On April 20, 2010, an explosion and fire erupted on the Deepwater Horizon, an offshore drilling rig in the Gulf of Mexico, killing eleven platform workers and injuring 17 others. It took 87 days to cap the oil gusher and the US Government estimated the total spill at 4.9 million barrels (210 million gallons) – the largest oil spill in history US history.
Rapperport Associates was engaged to determine the predicted risk reduction for various blowout preventer (BOP) design modifications proposed by the US Department of the Interior. Key design recommendations included: (1) Equipping drill rigs with two sets of blind shear rams spaced at least four feet apart to prevent BOP failure when the shear ram encounters a drill pipe joint or drill tool and (2) Emergency back-up control systems.
According to interviews with 21 Horizon crew members and on sworn testimony and written statements from nearly all of the other 94 people who escaped the rig. Their accounts, along with thousands of documents obtained by The New York Times describing the rig’s maintenance and operations, make it possible to piece together the Horizon’s last hours.
Every one of the Horizon’s defenses failed on April 20th – some deployed but did not work, some were activated too late (after they had almost certainly been damaged by fire or explosions) and some were never deployed at all.
A House energy panel investigation found that the blowout preventer that failed had a dead battery in its control pod and a cutting tool that wasn’t strong enough to shear through steel joints in the well pipe.
After the explosion of the Deepwater Horizon oil rig, investigators focused on the failure of a component on the well’s blowout preventer that is supposed to close off a well spewing out of control. The device, called a blind shear ram, is the only part of the blowout preventer that can completely seal the well. Minutes after the explosion, at least one rig worker hit an emergency button, which is supposed to trigger the blind shear ram within about 30 seconds, and then disconnect the rig from the well. But that night, the blind shear ram never fully deployed.
Some evidence suggests that when the crew activated the blind shear ram, its blades tried to cut the drill pipe, but then failed to finish the job because one or more of its shuttle valves leaked hydraulic fluid.
Blind shear ram problems were well known in the drilling industry – in 1997, a blind shear ram was unable to slice through a thick joint connecting two sections of drill pipe during a blowout of a deep oil and gas well off the Louisiana coast. Even now, it is virtually impossible for a blind shear ram to slice through these joints. In an emergency, there is no time for a driller to make sure the ram’s blades are clear of these joints, which can make up almost ten percent of the drill pipe’s length.
Even more troubling, two studies, in 2002 and 2004, West Engineering Services of Brookshire, Texas, found a more basic problem: even when everything worked properly, some blind shear rams still failed to cut the pipe.
West’s experts concluded that calculations used by manufacturers of blowout preventers overestimated the cutting ability of blind shear rams (so-called because they close off wells like a window blind). Modern drill pipe is nearly twice as strong as older pipes of the same size. In addition, frigid temperatures of deep water make it tougher to shear a pipe. These and other factors can require hundreds of thousands of additional pounds of cutting force.
In 2004 British Petroleum (BP) opted to remove a layer of redundancy from the blowout preventer. It requested that Transocean replace one of the blowout preventer’s secondary rams with a “test ram” – a device that would save BP money by reducing the time it took to conduct certain well tests. In a joint letter, BP and Transocean executives confirmed that BP was aware that the change “will reduce the built-in redundancy” and raise Transocean’s “risk profile”.
As part of its assessment of the blowout preventer, Transocean hired West Engineering, which had a checklist of more than 250 components and systems to examine. It did not perform 72 of them because the Deepwater Horizon was operating in the Gulf of Mexico, and the blowout preventer was on the seafloor and was therefore inaccessible. One of those 72 items was verification that the blowout preventer could shear drill pipe and seal off wells in deep water.
There were also two separate backup system; the deadman and the autoshear, which were supposed to close the blind shear ram automatically. Both of these backups systems failed and soon after the Deepwater Horizon sank.
