The blowout preventer (BOP) that was intended to shut off the flow of high-pressure oil and gas from the Macondo well in the Gulf of Mexico during the disaster on the Deepwater Horizon drilling rig on April 20, 2010, failed to seal the well because drill pipe buckled for reasons the offshore drilling industry remains largely unaware of, according to a new two-volume draft investigation report released today by the U.S. Chemical Safety Board (CSB).

Eleven died, 17 were injured

The blowout caused explosions and a fire on the Deepwater Horizon rig, leading to the deaths of 11 personnel onboard and serious injuries to 17 others. Nearly 100 others escaped from the burning rig, which sank two days later, leaving the Macondo well spewing oil and gas into Gulf waters for a total of 87 days. By that time the resulting oil spill was the largest in offshore history. The failure of the BOP directly led to the oil spill and contributed to the severity of the incident on the rig.

The draft report will be considered for approval by the Board at a public meeting scheduled for 4 p.m. CDT at the Hilton Americas Hotel, 1600 Lamar St., Houston, TX 77010. The meeting will include a detailed staff presentation, Board questions, and public comments, and will be webcast at: http://www.csb.gov/investigations/webcast/.

Pipe buckling occurred early

The CSB report concluded that the pipe buckling likely occurred during the first minutes of the blowout, as crews desperately sought to regain control of oil and gas surging up from the Macondo well. Although other investigations had previously noted that the Macondo drill pipe was found in a bent or buckled state, this was assumed to have occurred days later, after the blowout was well underway.

After testing individual components of the blowout preventer (BOP) and analyzing all the data from post-accident examinations, the CSB draft report concluded that the BOP’s blind shear ram – an emergency hydraulic device with two sharp cutting blades, intended to seal an out-of-control well – likely did activate on the night of the accident, days earlier than other investigations found. However, the pipe buckling that likely occurred on the night of April 20 prevented the blind shear ram from functioning properly. Instead of cleanly cutting and sealing the well’s drill pipe, the shear ram actually punctured the buckled, off-center pipe, sending huge additional volumes of oil and gas surging toward the surface and initiating the 87-day-long oil and gas release into the Gulf that defied multiple efforts to bring it under control.

The identification of the new buckling mechanism for the drill pipe ­– called “effective compression” – was a central technical finding of the draft report. The report concludes that under certain conditions, the “effective compression” phenomenon could compromise the proper functioning of other blowout preventers still deployed around the world at offshore wells. The complete BOP failure scenario is detailed in a new 11-minute computer video animation the CSB developed and released along with the draft report.

Miswiring, battery failures

The CSB draft report also revealed for the first time that there were two instances of miswiring and two backup battery failures affecting the electronic and hydraulic controls for the BOP’s blind shear ram. One miswiring, which led to a battery failure, disabled the BOP’s “blue pod” – a control system designed to activate the blind shear ram in an emergency. The BOP’s “yellow pod” – an identical, redundant system that could also activate the blind shear ram – had a different miswiring and a different battery failure. In the case of the yellow pod, however, the two failures fortuitously cancelled each other out, and the pod was likely able to operate the blind shear ram on the night of April 20.

“Although both regulators and the industry itself have made significant progress since the 2010 calamity, more must be done to ensure the correct functioning of blowout preventers and other safety-critical elements that protect workers and the environment from major offshore accidents,” said Dr. Rafael Moure-Eraso, the CSB chairperson. “The two-volume report we are releasing today makes clear why the current offshore safety framework needs to be further strengthened.”

 “Our investigation has produced several important findings that were not identified in earlier examinations of the blowout preventer failure,” said CSB Investigator Cheryl MacKenzie, who led the investigative team. “The CSB team performed a comprehensive examination of the full set of BOP testing data, which were not available to other investigative organizations when their various reports were completed. From this analysis, we were able to draw new conclusions about how the drill pipe buckled and moved off-center within the BOP, preventing the well from being sealed in an emergency.”

The April 2010 blowout in the Gulf of Mexico occurred during operations to “temporarily abandon” the Macondo oil well, located in approximately 5,000-foot-deep waters some 50 miles off the coast of Louisiana. Mineral rights to the area were leased to oil major BP, which contracted with Transocean and other companies to drill the exploratory Macondo well under BP’s oversight, using Transocean’s football-field-size Deepwater Horizon drilling rig.

Cement failed to seal the well

The blowout followed a failure of the cementing job to temporarily seal the well, while a series of pressure tests were misinterpreted to indicate that the well was in fact properly sealed. The final set of failures on April 20 involved the Deepwater Horizon’s blowout preventer (BOP), a large and complex device on the sea floor that was connected to the rig nearly a mile above on the sea surface.

Effective compression, as described in the draft report, occurs when there is a large pressure difference between the inside and outside of a pipe. That condition likely occurred during emergency response actions by the Deepwater Horizon crew to the blowout occurring on the night of April 20, when operators closed BOP pipe rams at the wellhead, temporarily sealing the well. This unfortunately established a large pressure differential that buckled the steel drill pipe inside the BOP, bending it outside the effective reach of the BOP’s last-resort safety device, the blind shear ram.

Ways to avoid pipe buckling

“The CSB’s model differs from other buckling theories that have been presented over the years but for which insufficient supporting evidence has been produced,” according to CSB Investigator Dr. Mary Beth Mulcahy, who oversaw the technical analysis. “The CSB’s conclusions are based on real-time pressure data from the Deepwater Horizon and calculations about the behavior of the drill pipe under extreme conditions. The findings reveal that pipe buckling could occur even when a well is shut-in and apparently in a safe and stable condition. The pipe buckling – unlikely to be detected by the drilling crew – could render the BOP inoperable in an emergency. This hazard could impact even the best offshore companies, those who are maintaining their blowout preventers and other equipment to a high standard. However, there are straightforward methods to avoid pipe buckling if you recognize it as a hazard.”

The CSB investigation found that while Deepwater Horizon personnel performed regular tests and inspections of those BOP components that were necessary for day-to-day drilling operations, neither Transocean nor BP had performed regular inspections or testing to identify latent failures of the BOP’s emergency systems. As a result, the safety-critical BOP systems responsible for shearing drill pipe in emergency situations – and safely sealing an out-of-control well – were compromised before the BOP was even deployed to the Macondo wellhead. The CSB report pointed to the multiple miswirings and battery failures within the BOP’s subsea control equipment as evidence of the need for more rigorous identification, testing, and management of critical safety devices. The report also noted that the BOP lacked the capacity to reliably cut and seal the 6-5/8 inch drill pipe that was used during most of the drilling at the Macondo well prior to April 20 – even if the pipe had been properly centered in the blind shear ram’s blades.

Despite the multiple maintenance problems found in the Deepwater Horizon BOP, which could have been detected prior to the accident, CSB investigators ultimately concluded the blind shear ram likely did close on the night of April 20, and the drill pipe could have been successfully sealed but for the buckling of the pipe. 

Another catastrophic accident is possible

“Although there have been regulatory improvements since the accident, the effective management of safety critical elements has yet to be established,” Investigator MacKenzie said. “This results in potential safety gaps in U.S. offshore operations and leaves open the possibility of another similar catastrophic accident.”

The draft report, subject to Board approval, makes a number of recommendations to the U.S. Department of Interior’s Bureau of Safety and Environmental Enforcement (BSEE), the federal organization established following the Macondo accident to oversee U.S. offshore safety. These recommendations call on BSEE to require drilling operators to effectively manage technical, operational, and organizational safety-critical elements in order to reduce major accident risk to an acceptably low level, known as “as low as reasonably practicable.”

“Although blowout preventers are just one of the important barriers for avoiding a major offshore accident, the specific findings from the investigation about this BOP’s unreliability illustrate how the current system of regulations and standards can be improved to make offshore operations safer,” Investigator MacKenzie said. “Ultimately the barriers against a blowout or other offshore disaster include not only equipment like the BOP, but also operational and organizational factors. And all of these need to be rigorously defined, actively monitored, and verified through an effective management system if safety is to be assured.”  Companies should be required to identify these safety-critical elements in advance, define their performance requirements, and prove to the regulator and outside auditors that these elements will perform reliably when called upon, according to the draft report.

A recommendation to the industry

The report also proposes recommendations to the American Petroleum Institute (API), the U.S. trade association for both upstream and downstream petroleum industry. The first recommendation is to revise API Standard 53, Blowout Prevention Equipment Systems for Drilling Wells, calling for critical testing of the redundant control systems within BOP’s, and another for new guidance for the effective management of safety-critical elements in general.

CSB Chairperson Rafael Moure-Eraso said, “Drilling continues to extend to new depths, and operations in increasingly challenging environments, such as the Arctic, are being planned. The CSB report and its key findings and recommendations are intended to put the United States in a leading role for improving well-control procedures and practices. To maintain a leadership position, the U.S. should adopt rigorous management methods that go beyond current industry best practices.”

Two forthcoming volumes of the CSB’s Macondo investigation report are planned to address additional regulatory matters as well as organizational and human factors safety issues raised by the accident.