Introducing his analysis on the Macondo incident in the US Gulf of Mexico (GOM), Stan Christman quoted, “Complex systems almost always fail in complex ways.” The line came from the Columbia Accident Investigation Board’s report of the space shuttle Columbia explosion in 2003, but it could easily describe the explosion and resultant spill that devastated the GOM in 2010.
In a presentation hosted by SPE’s Drilling and Completions Advisory Committee, Christman, a member of the United States Chemical Safety and Hazard Investigation Board (CSB), outlined the failures of barriers and tests, and the problems within the Deepwater Horizon’s blowout preventer (BOP) system that led to the accident. The findings were the result of a 4-year investigation conducted by the CSB, which released its report in June. The federal independent agency had access to the full set of test data in real time, some of which were unavailable at the time of the publications of other reports on Macondo.
At around 4:12 p.m. on 20 April 2010, there was a small shortfall in the returns of fluid going into the well during displacement. By 4:35 p.m., the shortfall had increased to between 10% and 15%. Christman said the missing fluid was likely due to a wellbore leak resulting from the top wiper plug giving way or from a failure in the casing. Both scenarios were equally plausible, he said.
The Deepwater Horizon had been successfully pressure-tested a few hours earlier, so the leak probably developed during the early part of the displacement. Christman said the crew did not notice the shortfall in fluid.
“If the losses had been noticed by the crew, it is certain in my opinion that the crew would have taken remedial steps and recognized that something was wrong with the well,” he said. “The lesson here is to emphasize loss detection by always monitoring, even if you think everything is OK.”
Approximately 420 bbl of spacer fluid were pumped through the well during this time. The fluid was supposed to displace above the BOP, but because of the well fluid losses, much of the spacer fluid was left in the BOP and below it in the annulus at a depth of approximately 2,000 ft. When the pumps were stopped at 4:52 p.m., the drillpipe pressure leveled off at 2,250 psi. Christman said that if the well annulus had been full of water as intended, the pressure should have been 1,600 psi.
The subsequent negative pressure test showed the inconsistency between the kill line pressure and the high drillpipe pressure, and the crew’s decision to continue operations after that test proved to be what Christman called a “tragically wrong” decision.
“Overall, we could see the crew had difficulties in interpreting starting and ending pressures, recognizing the compressibility volume, and deciding if the test was good or not,” he said. “The lesson is to have such test pressures provide the respective pressure and bleed volume, and especially include an objective criteria for a successful test.”
Because the flow rate was too high, the annulus did not seal. Four minutes later, the well was successfully sealed by closing the middle variable bore pipe ram (VBR). Contrary to previous reports, the CSB found that the upper VBR had not closed. Oil and gas above the pipe ram continued flowing toward the oil rig, and at about 9:49 p.m., they found an ignition source, causing the first explosion.
The explosion led to a loss of electric power, communication, and hydraulic supply to the subsea BOP and the automatic mode function (deadman) backup control feature, which is designed to close the blind shear ram (BSR) under certain emergency conditions. The CSB said the deadman likely actuated the BSR, though it could not be proven beyond a reasonable doubt. Regardless, even if the BSR was actuated, Christman said it failed to seal the pipe and, in fact, sheared it, creating a new path for oil and gas to flow up the riser and allowing the blowout to continue. The BSR did not seal because the drillpipe had buckled.
Christman said companies have options available to deal with the risk of an off-center pipe. The most obvious option, he said, was to have a BSR that worked with off-center pipes, one with a design validated by physical testing. However, there is no industry standard for a BSR test. He also suggested that operators adjust their well control procedures to prevent an off-center drillpipe during a period of high pressure.
Although Christman’s presentation focused on the mechanical issues surrounding Deepwater Horizon, he addressed the possible human factors that led to the accident. While he mentioned the CSB’s upcoming report on the latter issue, he said the accident was an example of low-probability, high-consequence risk and the tendency of human nature to minimize the risk probability to near zero.
“I hate to use the word ‘complacent’ because it implies a poor attitude in the crew—which I don’t think they had—but it is human nature to put those risks aside. I feel like the crew knew the well was good. They did a cement job, they pressure-tested it, and so there was a mind-set that ‘hey, it’s pretty good.’ That’s what I would think. And so you tend not to question yourself,” he said.