How the blowout happened

  • On April 21, 2010, rescue vessels in the Gulf of Mexico battle an inferno on the Deepwater Horizon "“ a fire fed by oil and gas spewing from a well that blew the previous day 5 500 metres below the deck of the drilling rig. Image credit: USCG
  • Deepwater Horizon burned for a day and a half before sinking in the Gulf of Mexico on April 22.
  • Two days after the blowout, a robot sub attempts to seal the runaway Macondo well.
  • How the blowout happened
Date:1 November 2010 Tags:, , , , , , , , , ,

Three Mile Island, Challenger, Chernobyl and now, Deepwater Horizon. Like those earlier disasters, the destruction of the drilling rig was an accident waiting to happen. Here, engineers in the growing science of failure analysis identify seven fatal flaws that led to the oil spill in the gulf of mexico and draw lessons on how to prevent future catastrophes.

Special report by Carl Hoffman
Additional reporting by Davin Coburn

April 20 was a triumphant evening for British Petroleum and the crew of Transocean’s Deepwater Horizon. Floating 84 kilometres of the coast of Louisiana in 1 500 metres of water, the oil rig was close to completing a well 4 000 metres beneath the ocean floor – an operation so complex it’s often compared to flying to the Moon. Now, after 74 days of drilling, BP was preparing to cap the Macondo Prospect well until a production rig was brought in to start harvesting oil and gas. Around 10:30 in the morning, a helicopter flew in four senior executives – two from BP and two from Transocean, to celebrate the well’s completion and the rig’s seven years without a serious accident.

What unfolded over the next few hours could almost have been written as a treatise in the science of industrial accidents. As with the Three Mile Island nuclear plant partial core meltdown in 1979; the chemical leak in Bhopal, India, in 1984; the space shuttle Challenger disintegration in 1986; and the Chernobyl nuclear plant explosions and fire that same year, there is never one mistake or one malfunctioning piece of hardware to blame. Instead, the Horizon disaster resulted from many human and technical failings in a risk-taking corporation that operated in an industry with ineffective regulatory oversight. By the time the blowout came, it was almost inevitable.

“It’s clear that the problem is not technology, but people,” says Robert Bea, an engineering professor at the University of California–Berkeley. “It was a chain of important errors made by people in critical situations involving complex technological and organisation systems.”

Bea and other engineers subject catastrophes such as Deepwater Horizon to the science of failure analysis for good reason: studying industrial disasters can lead to understanding the root causes behind every accident, which is the critical first step toward improving safety and preventing future big bangs. If we learn from mistakes, failure can drive innovation, both technical and organisational. “A lot of intelligence came out of Three Mile Island,” says Larry Foulke, former president of the American Nuclear Society and an adjunct professor at the University of Pittsburgh. What he means is knowledge that led to such improvements as better control-room ergonomics and the standardisation and accreditation of industry-wide training programmes. Since Three Mile Island, there has not been another major accident in the US nuclear industry.

The following lessons drawn from forensic engineering should spur changes in the oil industry and government agencies that will lead to better risk assessment, more useful regulatory oversight, safer operating procedures and rapid crisis response. The blowout was a punishing lesson: 11 workers were killed and 17 injured in the accident itself. The resulting oil spill damaged the economy and environment of the entire Gulf Coast. But out of this calamity can come changes that will reduce the chances of such a tragedy occurring again, not just in deepwater drilling but in other high-tech, high-risk industries as well.

Success breeds complacency
A simple but counterintuitive fact led to the Horizon disaster: wells, even ones drilled in deep water, had worked most of the time, just as the space shuttle and chemical and nuclear plants had functioned successfully, in some cases for decades. Although underwater drilling is complex and challenging, there are 3 423 active wells in the Gulf of Mexico, 25 in water deeper than 300 metres. Seven months before the blowout and about 400 kilometres southeast of Houston, the Horizon had drilled the world’s deepest well – an astounding 10 685 metres.

What was impossible just a few years earlier had become seemingly routine as BP and Transocean banged out record firsts on the farthest frontiers of technology and geography. The same off shore techniques and equipment that worked in shallow hydrocarbon formations seemed to function fine at ever greater depths and higher pressures. The off shore rush was on, and nothing was going to stop it. “When you think you’ve got a robust system,” says Henry Petroski, a professor of civil engineering at Duke University, “you tend to relax.”

Other industries have lapsed into the same sense of false security. “By the time of Three Mile Island,” Foulke says, “the nuclear industry had not had a major mishap in 25 years. When you get an attitude that nothing bad happens, it leads you to believe that nothing ever will.”

It’s called hubris, and it set the stage for the Deepwater disaster. “In the event of an unanticipated blowout resulting in an oil spill,” read the exploration plan that BP submitted on March 10, 2009, to the US Department of the Interior’s Minerals Management Service (MMS), which then managed and regulated off shore drilling, “it is unlikely to have an impact based on the industry-wide standards for using proven equipment and technology for such responses . ."

That was nonsense. Although off shore blowouts occur frequently – there were 173 in the Gulf of Mexico alone from 1980 to 2008 – there had never been one in deep water. In fact, neither BP nor any of its competitors had “proven equipment or technology” or any backup plan for a catastrophic failure at great depth. “The industry has not developed an oil spill plan for the low-probability, highconsequence event when everything fails,” says Greg McCormack, director of the Petroleum Extension Service at the University of Texas.

Promoters can’t be enforcers
Oil and gas leases are the US government’s second-largest source of revenue, after income taxes. Before the blowout, the responsibility for leasing mineral rights and collecting revenue from those leases belonged to the MMS. The MMS clearly placed its mandate to promote drilling ahead of its role as a safety cop. (After the disaster, the Interior Department disbanded the service and created the Bureau of Ocean Energy Management, Regulation and Enforcement, with an investigative arm to root out misconduct and complacency.) In the MMS era, oil companies were referred to as partners, and MMS officials routinely received cash bonuses for meeting government deadlines for off shore leasing. Although the Bureau of Land Management has a similar relationship with the oil industry, says Jeff Ruch, executive director of Public Employees for Environmental Responsibility, the consequences of a blowout on shore are much less severe. “The roots of the MMS,” Ruch says, “were to facilitate the work of its partners and to collect revenue – and the national policy was to increase revenue.”

Just 60 MMS inspectors oversaw rigs in the gulf. They examined oil spill response plans that were often boilerplate reproductions from one well to another. BP’s response plan for the Gulf referenced seals and walruses, which aren’t found in that body of water, referred to a home-shopping network in Japan and listed scientists who were dead. No one noticed. The inspectors, Ruch says, “just made sure the companies checked the right boxes”. Since much of the drilling data necessary to complete environmental reviews was proprietary, MMS scientists were not allowed access to exploration and drilling details. When BP made repeated last-minute changes to its drilling plan in the days before the blowout, the MMS approved them all, often within minutes. “That’s what happens,” Ruch says, “when the government is dependent on industry for its expertise.”

A cowboy culture
For years BP had prided itself on taking high-risk jobs in politically sensitive countries such as Angola and Azerbaijan and for pushing the limits of technology in the remotest reaches of Alaska and the deepest waters of the Gulf of Mexico – “the tough stuff that others cannot or choose not to do”, according to former BP chief executive officer Tony Hayward. Within the industry, the company was notorious for its cavalier approach to safety. According to the Centre for Public Integrity, from June 2007 to February 2010, BP’s refineries in Texas City, Texas, and Toledo, Ohio, accounted for 829 of 851 industry-wide safety violations identified as “wilful” by the Occupational Safety and Health Administration (OSHA). These were refineries, not oil rigs, but they demonstrate what OSHA describes as “plain indifference to . . . employee safety and health”.

And Deepwater was not BP’s . rst significant spill. In 2007, BP Products North America paid a criminal fine of more than R430 million for violating environmental regulations in Texas and Alaska, including a 2006 spill on the North Slope of Alaska that resulted from BP’s failure to address pipeline corrosion. The 760 000 litres of crude that spread across the tundra formed the largest spill on the North Slope.

Here’s how Steve Arendt, a vicepresident of ABS Consulting and an industry expert who worked with the Chemical Safety Board’s investigation panel on BP’s 2005 Texas City refinery fire, describes the BP corporate culture: “We have the matter in hand. It might be a northern European cultural thing, but BP was convinced that the Texas City accident was a one-off , rather than something systemic and pervasive. They were arrogant and proud of the systems they had in place. They were in denial.”

Executives of other oil companies told the US Congress that BP’s well plans were outside industry norms. “It certainly appears that not all the standards that we would recommend or that we would employ were in place,” said John S Watson, chairman of Chevron. Marvin E Odum, president of Shell, concurred: “It’s not a well that we would have drilled in that mechanical set-up.”

The MMS had implemented a voluntary safety and environmental management programme for the off shore industry. In 2009, when the MMS tried to make the programme mandatory, much like the OSHA regulations that govern onshore drilling, the industry objected so vigorously that the programme died. “ The regulations are fine as they stand,” says Terry Barr, a petroleum geologist who has spent over 30 years in the oil and gas industries. “But there’s an honour system – and this is where the industry is so unhappy with BP. When you send your paper-work to MMS, that’s a recipe for what you’re going to do, and you have to honour that. And 99 per cent of the time, people follow what they say they are going to do. That was not the case in this well.”

Blowing on the dice
Oil and methane gas in deep geological formations are under tremendous pressure – insert a straw and up they shoot. The deeper the well, the higher the pressure, more than 600 bar in wells 6 000 metres deep. During drilling, mineral-weighted mud pumped down the well lubricates the drill string and . ushes rock chips to the surface. Most importantly, the dense mud’s hydrostatic pressure keeps the fluids in the formation in check. Mud is, in fact, the primary line of defence against a blowout.

If oil, gas or water enters the well during drilling because mud weight is too low, the well is said to “kick”. (Transocean testi. ed before Congress that the Macondo well had kicked several times.) If the well is fractured or the cement bond between the casing protecting the drill string and the rock wall of the well isn’t tight, gas bubbles can roar up the drill string or the outside of the casing and re-enter the casing at its overlapping joints. Even if the methane doesn’t come to the surface, it can “push the mud into the formation” with such power it fractures the hole and creates a leak, says Philip Johnson, professor of civil engineering at the University of Alabama.

What happened on the Horizon falls into the category of low-probability, high-consequence events that author Nassim Nicholas Taleb dubbed black swans – a common term in the Middle Ages for an impossibility, since at the time all swans were thought to be white. “ The human perception of risk is an affective, subjective business,” says

David Ropeik, an instructor at Harvard and author of How risky is it, really? Why our fears don’t always match the facts. A classic black swan was the Chernobyl nuclear disaster in the Soviet Union in 1986. The reactor had no containment dome – engineers deemed the safety feature unnecessary because a meltdown was simply thought to be so unlikely. The design flaw, compounded by operator error, poor training and a lax attitude toward safety, contributed to an explosion that released widespread nuclear radiation. “Assessing risk is not a fact-based process of clear reason,” Ropeik says, “and subjective feelings always play a larger role than the facts.”

Neither the oil industry nor the MMS addressed the added risks of drilling in ever more challenging environments. “There was a lack of a sense of vulnerability within the industry,” says safety expert Arendt. “The gulf was one of the last cowboy environments, and the industry was blinded by its good performance.” Robert Bea adds: “Because BP and the MMS believed that the potential consequences were ‘insigni. cant’, they were not prepared for the failures associated with the Deepwater Horizon’s operations, both in prevention and containment.”

Normalisation of deviance
At the root of BP’s choices was what BEa calls the normalisation of deviance. The company had long grown used to operating at the margins of safety. It regarded red flags as normal, and those red flags cropped up repeatedly on the Macondo well, with the frequency accelerating in the four days before the blowout.

A series of delays added to the pressure on managers to ignore warning signs. Though drilling had begun on October 7, 2009, using a di. erent rig, the Marianas, that rig was damaged in a November hurricane. It took three months to bring in the Horizon and resume drilling. The well was scheduled for 78 days at a cost of R690 million, but the real target was 51 days. BP urged speed. Mike Williams, Transocean’s chief electronics technician, told CBS’s “60 Minutes” that he heard a BP manager saying, “Let’s bump it up, let’s bump it up.”

But in early March that increased drilling speed fractured the well, forcing workers to backtrack 699 metres from the then-4 000-metre hole, plug the cracked section with cement, and carve a new path to the hydrocarbon-bearing formation, or pay zone. “Operations were faster and cheaper,” Bea says, “but not better – the operation records clearly show excessive economic and schedule pressures resulting in compromises in quality and reliability.”

Those compromises began piling up on April 9, when the well reached its final depth of 5 600 metres below the rig – 363 metres below the last cemented steel casing. A well is drilled in sections: roughnecks bore through rock, install casing to line the hole, pour cement into the gap between the casing and the surrounding rock, and repeat the process with ever-narrower casing. To secure that final section, BP had two options: run a single string of casing from the wellhead to the well bottom or hang a liner from the last section of casing already installed and cemented, and then slide in a second steel liner tube called a liner/tieback.

The tieback option cost R50 million to R70 million more than the single string, but it was far less risky, providing double barriers to gas flowing up the outside of the pipe. According to US Congressional investigators, an internal BP document that appears to date from mid-April recommended against single string casing. Nevertheless, on April 15 the MMS approved BP’s request to amend its permit application, which claimed that using the single string made “the best economic case”.

Although single strings are common in shallow water, they are rarely used in deepwater exploration wells like the Macondo where high pressures exist and the geologic formation is not well known. A Wall Street Journal investigation found that BP used the cheaper, riskier single string method in the gulf far more than other operators.

As casing is lowered, metal collars called centralisers position the pipe in the middle of the well bore to ensure an even cement job that contains no spaces where gas can squeeze through. On April 15, BP informed Halliburton’s account representative, Jesse Gagliano, that BP was planning to use six centralisers on the final 363 metres of casing string. Gagliano ran a computer analysis of a number of cementdesign scenarios to determine how many centralisers would be necessary: he found that 10 would result in a “moderate” gas flow problem; 21 would reduce the potential gas flow problem to “minor”. Gagliano recommended that BP use 21 centralisers. Gregory Walz, BP’s drilling engineering team leader, wrote to John Guide, BP’s well team leader: “We have located 15 Weatherford centralisers with stop collars . . . in Houston and worked things out with the rig to be able to fly them out in the morning . . . We need to honour the modelling to be consistent with our previous decisions to go with the long string.”

Guide objected: “It will take 10 hrs to install them . . . I do not like this and . . . I [am] very concerned about using them.” On April 16, Brett Cocales, BP’s operations drilling engineer, emailed Brian Morel, another BP drilling engineer: “But, who cares, it’s done, end of story, will probably be fine and we’ll get a good cement job . . . So Guide is right on the risk/reward equation.”

On April 17, BP informed Gagliano that it had decided to use only six centralisers. Gagliano then ran a model based on seven centralisers and reported to BP on April 18 that the “well is considered to have a severe gas . ow problem”. If BP installed the additional centralisers, it would cost an estimated R295 000 an hour for the completion delay. BP went with the six centralisers.

After a well is cemented, drillers routinely run a cement bond log, an acoustic test that measures how well the cement has bonded to the casing and surrounding formation. On April 18 a crew from oil services contractor Schlumberger flew out to the rig to perform the test. But BP told the crew it wasn’t needed and . ew them o. the rig on the morning of April 20. Gordon Aaker Jr, a failure analysis consultant with the firm Engineering Services, told the House committee investigating the blowout that it was “unheard of” not to perform this routine test on a single casing well. He called BP’s decision to skip the cement bond log “horribly negligent”. BP did not respond to requests for comment.

Shifting the burden of proof
The events of the week preceding the blowout point to what Allan J McDonald, author of Truth, lies and O-rings: inside the space shuttle Challenger disaster, calls switching the burden of proof, a reversal that leads to a kind of bureaucratic illusion. The closest analogy is the space shuttle, a system so complex and dangerous that a coldly factual analysis would show the spacecraft presented a risk almost too high to tolerate. During the Challenger accident investigation, the physicist Richard Feynman asked Nasa for its failure rate. The answer: one in 100 000. Feynman was incredulous, pointing out that this meant a shuttle launch every day for 300 years with only a single mishap, when the demonstrated failure rate was between one in 25 and one in 60. “Nasa’s figures were totally baseless,” McDonald says, “and were just backed into as a number that was acceptable to Congress.”

McDonald, who is the former director of Morton-Thiokol’s space shuttle solid-rocket-motor project, says that the company’s engineers knew there was a problem with the shuttle boosters’ O-rings. The seals, which kept blistering gases from escaping the motors, could turn brittle and leak in temperatures below 11 degrees. On the morning of January 28, 1986, the temperature in Cape Canaveral was 1 degree.

But the company managers pressed forward – the mission had already been postponed six times because of weather and mechanical problems – and engineers were left having to prove the components would fail. “It’s a trap,” McDonald says. “Is it safe enough to fly? is the correct question, not that you have to prove it will fail. If you can’t prove that it will fail, then there will be zero failure rate!” If a system never fails, he explains, then why bother spending time and money on safety? That inversion of logic “changes the burden of proof, and that is a fatal mistake”. Thiokol’s engineers ultimately relented. The shuttle broke apart 73 seconds after launch.

By the time Halliburton’s Gagliano ran his models about gas flow and centralisers for the Macondo well, everyone but the drilling engineers was operating in a haze of justi. cation and rationalisation. Gagliano showed there might be gas leaks, and gas leaks increase the risk of a blowout. But the models didn’t prove that a blowout would occur.

Deepwater wells have one . nal line of defence: the blowout preventer (BOP), a five-storey tower of valves atop the well bore that can, in principle, lock down and shut o. a runaway well. The Macondo BOP, however, was severely compromised. One of its pipe rams – horizontally opposed plates that clamp around the drill pipe to block methane and . uids rising through the BOP – had been swapped out for an inoperable test version. The conversion is common in the industry, decreasing testing and operation costs but increasing risk.

Investigators also found that one of the BOP’s control pods had a dead battery, making it unable to receive the “deadman” signal from the pod. This last-ditch control triggers a shear ram that severs the drill pipe, shutting down the well. Even with a charged battery, the shear ram may not have worked – one of its hydraulic lines was leaking. MMS regulations are clear: if there is a BOP “control station or pod [that] is not functional” the rig must “suspend further completion operations until that station or pod is operable”. Eleven days before the blowout, the BP representative in charge on the rig noted the leak in a daily operation report and alerted the home office in Houston. However, BP did not shut down completion operations, initiate repairs or inform the MMS.

Even a fully operational BOP has design flaws. A shear ram’s blades can’t sever the joints connecting the 9-metre sections of drill pipe – and joints make up 10 per cent of the string. In fact, internal Transocean documents show that, when it bought this particular BOP in 2001, the company identified 260 separate ways it could fail. During a Congressional hearing, Bart Stupak, Democratic Party member for Michigan, asked: “How can a device that has 260 failure modes be considered fail-safe?”

Broken chain of command
By April 20, with the untested cement sheath in place on the final 363 metres of casing, workers prepared to seal the Macondo well and move on to the next drilling job. A dispute arose during a planning meeting around 11 am – 11 hours before the rig exploded. Accounts vary: one Transocean worker testified that BP wanted to replace the protective column of drilling mud with lighter seawater before closing off the well; Transocean strenuously objected, but eventually relented. Other witnesses say the argument was whether or not to conduct a negative pressure test – a procedure that reduces pressure in the well to see if gas and oil enter – even though it was not part of the drilling plan.

The argument revealed the inherent conflict on the rig. BP, which was paying Transocean R3,6 million daily to lease the Horizon, wanted to move as quickly as possible. With its costs covered, Transocean could afford to focus more on safety and well control. Safety expert Arendt believes some of the problems are systemic to offshore drilling. “Onshore, you have one plant owner and, normally, one large contractor to deal with,” he says. “Offshore, you have the lease holder, the platform owner, the drilling contractor and one or two critical drilling and well service contractors. This creates the potential for mixed messages and a conflict between economic versus safety priorities.”

Transocean conducted two negativepressure tests; BP’s Don Vidrine and Transocean’s Jimmy Harrell, the two companies’ top officials on the rig, deemed them to be successful, and preparations began to install a cement plug to seal the well. At 7:55 pm, BP engineers decided that the plug was holding, so they told Transocean workers to open the BOP’s annular valve to pump seawater into the riser to displace the mud, which was piped to the Damon B Bankston, a supply ship tethered to the rig. At 8:58 pm, drill-pipe pressures increased. At 9:08, with pressure continuing to build, workers stopped pumping.

Here, there were eerie echoes from the Union Carbide chemical plant spill in Bhopal, India, which killed an estimated 20 000. In Bhopal, water leaked into a tank containing 42 tons of methyl isocyanate, setting off a deadly chemical reaction. Workers in the control room watched pressure build in the tank, but never shut the system down as three backup systems failed, and the deadly gas spread over a densely populated village.

Remarkably, after a 6-minute hiatus, workers on the Horizon resumed displacing mud with seawater, despite the slew of signals – kicks and pressure spikes – that warned something was wildly wrong. “Normally, on any well,” says the University of Texas’s McCormack, “if you have a problem, you stop and solve it.”

At 9:31, once again the workers stopped pumping seawater; at 9:47 monitors detected “a significant pressure buildup”. A few minutes later, methane coursed from the drill pipe, transforming the rig into a giant unlit blowtorch. From the decks of his supply ship, Captain Alwin Landry saw “mud falling on the back half of my boat, kind of like a black rain.” Then came a green flash and a white liquid – a frothy mix of mud, water, methane and oil – boiling out of the derrick. First Mate Paul Erickson saw “a flash of fire on top of the liquid” and then watched men jump from the rig, as a distress call came in. “Mayday, mayday, mayday! The rig’s on fire! Abandon ship!”

“The scene was very chaotic,” rig worker Carlos Ramos told The Wall Street Journal. “People were in a state of panic . . . There was no chain of command, nobody in charge.” Throughout the rig, workers struggled to reach the two usable lifeboats. Some yelled to lower them, some wanted to wait for more workers, others simply leaped into the sea 25 metres below.

On the bridge, Captain Curt Kuchta argued with a subsea supervisor over who had the authority to hit the Emergency Disconnect System to activate the shear rams, thereby sealing the well and detaching the rig from the riser. It took 9 minutes to activate the system. Not that it mattered – the BOP failed. The Horizon was never disconnected. Oil and gas continued to surge up from below, feeding an inferno that soon engulfed the rig. Although the vessel had muster stations and emergency plans, crew members had never practised safety drills without warning to simulate a real disaster.

In the end, 11 men died, the disaster cost BP billions, and the environment of the Gulf of Mexico may be irrevocably altered. President Obama’s ambitious plans to open up vast areas to offshore drilling have been shelved. But worst of all, says Ford Brett, president of Oil and Gas Consultants International, the blowout “wasn’t an accident in the traditional sense, like when someone just hits your car. It was an accident that was totally preventable”.

What lead to the blowout
British Petroleum (BP) leases drilling rigs owned by Swiss-based Transocean to tap a hydrocarbon formation called the Macondo Prospect 84 kilometres southeast of Venice, Louisiana. The Macondo is 4 000 metres beneath the ocean ¢ oor in water 1 500 metres deep. The potential yield is 100 million barrels – a midsize field. BP wants to complete the job in 51 days.

Oct. 7, 2009
BP begins drilling the well on a 2 300-hectare plot leased in 2008 for R245 million. But the rig, Marianas, is damaged during Hurricane Ida and towed to a shipyard for repairs. It will take three months for its replacement, Deepwater Horizon, to start drilling.

Feb. 6, 2010
Horizon commences operations at the Macondo. Workers hurry to keep on schedule, bumping up the speed of drilling. Soon, the increased rate fractures the well bore, and gas begins to seep in. Engineers seal the bottom 600 metres and reroute the well. The delay costs two weeks.

Mid-March
Transocean chief electronics technician Mike Williams asks senior subsea supervisor Mark Hay why he set the control-panel system to bypass its gas-shutdown function. According to Williams, Hay says, “The entire fleet runs them in bypass.” A year earlier Williams noted that the rig’s general alarm and indicator lights were set to “inhibited”, so they don’t automatically trip when gas or fire is detected. In March, he also sees a worker holding chunks of rubber from the well – pieces of the crucial annular valve on the blowout preventer (BOP), a stack of safety valves atop the well. According to Williams, Hay says, “That’s normal.”

March 30, 10:54 am
BP engineer Brian Morel e-mails a colleague to discuss using an 18-cmdiameter “single string” of casing down the inside of the segmented steel that extends from the wellhead to the well bottom. A safer option: a liner/tieback, which provides more barriers to gas flowing up the well. Morel notes: “Not running the tieback saves a good deal of time/ money.” But with a liner, says Ford Brett, a long-time oil engineer, “the well would have been much more fault-tolerant.”

April 9
BP well site leader Ronald Sepulvado reports a leak in one of the BOP’s control pods, which receive electronic shutdown signals from the rig and activate hydraulic rams to seal the well in an emergency. BP is supposed to notify the federal Minerals Management Service (MMS) and suspend drilling until the pod is operable. Instead, the company puts the malfunctioning pod in “neutral” to prevent leaks and continues drilling. It does not notify the MMS.

April 14
BP submits a request to MMS to use the single string instead of the safer tieback – it’s approved the following day. Two other requests are approved within minutes. Since 2004, 2 200 wells have been drilled in the Gulf; only one other company ever submitted three revisions in a 24-hour span.

Mid-April
A BP plan review recommends against the single string, which would create “an open annulus to the wellhead” – the annulus is the space between the steel casing and the formation wall – and make the BOP the “only barrier” to gas flow if the cement job failed. Despite this warning, BP decides to install the single string.

April 15
The crew finishes drilling and plans to circulate fresh mud through the well and bring used mud from the bottom up to the rig. This cleans out gas bubbles and debris that can weaken the cement that will later seal the annulus. For the Macondo, this “bottoms up” should take 12 hours. BP overrides its operations plan and later cycles mud for 30 minutes.

April 15, 3:35 pm
Halliburton’s Jesse Gagliano e-mails BP to recommend using 21 centralisers – collars that centre the casing in the well to ensure an even cement job. BP eventually installs six. BP well team leader John Guide later testifies that the centralisers were wrong for the job. “Why couldn’t you wait to get the right centralisers?” a lawyer asks. “[It] never came up,” he replies.

April 20, 12:35 am
Workers pump cement slurry down the casing, then use mud to push it out the bottom and 300 metres up the annulus, to comply with MMS regulations for sealing a hydrocarbon-bearing zone. Halliburton, the cement contractor, uses nitrogencharged cement, which bonds strongly with rock but requires extra care and handling. If gas bubbles work into the wet cement, they can form channels that allow oil, gas or water to leak into the well.

April 20, 1:00 am – 2:30 pm
Halliburton conducts three positive-pressure tests—increasing pressure inside the well to check that the cement seals hold—during the morning and afternoon. All are successful.

April 20, 11:15 am
Contractors brought to the rig to conduct a 12-hour cement bond log, which uses acoustic waves to test the seals, are sent home. “It was a huge error,” says Satish Nagarajaiah, an engineering professor at Rice. “That’s when they lost control of the well.

April 20, 5:05 pm
A loss of riser fluid signals that the annular preventer is leaking. Soon after, the crew runs a negative-pressure test on the drill pipe, during which they reduce fluid pressure in the well and watch to see if hydrocarbons force their way through the cement or casing. The results suggest a possible breach, and a second test is ordered. Typically, before a test, workers install a lockdown sleeve to secure the top of the well casing to the BOP; in this case, BP does not.

April 20, 6:45 pm
The second negativepressure test confirms the findings, this time by measuring pressure readings on the multiple pipes that run between the rig and the BOP. The test shows 96 bar of pressure on the drill pipe, but 0 bar on the other pipes, suggesting that an influx of gas is raising pressure in the well bore.

April 20, 7:55 pm
Even with the test results, BP orders Transocean to replace drilling mud (1,7 kg per litre) from the riser and top of the casing with seawater (1 kg per litre) and, at the same time, add a cement plug to the well 900 metres below the ocean floor (mud line). This simultaneous operation is risky: if the cement plug doesn’t seal the well, mud becomes the first defence against a blowout. BP’s own investigator later calls the decision a “fundamental mistake”

April 20, 8:35 pm
Workers pump in 3 500 litres of seawater per minute to ush the riser – but the ow rate of mud coming out jumps to 4 500 litres per minute. “It’s simple math, ” petroleum geologist Terry Barr says. “They should have said, ‘The well’s owing. Put the mud back in the hole. Kill it.’” The crew pumps more seawater.

April 20, 9:08 pm
Workers shut down the rig’s seawater pump for an EPAmandated “sheen test” to determine if oil is oating on the water; it is not. With the pump off, the well continues to flow, increasing casing pressure from 70 to 87 bar. Over the next halfhour, pressure builds – and workers stop pumping water.

April 20, 9:47 pm
The well blows. Highly pressurised gas shoots through the BOP and up the riser to the rig. A 70-metre geyser gushes from the top of the derrick, followed by icy slush “steaming” with evaporating methane. The “inhibited” general alarm means workers on the rig floor have no warning for what’s to come. The bypassed controlpanel shutdown system, which is designed to stop the engines in the drilling shack, fails to trip.

April 20, 9:49 pm
Gas seeps through ducts into the mud pit, where a pair of engineers are responding to a frantic call for more mud to control the well. The engines suck in gas through their air intakes and overspeed. Engine No 3 explodes, triggering an eruption that rocks the rig. The two engineers are killed instantly, along with four others in the adjacent shaker room. Five other workers also perish.

April 20, 9:56 pm
A worker on the bridge hits the Emergency Disconnect System to activate the BOP’s shear rams and seal the well. The rams don’t work. A battery on the BOP is supposed to power a deadman’s switch to trigger the rams if communication, hydraulic and power lines are severed. Because hydraulic lines were later found intact, BP believes the switch did not activate. Rig officers order an abandon ship.

April 22, 3:11 pm
By now the Deepwater Horizon has been burning for more than 40 hours and listing for the past 33 because of damage to the rig’s ballastcontrol system. As the platform begins to sink, the riser attached to the BOP breaks. Fifteen minutes later, the rig is fully submerged. Coast Guard crewmen report “ fi re is still coming from the water”. The disaster on the drilling platform is over, but the worst offshore oil spill in US history is just beginning.

Maconda Prospect Well

Platform:
Deepwater Horizon semisubmersible oil drilling rig.

Riser:
Pipe that serves as conduit for drill string between rig and blowout preventer on sea floor.

Blowout prventer:
Stack of heavy valves on ocean floor that stops gushers by closing off well.

Drill pipe:
Jointed steel tube that connects rig equipment with drill bit in well bore; conduit for mud pumped into well for lubrication and pay-zone pressure containment.

Formations:
Layers of rock through which the drill string bores.

Pay zone:
Rock stratum containing oil and natural gas.

Total Depth
At the well’s base, cement slurry is pumped out of the casing and up the outside to protect the well and prevent leaks.

Casing:
Treaded steel pipe ensures integrity of well bore against hundreds of bar from the surrounding formation. At the Macondo, the . nal casing segment was 18 cm in diameter.

Annulus:
Space between casing and well bore wall.

Centralised:
Bow-springed tool that centres casing in well bore to ensure even cement sheath.

Cementing plugs:
Rubber plugs inside casing that separate cement slurry from other . uids to reduce contamination.

Float collar:
Flapper valve that protects against the “U-tube” effect – . ow-back of cement slurry when pumping ends.

Guide shoe:
Bullet-shaped steel component that directs casing to centre of well bore.

Pay zone:
When production begins, cement and casing are perforated – often with charges from perforating gun – allowing oil and gas to flow into well.

Blowout preventer
The bop is a 15.Metre stack of valves that closes a runaway well. For reasons still unknown, this last line of defence failed to deploy at the Macondo.

Shear ram:
The last resort – interlocking steel blades that slam through the drill pipe and choke off. a flowing well.

Riser:
Connects rig to BOP, carrying drilling mud – and other . uids – from well bore back to the surface.

Kill/choke lines:
Pressurised metal pipes extending from BOP along the riser to the surface that regulate shifting pressures of drilling . uid inside well bore.

Annular preventers:
Large valves, like rubber doughnuts, at top of BOP that seal open space around drill pipe.

Control pods:
Receive electronic signals from rig and activate BOP’s hydraulic rams.

Pipe rams:
Horizontally opposed rams that clamp to drill pipe in an emergency, sealing annular space inside BOP but leaving pipe intact.

Deep water horizon

Mud pit:
Waves of gas overspeed the diesel engines in the drilling area and . nd a spark. Six men in the pit and nearby shaker room perish.

Ballast tank:
The initial explosions on April 20 damaged the ballastcontrol system, causing the rig to list, then sink on April 22.

Derrick:
A 70metre geyser of gas and seawater shoots through the derrick, engul. ng surrounding areas. Gas settles to the rig floor, which is engulfed in flames.

Rig floor:
Moments before the blast, four crew members pump drilling . uid from the mud pit into the well, trying to regain control. All four are killed.

Related material
* Video: Watch AUV with gulper samplers sent to investigate Gulf of Mexico oil spill. [click here]