if one shear ram hits on a joint connecting two drill pipes.
“It’s kind of like a parachute — it’s nice to have a backup,” said Dan Albers, a drilling engineer who is part of an independent investigation of the disaster.
But neither Transocean nor BP took steps to outfit the Deepwater Horizon’s blowout preventer with two blind shear rams. In a statement, BP pointed to the need for the rig to carry its blowout preventer from well to well.
BP said space limitations on the Deepwater Horizon would have prohibited the company from adding a second blind shear ram to the existing configuration on the blowout preventer. But other experts told The Times that a second blind shear ram could have been swapped in for some other component.
In a statement, Transocean said BP would have been responsible for deciding whether the blowout preventer was equipped with one or two blind shear rams; BP said both companies would have been involved.
Whatever the reasoning, the result was that the Deepwater Horizon was left with just one blind shear ram to contain a blowout. And yet, The Times examination found, government regulations do not require any regular checks of several important elements of blind shear rams.
What’s more, when those elements were put to the test after the blowout, some appeared to malfunction. In addition, interviews and documents show that after the crew abandoned the rig, the initial frantic efforts to find another way to activate the blind shear ram were hampered by the lack of submersibles with sufficient power.
Teams of engineers knew they were up against the clock. With each passing hour, more oil and well debris were rattling up through the blowout preventer under tremendous force, almost certainly chewing away at the blades of the blind shear ram — the very blades they still hoped and prayed would come to their rescue.
Vulnerable Devices
Last year, Transocean commissioned a “strictly confidential” study of the reliability of blowout preventers used by deepwater rigs.
Using the world’s most authoritative database of oil rig accidents, a Norwegian company, Det Norske Veritas, focused on some 15,000 wells drilled off North America and in the North Sea from 1980 to 2006.
It found 11 cases where crews on deepwater rigs had lost control of their wells and then activated blowout preventers to prevent a spill. In only six of those cases were the wells brought under control, leading the researchers to conclude that in actual practice, blowout preventers used by deepwater rigs had a “failure” rate of 45 percent.
For all their confident pronouncements about blowout preventers (the “ultimate failsafe device,” some called it), oil industry executives had long known they could be vulnerable and temperamental.
Rising five or more floors and weighing hundreds of thousands of pounds, these devices were daunting in their scale and complexity. There were hundreds of ways they could malfunction or be improperly maintained, tested and operated. Not only did they have to withstand extreme environments, they were relied upon to tame the ferocious forces often unleashed when drilling rigs penetrate reservoirs of highly compressed oil and gas.
They were also costly to maintain. An industry study last year estimated the price of stopping operations to pull up a blowout preventer for repairs at $700 per minute.
Those costs could be enough to draw the attention of Wall Street. Last August, during a conference call with investment analysts, Steven L. Newman, the chief executive of Transocean, was asked why his deepwater fleet had been paid for fewer days of drilling compared with earlier in the year.
Mr. Newman said the fleet had experienced a “handful of B.O.P. problems.”
But he assured the analysts that the problems were not systemic. “They were anomalies,” he said. “I would just leave it at that.”
A draft of another industry-financed study this year contended that companies cut corners on federally mandated tests of blowout preventers. A copy obtained by The Times described a mentality of “I don’t want to find problems; I want to do the minimum necessary to obtain a good test.”
It also included this observation: “Often there is a great deal of pressure to run the B.O.P. stack before it is deemed fit for purpose by the experts who maintain and test the equipment.”
When the report was finalized, those criticisms were omitted, although it is not clear why.
Last Finger in the Dike
Blowout preventers are designed to handle a range of well control problems. They come with several types of rams, giving rig workers flexibility if a situation escalates. But one component in particular has to work properly: the blind shear ram, the last finger in the dike during an uncontrolled blowout.
The danger is not merely theoretical.
More than three decades ago, the failure of a shear ram was partly to blame for one of the largest oil spills on record, a blowout at the Ixtoc 1 well off the Yucatan Peninsula in Mexico. Descriptions of the accident at the time detailed problems both with the shear ram’s ability to cut through thick pipe and with a burst line carrying hydraulic fluids to the blowout preventer.
In 1990, a blind shear ram could not snuff out a major blowout on a rig off Texas. It cut the pipe, but investigators found that the sealing mechanism was damaged. And in 1997, a blind shear ram was unable to slice through a thick joint connecting two sections of drill pipe during a blowout of a deep oil and gas well off the Louisiana coast. Even now, despite advances in technology, it is virtually impossible for a blind shear ram to slice through these joints. In an emergency, there is no time for a driller to make sure the ram’s blades are clear of these joints, which can make up almost 10 percent of the drill pipe’s length.
The problems highlighted by these cases were common knowledge in the drilling industry.
But in two studies, in 2002 and 2004, one of the industry’s premier authorities on blowout preventers, West Engineering Services of Brookshire, Tex., found a more basic problem: even when everything worked right, some blind shear rams still failed to cut pipe.
West’s experts concluded that calculations used by makers of blowout preventers overestimated the cutting ability of blind shear rams, so-called because they close off wells like a window blind. Modern drill pipe is nearly twice as strong as older pipes of the same size. In addition, the intense pressure and frigid temperatures of deep water make it tougher to shear a pipe. These and other “additive pressures,” the researchers found, can demand hundreds of thousands of additional pounds of cutting force.
Yet when the team examined the performance of blind shear rams in blowout preventers on 14 new rigs, it found that seven had never been checked to see if their shear rams would work in deep water. Of the remaining seven, only three “were found able to shear pipe at their maximum rated water depths.”
“This grim snapshot,” the researchers concluded, “illustrates the lack of preparedness in the industry to shear and seal a well with the last line of defense against a blowout.”
Yet as the industry moves into deeper waters, it is pressing to reduce government-mandated testing of blowout preventers. BP and other oil companies helped finance a study early this year arguing that blowout preventer pressure tests conducted every 14 days should be stretched out to every 35 days. The industry estimated the change could save $193 million a year in lost productivity.
The study found that blowout preventers almost always passed the required government tests — there were only 62 failures out of nearly 90,000 tests conducted over several years — but it also raised questions about the effectiveness of these tests.
“It is not possible,” the study pointed out, “to completely simulate” the actual conditions of deepwater wells.
Flawed Oversight
BP is the largest oil producer in the Gulf of Mexico. It pumped 182 million barrels of crude oil from the gulf last year, and it is leading the charge to go deeper. Last fall, while working on another BP well, the Deepwater Horizon drilled a record 35,055 feet.
As with BP, the rig’s owner, Transocean, was aware of the vulnerabilities and limitations of blowout preventers.
But they were not the only ones.
The Minerals Management Service knew the problems, too. In fact, the agency helped pay for many of the studies that warned of their shortcomings, including those in 2002 and 2004 that raised doubts about the ability of blind shear rams to cut pipe under real-world conditions.
In some cases, the agency did not act on the recommendations of its consultants. But in 2003, it adopted a regulation requiring companies to submit test data proving that their blind shear rams could work on the specific drill pipe used on a well and under the pressures they would encounter. Companies had to submit this information to get drill permits.
At least, that was the way it was supposed to work.
Last year, when BP applied for its permit to drill the Macondo well, its application was reviewed by Frank Patton, an engineer in the New Orleans office of the Minerals Management Service. With nearly three decades of experience working for the agency and the oil industry, Mr. Patton was fully aware of the blowout preventer’s importance.
“It is probably the most, in my estimation, the most important factor in maintaining safety of the well and safety of everything involved, the rig and personnel,” he testified last month during the Coast Guard’s inquiry into the disaster.
Yet Mr. Patton said he approved BP’s permit without requiring proof that its blowout preventer could shear pipe and seal a well 5,000 feet down. “When I was in training for this, I was never, as far as I can recall, ever told to look for this statement,” he explained.
Mr. Patton said he had approved hundreds of other well permits in the gulf without requiring this proof, and BP likewise contends that companies have never been asked to furnish this proof on drilling applications.
In subsequent testimony, Michael Saucier, the agency’s regional supervisor for field operations in the gulf, insisted that the regulation was enforced. But asked if anyone ensures that a blowout preventer functions properly, Mr. Saucier replied, “I don’t know if somebody does or not.”
Capt. Hung M. Nguyen, the co-chairman of the Coast Guard inquiry, seemed incredulous at the agency’s deference to the industry on the most critical of safety devices.
“So my understanding,” Captain Nguyen said, “is that it is designed to industry standard, manufactured by industry, installed by industry, with no government witnessing oversight of the construction or the installation. Is that correct?”
“That would be correct,” Mr. Saucier said.
Adding Protection
As a consequence of this arrangement, the agency had little likelihood of knowing what engineering consultants had determined in 2000, when they were asked to assess the specific vulnerabilities of the Deepwater Horizon’s blowout preventer. The consultants, hired by the blowout preventer’s manufacturer, Cameron, zeroed in on what they considered the most serious weakness: the potential failure of the blind shear ram to close.
The consultants said the Deepwater Horizon’s blind shear ram was vulnerable to “single-point failure.” In other words, the breakdown of just one part could result in a catastrophic failure. The consultants focused on one of several T-shaped shuttle valves, which control the flow of pressurized hydraulic fluid that pushes the shear ram’s blades together.
This particular valve has no backup, so if it gets stuck or leaks hydraulic fluid, disaster beckons. In fact, the consultants concluded that this one shuttle valve represented 56 percent of the blowout preventer’s “failure likelihood.”
“Care should be taken to ensure the highest reliability possible from this valve,” they wrote.
In a written statement, BP said the consultants’ report was used “to ensure that critical components and maintenance activities are clearly understood so that system reliability remains high.” The company said a portion of the assessment not seen by The Times found that the blowout preventer’s overall risk of failure was tiny. It declined to release that part of the report.
In the 61 days since the blowout, BP and Transocean have clashed over who was responsible for what on the Deepwater Horizon. In written responses to questions, BP and Transocean differed yet again on why the Deepwater Horizon’s blowout preventer was not originally outfitted — or later converted — to have two blind shear rams.
Transocean said that BP, as the rig’s operator, would have determined the blowout preventer’s configuration. “Operators select B.O.P. stack configurations based on their anticipated operating environments, including water depths, seismic data, anticipated well conditions and the like.”
BP, however, said it was a collaborative decision driven by “contractor preference and operator requirements.” The company emphasized that blowout preventer reliability did not simply boil down to the number of blind shear rams. “These choices are risk assessed to provide the overall stack and system reliability to perform in a wide variety of situations.”
In 2001, just as BP and Transocean were pressing the Deepwater Horizon into service, the Minerals Management Service was being warned against allowing deepwater rigs to operate with only one blind shear ram. The agency had commissioned a study that documented more than 100 failures during testing of blowout preventers.
“All subsea B.O.P. stacks used for deepwater drilling should be equipped with two blind shear rams,” said the report, written by the SINTEF Group, a Scandinavian research organization that advises the oil industry and maintains detailed records on blowouts around the world.
The agency made no such requirement. Indeed, it waited until 2003 to require even one blind shear ram. By then, the industry had already started moving to two blind shear rams — although industry and government records show that roughly two-thirds of the rigs in the gulf today still have only one.
The benefit of two shear rams was examined last year in a report to Transocean. It estimated that while a blowout preventer with a single blind shear ram was 99 percent reliable, having two shear rams increased that reliability to 99.32 percent. Still, the study said, blowout preventers remain vulnerable to the same “single-point failures.”
In 2003, BP and Transocean experienced firsthand the benefits of redundant blind shear rams. On May 21 at 4 a.m., the Transocean rig Discoverer Enterprise, working on a deepwater BP well, was violently jolted. The steel riser that connected the rig to the well had cracked apart in two places. A BP executive would later write that if there had been a blowout, more oil would have spilled in a week “than occurred during the whole of the Exxon’s Valdez oil spill.”
One of the blowout preventer’s blind shear rams was triggered shortly after the jolt and worked as expected. But when a robotic submersible was sent down, it found the blowout preventer damaged. Workers then activated the second blind shear ram, giving an extra layer of safety.
On the other hand, BP and Transocean officials could have drawn reassurance from another close call that year, this one involving the Deepwater Horizon itself. On June 30, 2003, while drilling a 25,000-foot-deep well in the gulf, high winds and strong currents pushed the rig away from the well hole. The crew was forced to perform an emergency disconnect from the blowout preventer, which triggered the blind shear ram.
It worked perfectly. Whether it would have worked as perfectly in an actual blowout, or with a different type of drill pipe, was another matter. The following year, BP opted to remove a layer of redundancy from the blowout preventer. It asked Transocean to replace one of the blowout preventer’s secondary rams with a “test ram” — a device that would save BP money by reducing the time it took to conduct certain well tests. In a joint letter, BP and Transocean executives confirmed that BP was aware that the change “will reduce the built-in redundancy” and raise Transocean’s “risk profile.”
The Deepwater Horizon was scheduled for a series of extensive maintenance checks later this year. The last time it was checked so thoroughly, records indicate, was in 2005, when significant problems with the blowout preventer were uncovered. The control panels on the rig that operate the blowout preventer acted strangely, giving unusual pressure readings and flashing unexplained alarm signals. A critical piece of equipment, the “hot line” that connects the rig to the blowout preventer, was “leaking badly,” Transocean maintenance documents said.
As part of its assessment of the blowout preventer, Transocean hired West Engineering, which had a checklist of more than 250 components and systems to examine. It did not perform 72 of them, mostly for a simple reason: at the time, the Deepwater Horizon was operating in the Gulf of Mexico, and the blowout preventer was on the seafloor and therefore inaccessible.
According to a West Engineering document, one of those 72 items was verifying that the blowout preventer could shear drill pipe and seal off wells in deepwater. This checkup appears to be the last time an independent expert was asked to perform a comprehensive examination of the Deepwater Horizon’s blowout preventer.
The rig’s blowout preventer did get lots of attention from Transocean’s maintenance workers. In January, as the Deepwater Horizon sailed toward the Macondo well site, technicians spent 145 hours repairing and checking the blowout preventer, records show. And the maintenance continued, almost daily, as the drilling began.
A Rich, Difficult Well
The Macondo project yielded a rich prize: one of the largest finds in the Gulf of Mexico. But the crew repeatedly struggled to maintain control of the well against powerful “kicks” of surging gas. They contended with stuck drilling pipes and broken tools. The job fell weeks behind schedule, costing BP millions of dollars in rig rental fees. In e-mail messages, BP engineers vented their frustrations, calling it a “crazy well” and a “nightmare well.”
Yet in April, as BP prepared to seal the well for later production, the company took what numerous industry experts and fellow oil executives say were highly questionable shortcuts. These included using a well design that presented few barriers to high-pressure gas rising up; skipping a crucial $128,000 test of the quality of the cementing; and failing to install capping devices at the top of the well that could also have kept gas from lifting a critical seal.
Representative Henry A. Waxman, chairman of the House Energy and Commerce Committee, asserted last week that the common thread behind all of these decisions was that they saved BP time and money but raised the risk of catastrophe. “BP has cut corner after corner to save $1 million here, a few hours or days there, and now the whole Gulf Coast is paying the price,” Mr. Waxman said.
However, as Tony Hayward, BP’s chief executive, repeatedly told Mr. Waxman’s committee last Thursday, many of these decisions were approved by the Minerals Management Service.
But if federal regulators did not see any problems, some crew members on the Deepwater Horizon appeared to believe that BP’s decisions were, increasing the odds of a catastrophic blowout that only the rig’s blind shear ram could stop. In testimony in the Coast Guard inquiry, Douglas Brown, the rig’s chief mechanic, recalled an argument hours before the explosion between a BP official and Jimmy Harrell, a senior Transocean manager.
Mr. Brown recalled Mr. Harrell walking away, grumbling, “Well, I guess that’s what we have those pinchers for.”
Moment of Crisis
Minutes after the blast at 10:20 p.m. on April 20, Chris Pleasant headed for the bridge. As a subsea engineer who operated the blowout preventer, his first thought was to activate “the pinchers” with the ship’s emergency disconnect system. The system is supposed to trigger the blind shear ram and then free the rig by disconnecting the riser.
Mr. Pleasant immediately noticed that something was amiss. An alarm on the control panel indicated that “the pressure had dropped” in the blowout preventer’s hydraulics, he testified at the Coast Guard hearing. Without hydraulic pressure, the blowout preventer, and especially its blind shear ram, would be useless.
“I’m E.D.S.-ing,” he told the rig’s captain, referring to the emergency system.
The captain told him to hold off and calm down, he recalled. But Mr. Pleasant said he disconnected the system anyway. At first, he said, all seemed well. A control light switched from green to red, indicating that the blind shear ram had been activated.
But then he checked the panel’s flow meters, which measure whether hydraulic fluid is actually flowing under pressure to the blowout preventer. The meters showed no flow, he said. At that moment, he realized the ship and crew were in terrible danger.
“I knew it was time to leave.”
Yet even as emergency rescue operations began under the crippled Deepwater Horizon, the scramble was on to activate the blind shear ram in some other way. The chaos and confusion of those efforts emerge from testimony and documents, including the handwritten crisis team notes.
It was a race against time. The destructive force of oil, drilling mud and well debris blowing through the guts of the blowout preventer was sure to rapidly erode the shear ram’s blades and chew away its seals, leaving it useless.
Some people thought they had days at most. One study considered it “highly unlikely” the blades and seals could withstand a blowout for even five minutes.
It would be 27 hours after Mr. Pleasant abandoned ship before engineers could make their next effort to trigger the blind shear ram, according to BP documents.
Within the first few days, engineers had already begun to wonder whether a leak of hydraulic fluid had crippled the ram. “May have had leak & have lost pressure,” one entry reads. Using a robotic submersible equipped with a hydraulic pump, they injected seawater into the blind shear ram, hoping to drive its pistons and blades closed. But the pump did not have nearly the needed strength; it could not pump water fast enough to budge the blades.
Industry studies had highlighted the problem of submersibles without sufficient strength years earlier. Now, as BP and Transocean officials searched the globe for more powerful ones, engineers plotted out a plan essentially to trick the blind shear ram into closing.
When the rig’s control panels fail, two separate backup systems, the deadman and the autoshear, are supposed to close the blind shear ram automatically. The deadman is designed to close the shear ram if the electronic and hydraulic lines connecting the rig to the blowout preventer are severed.
An underwater robot cut several lines at 2:45 a.m. on April 22.
Nothing happened.
The situation was rapidly deteriorating. “2 explosions around 3:30-4:00 this morning & rig listing at about 35 degrees,” a crisis manager wrote. “High risk of sinking.”
The autoshear is designed to trigger the blind shear ram if a rig drifts out of position and yanks its riser loose from the blowout preventer.
At 7:30 a.m., a submersible cut a firing pin on the blowout preventer, simulating the rig’s pulling free. This time, the blowout preventer shuddered, as if struggling to come back to life. “L.M.R.P. rocked & settled,” one note says, referring to the top half of the blowout preventer. But after a few moments, as oil continued to flow, it became clear that this, too, had failed.
Soon after, the Deepwater Horizon sank.
Stunning Discovery
The deadman, the autoshear and the underwater robots constitute the critical backup systems that have given regulators and oil industry officials great confidence that no matter what, they could always find a way to activate their last line of defense.
This was more an act of faith than a fully tested proposition.
The Minerals Management Service had never required any of these backup systems to be tested despite a report it commissioned in 2003 that said these systems “should probably receive the same attention to verify functionality” as the rest of the blowout preventer. The agency had also declined to take the modest step of requiring rigs to have these backup systems in place at all, though it had sent out a safety alert encouraging their use.
At a BP complex in Houston after the Deepwater Horizon’s sinking, in a room called the hive with video screens displaying feeds from as many as a dozen underwater robots, engineers considered their options. BP officials theorized — perhaps based on the lower estimates of leakage in those first days — that the blind shear ram might have crimped, but not quite severed, the pipe.
The idea provided a comforting mental picture. Just a few more inches with the blind shear ram, the reasoning went, and perhaps it would snap shut and stanch the spewing oil.
So six days after the explosion, they began the fifth effort to close the blind shear ram. This time they sent down tanks of pressurized hydraulic fluid that a submersible could inject directly into the ram.
Shockingly, the blind shear ram’s hydraulic system leaked, meaning pressure could not be maintained on its shearing blades.
This leak shocked engineers because the blowout preventer’s hydraulic system was obsessively checked for leaks. “We see tests fail because the hydraulics leaked two drops,” said Benton Baugh, a leading authority on blowout preventers. Indeed, the blind shear ram had been tested for leaks only hours before the blowout, and according to Transocean, no hydraulic leaks had been detected in the weeks before the blowout.
The underwater robots tried to find and fix the leak, but by now, leaks were springing up on nearly every component of the blowout preventer.
“Retighten leak,” reads a note from 4 a.m. on April 26. At 4:45: “Retest & leak still present.” Fifteen minutes later: “Retighten loose connection.”
Some of those leaks appeared to be coming from shuttle valves leading to the blind shear ram — possibly the “single-point failure” that had been identified as the blowout preventer’s biggest vulnerability back in 2001. Or the leaks could have come from shuttle valves that let hydraulic fluid from the robots reach the blind shear ram.
The leaks pointed to a gaping hole in the government’s mandated leak tests. Those tests do not require rig operators to look for leaks in the connection points used by submersibles to activate a blowout preventer in an emergency.
Finally, seven long days after the explosion, operators of the underwater robots managed to repair the leak on the blind shear ram and apply 5,000 pounds per square inch of hydraulic pressure on its blades. This was nearly double the pressure it typically takes to shear pipe.
A BP report tersely described the results: “No indication of movement.”
But engineers could not be absolutely sure. Without any way to see into the blowout preventer, engineers had essentially been operating blind, using the rate of oil flow, for example, to deduce the conditions inside.
Help came from Scott Watson, an expert in gamma ray imaging at Los Alamos National Laboratory. Gamma rays, a form of electromagnetic radiation similar to X-rays but higher in energy, might at least penetrate a few inches into the blowout preventer’s thick steel walls. Then engineers might be able to see a device called a wedge lock, which slides into place behind the shear ram to hold it closed.
In mid-May, Mr. Watson ventured to the well site, where robotic submersibles were sent down to the seafloor with cobalt 60, a radioactive isotope that generates gamma rays. The team from Los Alamos was able to get a clear view of only one half of the blind shear ram. But the images showed one wedge lock fully engaged, meaning at least one half of the shear ram had deployed.
“I don’t think anybody who saw the pictures thought it was ambiguous,” Mr. Watson said.
It was a crushing moment.
Engineers realized that all their efforts to revive the blowout preventer had probably never budged the critical component at the machine’s core, the blind shear ram. They had assumed that at some point early on, the blades had tried to close. They had hoped to close them all the way. But now, the gamma ray images showed that at least one blade was fully deployed, and they had run out of options for forcing the other one closed. Continuing to push on the ram’s pistons with more hydraulic fluid would achieve nothing.
The last line of defense was a useless carcass of steel.
False Sense of Security
Barely three weeks before the Deepwater Horizon disaster, President Obama announced that he planned to open vast new tracts of ocean for oil exploration, including environmentally sensitive areas that for decades had been declared off limits by presidents from both parties.
Environmental groups were bitterly disappointed, but Mr. Obama said he had arrived at his decision after more than a year of study by his administration, including a careful weighing of environmental risks. Yet the administration’s examination did not question the oil industry’s confident assertions about its drilling technology. The well-known weaknesses of blowout preventers and blind shear rams simply did not make it onto the administration’s radar, interviews and documents show.
Mr. Hayes, the deputy interior secretary, said senior officials were reassured, perhaps wrongly, by “the NASA kind of fervor” over the oil industry’s seemingly “terrific technology.” They took comfort in what appeared to be a comprehensive regime of regulations. Most of all, he said, they were impressed by the rarity of significant oil spills even as more of the nation’s domestic oil supply was being drawn from ultradeep wells.
“The track record was good,” he said. “The results were significant.”
Not even environmental groups bitterly opposed to expanding offshore drilling were raising concerns about the industry’s technology for preventing deepwater spills, he added. “We were not being drawn by anybody to a potential issue with deepwater drilling or blowout preventers.”
As for the Minerals Management Service’s own studies on the vulnerabilities and failings of blowout preventers, Mr. Hayes faulted the agency for not bringing them to the administration’s attention. Long before Mr. Obama’s announcement, Mr. Hayes said, Interior Secretary Ken Salazar had asked the agency for a report describing the potential risks and benefits of expanding offshore drilling.
The report, 219 pages long, made no mention of blind shear rams. It barely mentioned blowout preventers. It did, however, assure Mr. Salazar that safety and engineering requirements were “extensive” and that blowouts were “very rare.”
“We did not have red flags about a problem with the enforcement culture at M.M.S.,” Mr. Hayes said. “We certainly have that now.”
After the Deepwater Horizon blowout, Mr. Obama declared a moratorium on offshore drilling and ordered Mr. Salazar to look for ways to improve safety. Within weeks, Mr. Salazar came back with a long list of changes, most of them clearly responsive to weaknesses that industry and government studies had identified years before.
Mr. Salazar recommended, for example, that all blowout preventers be equipped with two blind shear rams — a step suggested to the Minerals Management Service in 2001. He recommended new rules to make sure rigs were equipped with the right kind of underwater robots and had emergency backup systems to activate blowout preventers — a step suggested to the Minerals Management Service in 2003.
He also urged a break from the agency’s tradition of taking the drilling industry’s word. From now on, he said, government inspectors should witness actual testing on blowout preventers. Rig operators, he said, should have to pay an independent expert to verify that their blowout preventers were properly designed and had not been compromised by modifications.
But Mr. Salazar stopped short of what Mr. Hayward, the BP chief executive, said was called for in the aftermath of the Deepwater Horizon disaster. “We need a fundamental redesign of the blowout preventer,” Mr. Hayward testified last Thursday.
Still, J. Ford Brett, a drilling expert who contributed to Mr. Salazar’s list of suggestions, cautioned that blowout preventers, whatever their design, “will not save you in every situation.”
Mr. Salazar has yet to offer ideas for what to do if another blowout preventer fails thousands of feet beneath the sea. In the absence of a Plan B, he ordered his department to come up with new “deepwater well control procedures” in the next four months.
Already, though, pressure is building on the administration to let offshore drilling operations resume. Last month, Mr. Obama lifted the moratorium on drilling in shallow waters. But along the Gulf Coast, where drilling operations are responsible for an estimated 150,000 jobs, politicians are clamoring for an end to the deepwater moratorium, too.
In Senate testimony on June 9, Mr. Salazar made clear that Mr. Obama had no intention of pulling back permanently from deepwater drilling off the United States coast.
“It was the president’s directive that we press the pause button,” Mr. Salazar said. “It’s important for all of you on this committee to know that word — it’s the pause button. It’s not the stop button.”
Source: nytimes.com
Its very name — the blind shear ram — suggested its blunt purpose. When all else failed, if the crew of the Deepwater Horizon oil rig lost control of a well, if a dreaded blowout came, the blind shear ram’s two tough blades were poised to slice through the drill pipe, seal the well and save the day. Everything else could go wrong, just so long as “the pinchers” went right. All it took was one mighty stroke.
On the night of April 20, minutes after an enormous blowout ripped through the Deepwater Horizon, the rig’s desperate crew pinned all hope on this last line of defense.
But the line did not hold.
For days, technicians and engineers worked furiously to figure out why, according to interviews and hundreds of pages of previously unreleased notes scrawled by industry crisis managers in the disaster’s immediate aftermath.
Engineers sent robotic submersibles 5,000 feet deep to prod the blind shear ram, nestled in the bosom of a five-story blowout preventer standing guard over the Macondo well.
They were driven on, documents and interviews reveal, by indications that the shear ram’s blades had come within a few maddening inches of achieving their purpose. Again and again, they tried to make the blades close completely, knowing it was their best chance to end the nightmare of oil and gas billowing into the Gulf of Mexico.
“If that would’ve worked,” a senior oil industry executive said of the blind shear ram, “that rig wouldn’t have burned up and sunk.”
Much remains unknown about the failure of this ultimate fail-safe device. It continues to be a focus of inquiries, and some crucial questions will not be answerable until the blowout preventer is recovered from the sea.
But from documents and interviews, it is possible to piece together some of the decisions and events that came into play when the Deepwater Horizon most needed the blind shear ram.
Engineers contended with hydraulic fluid leaks that may have deprived the ram of crucial cutting force. They struggled to comprehend what was going on in the steel sarcophagus that encased the shear ram, as if trying to perform surgery blindfolded.
They wondered if the blades had by chance closed uselessly on one of the nearly indestructible joints that connect drilling pipe — a significant bit of misfortune, given a decision years before to outfit the Deepwater Horizon’s blowout preventer with just one blind shear ram when other rigs were already beginning to use two of them to guard against just this possibility.
But the questions raised by the failure of the blind shear ram extend well beyond the Deepwater Horizon.
An examination by The New York Times highlights the chasm between the oil industry’s assertions about the reliability of its blowout preventers and a more complex reality. It reveals that the federal agency charged with regulating offshore drilling, the Minerals Management Service, repeatedly declined to act on advice from its own experts on how it could minimize the risk of a blind shear ram failure.
It also shows that the Obama administration failed to grapple with either the well-known weaknesses of blowout preventers or the sufficiency of the nation’s drilling regulations even as it made plans this spring to expand offshore oil exploration.
“What happened to all the stakeholders — Congress, environmental groups, industry, the government — all stakeholders involved were lulled into a sense of what has turned out to be false security,” David J. Hayes, the deputy interior secretary, said in an interview.
Even in one significant instance where the Minerals Management Service did act, it appears to have neglected to enforce a rule that required oil companies to submit proof that their blind shear rams would in fact work.
As it turns out, records and interviews show, blind shear rams can be surprisingly vulnerable. There are many ways for them to fail, some unavoidable, some exacerbated by the stunning water depths at which oil companies have begun to explore.
But they also can be rendered powerless by the failure of a single part, a point underscored in a confidential report that scrutinized the reliability of the Deepwater Horizon’s blowout preventer. The report, from 2000, concluded that the greatest vulnerability by far on the entire blowout preventer was one of the small shuttle valves leading to the blind shear ram. If this valve jammed or leaked, the report warned, the ram’s blades would not budge.
This sort of “single-point failure” figures prominently in an emerging theory of what went wrong with the Deepwater Horizon’s blind shear ram, according to interviews and documents. Some evidence suggests that when the crew activated the blind shear ram, its blades tried to cut the drill pipe, but then failed to finish the job because one or more of its shuttle valves leaked hydraulic fluid.
These kinds of weaknesses were understood inside the oil industry, documents and interviews show. And given the critical importance of the blind shear ram, offshore drillers began adding a layer of redundancy by equipping their blowout preventers with two blind shear rams.
By 2001, when Transocean, now the world’s largest offshore drilling contractor, acquired the Deepwater Horizon, it had already begun equipping its new rigs with blowout preventers that could easily accommodate two blind shear rams.
Today, Transocean says 11 of its 14 rigs in the gulf have two blind shear rams. The company said the three rigs that do not were built before the Deepwater Horizon.
Likewise, every rig currently under contract with BP, which had been renting the Deepwater Horizon, comes with blowout preventers equipped with two blind shear rams, according to BP. While no guarantee against disaster, drilling experts said, two blind shear rams give an extra measure of reliability, especially if one shear ram hits on a joint connecting two drill pipes.
“It’s kind of like a parachute — it’s nice to have a backup,” said Dan Albers, a drilling engineer who is part of an independent investigation of the disaster.
But neither Transocean nor BP took steps to outfit the Deepwater Horizon’s blowout preventer with two blind shear rams. In a statement, BP pointed to the need for the rig to carry its blowout preventer from well to well.
BP said space limitations on the Deepwater Horizon would have prohibited the company from adding a second blind shear ram to the existing configuration on the blowout preventer. But other experts told The Times that a second blind shear ram could have been swapped in for some other component.
In a statement, Transocean said BP would have been responsible for deciding whether the blowout preventer was equipped with one or two blind shear rams; BP said both companies would have been involved.
Whatever the reasoning, the result was that the Deepwater Horizon was left with just one blind shear ram to contain a blowout. And yet, The Times examination found, government regulations do not require any regular checks of several important elements of blind shear rams.
What’s more, when those elements were put to the test after the blowout, some appeared to malfunction. In addition, interviews and documents show that after the crew abandoned the rig, the initial frantic efforts to find another way to activate the blind shear ram were hampered by the lack of submersibles with sufficient power.
Teams of engineers knew they were up against the clock. With each passing hour, more oil and well debris were rattling up through the blowout preventer under tremendous force, almost certainly chewing away at the blades of the blind shear ram — the very blades they still hoped and prayed would come to their rescue.
Vulnerable Devices
Last year, Transocean commissioned a “strictly confidential” study of the reliability of blowout preventers used by deepwater rigs.
Using the world’s most authoritative database of oil rig accidents, a Norwegian company, Det Norske Veritas, focused on some 15,000 wells drilled off North America and in the North Sea from 1980 to 2006.
It found 11 cases where crews on deepwater rigs had lost control of their wells and then activated blowout preventers to prevent a spill. In only six of those cases were the wells brought under control, leading the researchers to conclude that in actual practice, blowout preventers used by deepwater rigs had a “failure” rate of 45 percent.
For all their confident pronouncements about blowout preventers (the “ultimate failsafe device,” some called it), oil industry executives had long known they could be vulnerable and temperamental.
Rising five or more floors and weighing hundreds of thousands of pounds, these devices were daunting in their scale and complexity. There were hundreds of ways they could malfunction or be improperly maintained, tested and operated. Not only did they have to withstand extreme environments, they were relied upon to tame the ferocious forces often unleashed when drilling rigs penetrate reservoirs of highly compressed oil and gas.
They were also costly to maintain. An industry study last year estimated the price of stopping operations to pull up a blowout preventer for repairs at $700 per minute.
Those costs could be enough to draw the attention of Wall Street. Last August, during a conference call with investment analysts, Steven L. Newman, the chief executive of Transocean, was asked why his deepwater fleet had been paid for fewer days of drilling compared with earlier in the year.
Mr. Newman said the fleet had experienced a “handful of B.O.P. problems.”
But he assured the analysts that the problems were not systemic. “They were anomalies,” he said. “I would just leave it at that.”
A draft of another industry-financed study this year contended that companies cut corners on federally mandated tests of blowout preventers. A copy obtained by The Times described a mentality of “I don’t want to find problems; I want to do the minimum necessary to obtain a good test.”
It also included this observation: “Often there is a great deal of pressure to run the B.O.P. stack before it is deemed fit for purpose by the experts who maintain and test the equipment.”
When the report was finalized, those criticisms were omitted, although it is not clear why.
Last Finger in the Dike
Blowout preventers are designed to handle a range of well control problems. They come with several types of rams, giving rig workers flexibility if a situation escalates. But one component in particular has to work properly: the blind shear ram, the last finger in the dike during an uncontrolled blowout.
The danger is not merely theoretical.
More than three decades ago, the failure of a shear ram was partly to blame for one of the largest oil spills on record, a blowout at the Ixtoc 1 well off the Yucatan Peninsula in Mexico. Descriptions of the accident at the time detailed problems both with the shear ram’s ability to cut through thick pipe and with a burst line carrying hydraulic fluids to the blowout preventer.
In 1990, a blind shear ram could not snuff out a major blowout on a rig off Texas. It cut the pipe, but investigators found that the sealing mechanism was damaged. And in 1997, a blind shear ram was unable to slice through a thick joint connecting two sections of drill pipe during a blowout of a deep oil and gas well off the Louisiana coast. Even now, despite advances in technology, it is virtually impossible for a blind shear ram to slice through these joints. In an emergency, there is no time for a driller to make sure the ram’s blades are clear of these joints, which can make up almost 10 percent of the drill pipe’s length.
The problems highlighted by these cases were common knowledge in the drilling industry.
But in two studies, in 2002 and 2004, one of the industry’s premier authorities on blowout preventers, West Engineering Services of Brookshire, Tex., found a more basic problem: even when everything worked right, some blind shear rams still failed to cut pipe.
West’s experts concluded that calculations used by makers of blowout preventers overestimated the cutting ability of blind shear rams, so-called because they close off wells like a window blind. Modern drill pipe is nearly twice as strong as older pipes of the same size. In addition, the intense pressure and frigid temperatures of deep water make it tougher to shear a pipe. These and other “additive pressures,” the researchers found, can demand hundreds of thousands of additional pounds of cutting force.
Yet when the team examined the performance of blind shear rams in blowout preventers on 14 new rigs, it found that seven had never been checked to see if their shear rams would work in deep water. Of the remaining seven, only three “were found able to shear pipe at their maximum rated water depths.”
“This grim snapshot,” the researchers concluded, “illustrates the lack of preparedness in the industry to shear and seal a well with the last line of defense against a blowout.”
Yet as the industry moves into deeper waters, it is pressing to reduce government-mandated testing of blowout preventers. BP and other oil companies helped finance a study early this year arguing that blowout preventer pressure tests conducted every 14 days should be stretched out to every 35 days. The industry estimated the change could save $193 million a year in lost productivity.
The study found that blowout preventers almost always passed the required government tests — there were only 62 failures out of nearly 90,000 tests conducted over several years — but it also raised questions about the effectiveness of these tests.
“It is not possible,” the study pointed out, “to completely simulate” the actual conditions of deepwater wells.
Flawed Oversight
BP is the largest oil producer in the Gulf of Mexico. It pumped 182 million barrels of crude oil from the gulf last year, and it is leading the charge to go deeper. Last fall, while working on another BP well, the Deepwater Horizon drilled a record 35,055 feet.
As with BP, the rig’s owner, Transocean, was aware of the vulnerabilities and limitations of blowout preventers.
But they were not the only ones.
The Minerals Management Service knew the problems, too. In fact, the agency helped pay for many of the studies that warned of their shortcomings, including those in 2002 and 2004 that raised doubts about the ability of blind shear rams to cut pipe under real-world conditions.
In some cases, the agency did not act on the recommendations of its consultants. But in 2003, it adopted a regulation requiring companies to submit test data proving that their blind shear rams could work on the specific drill pipe used on a well and under the pressures they would encounter. Companies had to submit this information to get drill permits.
At least, that was the way it was supposed to work.
Last year, when BP applied for its permit to drill the Macondo well, its application was reviewed by Frank Patton, an engineer in the New Orleans office of the Minerals Management Service. With nearly three decades of experience working for the agency and the oil industry, Mr. Patton was fully aware of the blowout preventer’s importance.
“It is probably the most, in my estimation, the most important factor in maintaining safety of the well and safety of everything involved, the rig and personnel,” he testified last month during the Coast Guard’s inquiry into the disaster.
Yet Mr. Patton said he approved BP’s permit without requiring proof that its blowout preventer could shear pipe and seal a well 5,000 feet down. “When I was in training for this, I was never, as far as I can recall, ever told to look for this statement,” he explained.
Mr. Patton said he had approved hundreds of other well permits in the gulf without requiring this proof, and BP likewise contends that companies have never been asked to furnish this proof on drilling applications.
In subsequent testimony, Michael Saucier, the agency’s regional supervisor for field operations in the gulf, insisted that the regulation was enforced. But asked if anyone ensures that a blowout preventer functions properly, Mr. Saucier replied, “I don’t know if somebody does or not.”
Capt. Hung M. Nguyen, the co-chairman of the Coast Guard inquiry, seemed incredulous at the agency’s deference to the industry on the most critical of safety devices.
“So my understanding,” Captain Nguyen said, “is that it is designed to industry standard, manufactured by industry, installed by industry, with no government witnessing oversight of the construction or the installation. Is that correct?”
“That would be correct,” Mr. Saucier said.
Adding Protection
As a consequence of this arrangement, the agency had little likelihood of knowing what engineering consultants had determined in 2000, when they were asked to assess the specific vulnerabilities of the Deepwater Horizon’s blowout preventer. The consultants, hired by the blowout preventer’s manufacturer, Cameron, zeroed in on what they considered the most serious weakness: the potential failure of the blind shear ram to close.
The consultants said the Deepwater Horizon’s blind shear ram was vulnerable to “single-point failure.” In other words, the breakdown of just one part could result in a catastrophic failure. The consultants focused on one of several T-shaped shuttle valves, which control the flow of pressurized hydraulic fluid that pushes the shear ram’s blades together.
This particular valve has no backup, so if it gets stuck or leaks hydraulic fluid, disaster beckons. In fact, the consultants concluded that this one shuttle valve represented 56 percent of the blowout preventer’s “failure likelihood.”
“Care should be taken to ensure the highest reliability possible from this valve,” they wrote.
In a written statement, BP said the consultants’ report was used “to ensure that critical components and maintenance activities are clearly understood so that system reliability remains high.” The company said a portion of the assessment not seen by The Times found that the blowout preventer’s overall risk of failure was tiny. It declined to release that part of the report.
In the 61 days since the blowout, BP and Transocean have clashed over who was responsible for what on the Deepwater Horizon. In written responses to questions, BP and Transocean differed yet again on why the Deepwater Horizon’s blowout preventer was not originally outfitted — or later converted — to have two blind shear rams.
Transocean said that BP, as the rig’s operator, would have determined the blowout preventer’s configuration. “Operators select B.O.P. stack configurations based on their anticipated operating environments, including water depths, seismic data, anticipated well conditions and the like.”
BP, however, said it was a collaborative decision driven by “contractor preference and operator requirements.” The company emphasized that blowout preventer reliability did not simply boil down to the number of blind shear rams. “These choices are risk assessed to provide the overall stack and system reliability to perform in a wide variety of situations.”
In 2001, just as BP and Transocean were pressing the Deepwater Horizon into service, the Minerals Management Service was being warned against allowing deepwater rigs to operate with only one blind shear ram. The agency had commissioned a study that documented more than 100 failures during testing of blowout preventers.
“All subsea B.O.P. stacks used for deepwater drilling should be equipped with two blind shear rams,” said the report, written by the SINTEF Group, a Scandinavian research organization that advises the oil industry and maintains detailed records on blowouts around the world.
The agency made no such requirement. Indeed, it waited until 2003 to require even one blind shear ram. By then, the industry had already started moving to two blind shear rams — although industry and government records show that roughly two-thirds of the rigs in the gulf today still have only one.
The benefit of two shear rams was examined last year in a report to Transocean. It estimated that while a blowout preventer with a single blind shear ram was 99 percent reliable, having two shear rams increased that reliability to 99.32 percent. Still, the study said, blowout preventers remain vulnerable to the same “single-point failures.”
In 2003, BP and Transocean experienced firsthand the benefits of redundant blind shear rams. On May 21 at 4 a.m., the Transocean rig Discoverer Enterprise, working on a deepwater BP well, was violently jolted. The steel riser that connected the rig to the well had cracked apart in two places. A BP executive would later write that if there had been a blowout, more oil would have spilled in a week “than occurred during the whole of the Exxon’s Valdez oil spill.”
One of the blowout preventer’s blind shear rams was triggered shortly after the jolt and worked as expected. But when a robotic submersible was sent down, it found the blowout preventer damaged. Workers then activated the second blind shear ram, giving an extra layer of safety.
On the other hand, BP and Transocean officials could have drawn reassurance from another close call that year, this one involving the Deepwater Horizon itself. On June 30, 2003, while drilling a 25,000-foot-deep well in the gulf, high winds and strong currents pushed the rig away from the well hole. The crew was forced to perform an emergency disconnect from the blowout preventer, which triggered the blind shear ram.
It worked perfectly. Whether it would have worked as perfectly in an actual blowout, or with a different type of drill pipe, was another matter. The following year, BP opted to remove a layer of redundancy from the blowout preventer. It asked Transocean to replace one of the blowout preventer’s secondary rams with a “test ram” — a device that would save BP money by reducing the time it took to conduct certain well tests. In a joint letter, BP and Transocean executives confirmed that BP was aware that the change “will reduce the built-in redundancy” and raise Transocean’s “risk profile.”
The Deepwater Horizon was scheduled for a series of extensive maintenance checks later this year. The last time it was checked so thoroughly, records indicate, was in 2005, when significant problems with the blowout preventer were uncovered. The control panels on the rig that operate the blowout preventer acted strangely, giving unusual pressure readings and flashing unexplained alarm signals. A critical piece of equipment, the “hot line” that connects the rig to the blowout preventer, was “leaking badly,” Transocean maintenance documents said.
As part of its assessment of the blowout preventer, Transocean hired West Engineering, which had a checklist of more than 250 components and systems to examine. It did not perform 72 of them, mostly for a simple reason: at the time, the Deepwater Horizon was operating in the Gulf of Mexico, and the blowout preventer was on the seafloor and therefore inaccessible.
According to a West Engineering document, one of those 72 items was verifying that the blowout preventer could shear drill pipe and seal off wells in deepwater. This checkup appears to be the last time an independent expert was asked to perform a comprehensive examination of the Deepwater Horizon’s blowout preventer.
The rig’s blowout preventer did get lots of attention from Transocean’s maintenance workers. In January, as the Deepwater Horizon sailed toward the Macondo well site, technicians spent 145 hours repairing and checking the blowout preventer, records show. And the maintenance continued, almost daily, as the drilling began.
A Rich, Difficult Well
The Macondo project yielded a rich prize: one of the largest finds in the Gulf of Mexico. But the crew repeatedly struggled to maintain control of the well against powerful “kicks” of surging gas. They contended with stuck drilling pipes and broken tools. The job fell weeks behind schedule, costing BP millions of dollars in rig rental fees. In e-mail messages, BP engineers vented their frustrations, calling it a “crazy well” and a “nightmare well.”
Yet in April, as BP prepared to seal the well for later production, the company took what numerous industry experts and fellow oil executives say were highly questionable shortcuts. These included using a well design that presented few barriers to high-pressure gas rising up; skipping a crucial $128,000 test of the quality of the cementing; and failing to install capping devices at the top of the well that could also have kept gas from lifting a critical seal.
Representative Henry A. Waxman, chairman of the House Energy and Commerce Committee, asserted last week that the common thread behind all of these decisions was that they saved BP time and money but raised the risk of catastrophe. “BP has cut corner after corner to save $1 million here, a few hours or days there, and now the whole Gulf Coast is paying the price,” Mr. Waxman said.
However, as Tony Hayward, BP’s chief executive, repeatedly told Mr. Waxman’s committee last Thursday, many of these decisions were approved by the Minerals Management Service.
But if federal regulators did not see any problems, some crew members on the Deepwater Horizon appeared to believe that BP’s decisions were, increasing the odds of a catastrophic blowout that only the rig’s blind shear ram could stop. In testimony in the Coast Guard inquiry, Douglas Brown, the rig’s chief mechanic, recalled an argument hours before the explosion between a BP official and Jimmy Harrell, a senior Transocean manager.
Mr. Brown recalled Mr. Harrell walking away, grumbling, “Well, I guess that’s what we have those pinchers for.”
Moment of Crisis
Minutes after the blast at 10:20 p.m. on April 20, Chris Pleasant headed for the bridge. As a subsea engineer who operated the blowout preventer, his first thought was to activate “the pinchers” with the ship’s emergency disconnect system. The system is supposed to trigger the blind shear ram and then free the rig by disconnecting the riser.
Mr. Pleasant immediately noticed that something was amiss. An alarm on the control panel indicated that “the pressure had dropped” in the blowout preventer’s hydraulics, he testified at the Coast Guard hearing. Without hydraulic pressure, the blowout preventer, and especially its blind shear ram, would be useless.
“I’m E.D.S.-ing,” he told the rig’s captain, referring to the emergency system.
The captain told him to hold off and calm down, he recalled. But Mr. Pleasant said he disconnected the system anyway. At first, he said, all seemed well. A control light switched from green to red, indicating that the blind shear ram had been activated.
But then he checked the panel’s flow meters, which measure whether hydraulic fluid is actually flowing under pressure to the blowout preventer. The meters showed no flow, he said. At that moment, he realized the ship and crew were in terrible danger.
“I knew it was time to leave.”
Yet even as emergency rescue operations began under the crippled Deepwater Horizon, the scramble was on to activate the blind shear ram in some other way. The chaos and confusion of those efforts emerge from testimony and documents, including the handwritten crisis team notes.
It was a race against time. The destructive force of oil, drilling mud and well debris blowing through the guts of the blowout preventer was sure to rapidly erode the shear ram’s blades and chew away its seals, leaving it useless.
Some people thought they had days at most. One study considered it “highly unlikely” the blades and seals could withstand a blowout for even five minutes.
It would be 27 hours after Mr. Pleasant abandoned ship before engineers could make their next effort to trigger the blind shear ram, according to BP documents.
Within the first few days, engineers had already begun to wonder whether a leak of hydraulic fluid had crippled the ram. “May have had leak & have lost pressure,” one entry reads. Using a robotic submersible equipped with a hydraulic pump, they injected seawater into the blind shear ram, hoping to drive its pistons and blades closed. But the pump did not have nearly the needed strength; it could not pump water fast enough to budge the blades.
Industry studies had highlighted the problem of submersibles without sufficient strength years earlier. Now, as BP and Transocean officials searched the globe for more powerful ones, engineers plotted out a plan essentially to trick the blind shear ram into closing.
When the rig’s control panels fail, two separate backup systems, the deadman and the autoshear, are supposed to close the blind shear ram automatically. The deadman is designed to close the shear ram if the electronic and hydraulic lines connecting the rig to the blowout preventer are severed.
An underwater robot cut several lines at 2:45 a.m. on April 22.
Nothing happened.
The situation was rapidly deteriorating. “2 explosions around 3:30-4:00 this morning & rig listing at about 35 degrees,” a crisis manager wrote. “High risk of sinking.”
The autoshear is designed to trigger the blind shear ram if a rig drifts out of position and yanks its riser loose from the blowout preventer.
At 7:30 a.m., a submersible cut a firing pin on the blowout preventer, simulating the rig’s pulling free. This time, the blowout preventer shuddered, as if struggling to come back to life. “L.M.R.P. rocked & settled,” one note says, referring to the top half of the blowout preventer. But after a few moments, as oil continued to flow, it became clear that this, too, had failed.
Soon after, the Deepwater Horizon sank.
Stunning Discovery
The deadman, the autoshear and the underwater robots constitute the critical backup systems that have given regulators and oil industry officials great confidence that no matter what, they could always find a way to activate their last line of defense.
This was more an act of faith than a fully tested proposition.
The Minerals Management Service had never required any of these backup systems to be tested despite a report it commissioned in 2003 that said these systems “should probably receive the same attention to verify functionality” as the rest of the blowout preventer. The agency had also declined to take the modest step of requiring rigs to have these backup systems in place at all, though it had sent out a safety alert encouraging their use.
At a BP complex in Houston after the Deepwater Horizon’s sinking, in a room called the hive with video screens displaying feeds from as many as a dozen underwater robots, engineers considered their options. BP officials theorized — perhaps based on the lower estimates of leakage in those first days — that the blind shear ram might have crimped, but not quite severed, the pipe.
The idea provided a comforting mental picture. Just a few more inches with the blind shear ram, the reasoning went, and perhaps it would snap shut and stanch the spewing oil.
So six days after the explosion, they began the fifth effort to close the blind shear ram. This time they sent down tanks of pressurized hydraulic fluid that a submersible could inject directly into the ram.
Shockingly, the blind shear ram’s hydraulic system leaked, meaning pressure could not be maintained on its shearing blades.
This leak shocked engineers because the blowout preventer’s hydraulic system was obsessively checked for leaks. “We see tests fail because the hydraulics leaked two drops,” said Benton Baugh, a leading authority on blowout preventers. Indeed, the blind shear ram had been tested for leaks only hours before the blowout, and according to Transocean, no hydraulic leaks had been detected in the weeks before the blowout.
The underwater robots tried to find and fix the leak, but by now, leaks were springing up on nearly every component of the blowout preventer.
“Retighten leak,” reads a note from 4 a.m. on April 26. At 4:45: “Retest & leak still present.” Fifteen minutes later: “Retighten loose connection.”
Some of those leaks appeared to be coming from shuttle valves leading to the blind shear ram — possibly the “single-point failure” that had been identified as the blowout preventer’s biggest vulnerability back in 2001. Or the leaks could have come from shuttle valves that let hydraulic fluid from the robots reach the blind shear ram.
The leaks pointed to a gaping hole in the government’s mandated leak tests. Those tests do not require rig operators to look for leaks in the connection points used by submersibles to activate a blowout preventer in an emergency.
Finally, seven long days after the explosion, operators of the underwater robots managed to repair the leak on the blind shear ram and apply 5,000 pounds per square inch of hydraulic pressure on its blades. This was nearly double the pressure it typically takes to shear pipe.
A BP report tersely described the results: “No indication of movement.”
But engineers could not be absolutely sure. Without any way to see into the blowout preventer, engineers had essentially been operating blind, using the rate of oil flow, for example, to deduce the conditions inside.
Help came from Scott Watson, an expert in gamma ray imaging at Los Alamos National Laboratory. Gamma rays, a form of electromagnetic radiation similar to X-rays but higher in energy, might at least penetrate a few inches into the blowout preventer’s thick steel walls. Then engineers might be able to see a device called a wedge lock, which slides into place behind the shear ram to hold it closed.
In mid-May, Mr. Watson ventured to the well site, where robotic submersibles were sent down to the seafloor with cobalt 60, a radioactive isotope that generates gamma rays. The team from Los Alamos was able to get a clear view of only one half of the blind shear ram. But the images showed one wedge lock fully engaged, meaning at least one half of the shear ram had deployed.
“I don’t think anybody who saw the pictures thought it was ambiguous,” Mr. Watson said.
It was a crushing moment.
Engineers realized that all their efforts to revive the blowout preventer had probably never budged the critical component at the machine’s core, the blind shear ram. They had assumed that at some point early on, the blades had tried to close. They had hoped to close them all the way. But now, the gamma ray images showed that at least one blade was fully deployed, and they had run out of options for forcing the other one closed. Continuing to push on the ram’s pistons with more hydraulic fluid would achieve nothing.
The last line of defense was a useless carcass of steel.
False Sense of Security
Barely three weeks before the Deepwater Horizon disaster, President Obama announced that he planned to open vast new tracts of ocean for oil exploration, including environmentally sensitive areas that for decades had been declared off limits by presidents from both parties.
Environmental groups were bitterly disappointed, but Mr. Obama said he had arrived at his decision after more than a year of study by his administration, including a careful weighing of environmental risks. Yet the administration’s examination did not question the oil industry’s confident assertions about its drilling technology. The well-known weaknesses of blowout preventers and blind shear rams simply did not make it onto the administration’s radar, interviews and documents show.
Mr. Hayes, the deputy interior secretary, said senior officials were reassured, perhaps wrongly, by “the NASA kind of fervor” over the oil industry’s seemingly “terrific technology.” They took comfort in what appeared to be a comprehensive regime of regulations. Most of all, he said, they were impressed by the rarity of significant oil spills even as more of the nation’s domestic oil supply was being drawn from ultradeep wells.
“The track record was good,” he said. “The results were significant.”
Not even environmental groups bitterly opposed to expanding offshore drilling were raising concerns about the industry’s technology for preventing deepwater spills, he added. “We were not being drawn by anybody to a potential issue with deepwater drilling or blowout preventers.”
As for the Minerals Management Service’s own studies on the vulnerabilities and failings of blowout preventers, Mr. Hayes faulted the agency for not bringing them to the administration’s attention. Long before Mr. Obama’s announcement, Mr. Hayes said, Interior Secretary Ken Salazar had asked the agency for a report describing the potential risks and benefits of expanding offshore drilling.
The report, 219 pages long, made no mention of blind shear rams. It barely mentioned blowout preventers. It did, however, assure Mr. Salazar that safety and engineering requirements were “extensive” and that blowouts were “very rare.”
“We did not have red flags about a problem with the enforcement culture at M.M.S.,” Mr. Hayes said. “We certainly have that now.”
After the Deepwater Horizon blowout, Mr. Obama declared a moratorium on offshore drilling and ordered Mr. Salazar to look for ways to improve safety. Within weeks, Mr. Salazar came back with a long list of changes, most of them clearly responsive to weaknesses that industry and government studies had identified years before.
Mr. Salazar recommended, for example, that all blowout preventers be equipped with two blind shear rams — a step suggested to the Minerals Management Service in 2001. He recommended new rules to make sure rigs were equipped with the right kind of underwater robots and had emergency backup systems to activate blowout preventers — a step suggested to the Minerals Management Service in 2003.
He also urged a break from the agency’s tradition of taking the drilling industry’s word. From now on, he said, government inspectors should witness actual testing on blowout preventers. Rig operators, he said, should have to pay an independent expert to verify that their blowout preventers were properly designed and had not been compromised by modifications.
But Mr. Salazar stopped short of what Mr. Hayward, the BP chief executive, said was called for in the aftermath of the Deepwater Horizon disaster. “We need a fundamental redesign of the blowout preventer,” Mr. Hayward testified last Thursday.
Still, J. Ford Brett, a drilling expert who contributed to Mr. Salazar’s list of suggestions, cautioned that blowout preventers, whatever their design, “will not save you in every situation.”
Mr. Salazar has yet to offer ideas for what to do if another blowout preventer fails thousands of feet beneath the sea. In the absence of a Plan B, he ordered his department to come up with new “deepwater well control procedures” in the next four months.
Already, though, pressure is building on the administration to let offshore drilling operations resume. Last month, Mr. Obama lifted the moratorium on drilling in shallow waters. But along the Gulf Coast, where drilling operations are responsible for an estimated 150,000 jobs, politicians are clamoring for an end to the deepwater moratorium, too.
In Senate testimony on June 9, Mr. Salazar made clear that Mr. Obama had no intention of pulling back permanently from deepwater drilling off the United States coast.
“It was the president’s directive that we press the pause button,” Mr. Salazar said. “It’s important for all of you on this committee to know that word — it’s the pause button. It’s not the stop button.”
Source: nytimes.com