Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter.
Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 45
3
Blowout Preventer System
If hydrocarbons unexpectedly flow into the well during drilling or other
operations despite the use of primary barriers in the well, the blowout preventer
(BOP) system serves as a secondary means of well control (i.e., preventing un-
desired hydrocarbon flow from the well). During offshore drilling, the system is
deployed and attached to the wellhead to seal an open wellbore, close the annu-
lar portion of the well around the drill pipe or casing, or cut through the drill
pipe with steel shearing blades and then seal the well. A typical BOP system
also has more routine functions such as enabling certain well pressure tests and
injecting and removing fluid from the well through its “choke” and “kill” lines.
This chapter discusses the basic well control function of the BOP system that
was part of the Deepwater Horizon mobile offshore drilling unit (MODU),1 gen-
eral studies of BOP system reliability, the role of the BOP failure in the incident,
and the results of forensic analyses of the recovered BOP system. The commit-
tee found several past studies and incident reports that documented the limita-
tions of BOP effectiveness and reliability concerns, and they are discussed be-
low. Unfortunately, it appears that neither industry nor the Minerals Manage-
ment Service (MMS) responded to these past accidents in an appropriate man-
ner. The chapter provides the committee’s findings and observations, as well as
its recommendations for improving BOP system reliability.
BOP SYSTEM FOR DEEPWATER HORIZON
The BOP system for Deepwater Horizon was a massive, 57-foot-tall, ap-
proximately 400-ton well control system located at the wellhead (DNV 2011a, I,
15). A riser pipe attached to the top of the BOP system extended to the drilling
platform on the Deepwater Horizon to permit drilling fluids to circulate between
the borehole and the rig, passing through the BOP system. The bottom of the
BOP rests on top of a remotely detachable connection to the wellhead, which
allows the BOP to be released after well completion.
1
The term “rig” is intended to be synonymous with mobile offshore drilling unit.
45
OCR for page 46
46 Macondo Well Deepwater Horizon Blowout
The BOP system was formed from two basic structural assemblies. The
lower assembly, referred to as the BOP stack, rests on the wellhead connector.
The upper assembly, referred to as the lower marine riser package (LMRP), was
placed through a remotely detachable connection on top of the BOP stack and
had roughly the same gross dimensions as the BOP stack. These assemblies, and
basic functional components discussed below, are shown schematically in Fig-
ure 3-1. The LMRP had two annular preventers, and the BOP stack had four
principal sealing elements: one blind shear ram (BSR) and three variable bore
rams (VBRs). It also had a casing shear ram (CSR) that could shear drill pipe
and casing but was not designed to seal the well. In addition, various control
systems were located on the BOP system. In the event of an emergency discon-
nect, the LMRP was supposed to separate from the BOP stack, and the rig, riser,
and LMRP were to move away from the well, which was to have been sealed by
that point by the BSR in the BOP stack.
Annular Preventers
The LMRP contained two well-sealing components: the upper annular
preventer and the lower annular preventer. The preventers were, as the name
implies, annular in shape, and they were essentially flexible, elastomeric
“doughnut” seals backed by steel elements that could accommodate a range of
diameters of pipe and seal the annular space between the drill pipe and the
LMRP. The annular seals were used so that the well could be tested, for exam-
ple, for the so-called “negative test” discussed in Chapter 2, or potentially to
stop any unwanted flow up or down the annulus.
In a blowout-prevention situation, the annular seals (if intact) could be ac-
tivated and seal off the annular space between the pipe and the LMRP, although
a blowout could still occur as a result of flow through the drill pipe itself if the
drill pipe was not sealed.
A limiting factor was the maximum allowable differential pressure across
the annular preventers. Reportedly, the upper annular preventer was designed for
up to 10,000-psi differential pressure for sealing against a drill pipe or 5,000 psi
when sealing the entire hole. The lower annular preventer was apparently de-
signed for a 5,000-psi differential pressure for sealing around a drill pipe (BP
2010; Transocean 2011a).
Blind Shear Ram
The BSR was the uppermost of the five rams of the BOP stack and is
shown for nominal operation in Figure 3-2. A BSR is like a massive metal scis-
sors with two opposing blades that are designed to slice through the drill pipe as
the blades pass by each other, as shown in Figure 3-3, and seal the well. The
design intent was that, when the two blades of the “scissors” passed by each
other and fully penetrated into the “side packers” on the other side, the seal
OCR for page 47
47
Blowout Preventer System
across the BOP bore was to be effected and thus seal off the entire throat of the
BOP. The BSR was, by design, a device of last resort in a hierarchy of well con-
trol strategies: when all else failed, the BSR was to slice the drill pipe and seal
the well. Even if no drill pipe was present in the BOP system, the BSR was de-
signed to seal the well when the “scissor blades” passed by each other and into
the side packers.
FIGURE 3-1 Deepwater Horizon BOP port side. Source: DNV 2011a, I, p. 14. Reprinted
with permission; copyright 2011, DNV.
OCR for page 48
48 Macondo Well Deepwater Horizon Blowout
FIGURE 3-2 Sketch of intended nominal operation of BSR in the Macondo well.
Source: DNV 2011a, I, p. 155. Reprinted with permission; copyright 2011, DNV.
FIGURE 3-3 Upper and lower shear blades crushing the drill pipe and beginning the
shearing (or breaking) operation. Source: West Engineering Services, Inc. 2004, p. 2-2.
Reprinted with permission; copyright 2004, West Engineering Services, Inc.
OCR for page 49
49
Blowout Preventer System
The BSR was designed to be capable of activation in several ways (DNV
20011a, I, 2):
By personnel on the Deepwater Horizon directly via either one of
two control panels;
Through the activation of the emergency disconnect system (EDS,
with options EDS 1 and EDS 2) (BOEMRE 2011, 133), which was to function
via either of the two control panels on the rig (the EDS was meant to be trig-
gered when the drilling rig was to come off the well in an emergency for what-
ever reason);
By the circuits located on either of two pods on the BOP system if the
automatic mode function (AMF) was activated by loss of communications and
hydraulic connection with the rig;
By the autoshear function located on the BOP stack if the connection
to the LMRP was physically broken; and
By a subsea remotely operated vehicle (ROV).
The BSR is the only ram on the BOP that has automatic modes of opera-
tion: the AMF mode, which depends on the blue and the yellow pods, and
autoshear mode, which does not depend on the control pods. All the other rams
on the BOP are manually activated through the control pods.
Casing Shear Ram
The CSR was located below the BSR. It consisted of two pieces of metal
with opposed V-shaped cutting tools above and below the plane of the slice. The
CSR was designed to cut larger, thicker pipe than the BSR was designed to cut,
such as casing rather than drill pipe. But the CSR, unlike the BSR, was not de-
signed to seal off the BOP; it was designed only to cut pipe or casing.
Variable Bore Rams
Three VBRs were located near the base of the BOP stack, below the BSR
and CSR. These rams had metal-reinforced elastomeric annular elements that,
similar in function to the annular preventers in the LMRP, were designed to seal
off the annular space between the drill pipe and the BOP system. The VBRs
were more structurally robust than the annular preventers but were to close on
only a narrow range of pipe diameters. The bottom VBR had been reversed to
create a “test ram” that would seal against pressure in the riser instead of pres-
sure in the well.
Control System
A number of components of the BOP control system were located on the
BOP system itself, and the remainder were on the Deepwater Horizon. Two
OCR for page 50
50 Macondo Well Deepwater Horizon Blowout
electrohydraulic systems, termed blue and yellow “control pods,” which were
housed on the LMRP, were key system control components on the BOP.
The control pods each contained electronic control units, which were con-
nected to the drill rig with multiplexer (MUX) communication cables. A hydrau-
lic line from the drill rig to the LMRP enabled the pressurization of the cylinder
bank on the BOP system that held pressurized hydraulic fluid. The electronic
control system opened and closed valves that allowed the pressurized hydraulic
fluid to flow and to activate all rams and the seals in the upper and lower annular
preventers.
The annular preventers and shear rams were driven by high-pressure hy-
draulic fluid that could have come from the rig, or—if connection with the rig
was lost—from eight pressurized 80-gallon hydraulic accumulators on the BOP
system. The accumulators contained high-pressure gas that was intended to push
on the elastomeric bladders storing the hydraulic fluid. The high-pressure fluid
initially pumped into the accumulators “charged” these accumulators. Electronic
devices, when commanded, opened solenoid-driven valves that enabled the
high-pressure hydraulic fluid to exit (driven by the gas in the accumulators). The
high-pressure hydraulic pressure drove the rams (pistons) that displaced the pre-
venters and rams. The electronic systems were complex and permitted control
from the drilling rig, or—if communications were lost—were designed to self-
initiate automated actions such as operation of the BSR.
Comments on Emergency Operations
The BSR is designed to be the true emergency sealing ram—it is the only
one of the various rams on the BOP system that is designed to cut the pipe and
seal the BOP system and hence the well. Sealing off the BOP system after slic-
ing the drill pipe is a technical challenge but is well within the capabilities of
current technology. The differential pressure above and below the BSR, if it
works and seals, can be immense—thousands of pounds per square inch—
creating enormous force and the need for high structural integrity, carefully en-
gineered seals, and adequate testing under extreme conditions. After the metal
pipe is sliced, fugitive metal from the sliced drill string cannot be permitted to
become wedged between the slicing elements, which would prevent the slicing
devices from fully closing and effecting a seal.
Further complicating the ram design envelope is the fact that the drill pipe
joints (“tool joints”) are necessarily thicker than the drill pipe itself to accom-
modate geometrically the threaded portions of connecting drill pipe and to
transmit the drilling torque between them. Transocean’s 2008 document Well
Control Complications/Emergency provides background on the intended func-
tion of the BSRs. The Transocean document notes that “most BSRs are designed
to shear effectively only on the body of the drill pipe. Procedures for use of
BSRs must therefore ensure that there is no tool joint opposite the ram prior to
drilling” (Transocean 2008, 2). Time and care are needed to ensure that no tool
OCR for page 51
51
Blowout Preventer System
joint is located in the plane of the BSR. Furthermore, the BOP system did not
contain monitoring devices that would directly indicate the location of tool
joints within the BOP system to the crew on the rig. Thus, to ensure that a tool
joint is not present in the plane of the BSR, the drilling crew would have to posi-
tion a tool joint at a known location, either by measurement and calculation of
the tool joint positions or by “hanging” a tool joint on an underlying VBR.
The 2008 Transocean document does not address determination of tool
joint location during time-critical situations. The documents states that “opti-
mum shearing characteristics are obtained when the pipe is stationary and under
tension” (Transocean 2008, 2). By analogy, cutting a string or cord with scissors
is always easier if the string or cord is taut. But unlike regular string, drill pipe
can transmit high compressive loads, particularly when it can use the side walls
of the BOP for lateral stability. In the case of the Deepwater Horizon on April
20, 2010, the drill string above the BOP had a “dry weight”2 of more than
150,000 pounds.3 If an attempt is made to shear a drill string in compression,
additional friction can be substantial. When a BSR is slicing the pipe, the slice is
much easier to facilitate when the pipe is in tension (being pulled) rather than
under compression. Under tension, the two pieces being cut are being pulled
apart, away from the cut. If, instead, the drill pipe is in significant compression,
the two pieces being cut are pressed against one another and pressing on the
shearing blades, making the required shearing force much higher. Furthermore,
under tension, the cut pipe would be pulled away from the rams, clearing the
way for the rams to seal. Under compression, the pipe would tend to be jammed
into the rams and therefore block full sealing. To keep the long slender drill pipe
string in tension, it is hung off a “hook” that is attached to a “traveling block”
whose vertical location can be moved up and down by a huge cable hoist in the
drilling derrick. At the time of the explosion on the Deepwater Horizon, the dry
weight of the entire drill string was 217,000 pounds, entirely borne by the hook
and traveling block, and the total hook load hovered around 360,000 pounds (BP
2010, 105). Witness statements indicate in the case of the Deepwater Horizon
that the rig’s traveling block, which carries the hook load (weight of the drill
pipe string and upper works), fell at 22:20 (Transocean 2011a, I, 31), although
the hook load itself could have been lost earlier as a result of damage from the
explosions.
The design of the BOP system for the Deepwater Horizon focused on the
use of the BSR under controlled conditions when tension in the drill pipe can be
assured, and this appears to be the only way that BOP shear rams are tested.
Tension would be lost, for example, if the drill pipe and the drill rig became
disconnected because of an accident or explosion and the drill pipe moved
downward into the well. Tension might be assured under carefully controlled
2
The actual compressive load of this string at the BOP is slightly less due to the
“buoyancy” of the steel relative to the weight of the fluids in the string, but not greatly.
3
Transocean (2011a, I, 89), assuming 4,103 feet of 6 5 8 -inch string at 32.67 pounds
per foot and 900 feet of 5½-inch string at 21.9 pounds per foot.
OCR for page 52
52 Macondo Well Deepwater Horizon Blowout
conditions, but not in an emergency (such as that encountered on the Deepwater
Horizon) or in a number of other possible situations. Furthermore, since BOP
ram testing is invariably done on the surface, the effects of a huge compressive
pressure differential across the ram blocks are not revealed by the tests.
Some BOP systems have two BSRs as a remedy for the problem of a tool
joint being in the wrong place, which can occur with a single BSR during an
emergency. “All subsea BOP stacks used for deepwater drilling should be
equipped with two blind-shear rams” was the conclusion of SINTEF (Stiftelsen
for Industriell og Teknisk Forskning) in a study for MMS in 2001 (Holand and
Skalle 2001, 96). The practice of using a single BSR that is incapable of cutting
a tool joint raises serious questions about the overall reliability of the system in
an emergency. The goal of future BOP designs should be high reliability under
emergency conditions. How this requirement is met need not be prescriptively
specified in regulation and may or may not require multiple BSRs. Regulation
should require that emergency BOP reliability be empirically demonstrated by
impartial testing under the most demanding conditions that would be encoun-
tered in an emergency.
AREAS OF INVESTIGATION
The committee investigated the role that the BOP system failure played in
the Macondo well–Deepwater Horizon disaster and identified what might be
done in terms of BOP system design, operation, and maintenance to prevent
such an occurrence in the future.
Prior Warnings That Existing BOP System Designs Were Inadequate
Before the Macondo well blowout, there were numerous warnings to both
industry and regulators about potential failures of existing BOP systems. While
the inadequacies were identified and documented in various reports commis-
sioned over the years by industry operators and regulatory organizations alike, it
appears that there was a misplaced trust by responsible government authorities
and many industry leaders in the ability of the BOP to act as a fail-safe mecha-
nism.
West Engineering Studies
West Engineering Services, Inc., conducted two studies (West Engineer-
ing Services 2002, 2004) on BOPs at the behest of MMS, now known as the
Bureau of Ocean Energy Management, Regulation, and Enforcement
(BOEMRE). The first, Mini Shear Study, apparently a preliminary study, was
submitted in December 2002. The study was a review of shear ram test proce-
dures from American Petroleum Institute (API) Specification 16A and results of
OCR for page 53
53
Blowout Preventer System
shear tests performed by rig operators on seven BOP systems. Fourteen cases
were examined, but only seven included testing of BOP shearing capabilities.
The study made several important points:
“This study was designed to answer the question ‘Can a given rig’s
BOP shear the pipe to be used in a given drilling program at the most demand-
ing condition to be expected?’ This can only be demonstrated conclusively by
testing.”
“Of the seven [BOPs] tested, five successfully sheared and sealed
based on shop testing only. If operational considerations [increased hydrostatic
pressure] of the initial drilling program were accounted for, shearing success
dropped to three of six (50%).”
“This limited data set from the latest generation of drilling rigs paints
a grim picture of the probability of success when utilizing this final tool in se-
curing a well after a well control event.”
“WEST is unaware of any regulatory requirements that state the ob-
vious: that the BOP must be capable of shearing pipe planned for use in the cur-
rent drilling program.”
The West Engineering study addressed the challenge of increased hydro-
static head to the BSR but did not address the even greater challenge of a large
pressure differential across the rams as they attempt to seal. The West study
addressed only the likelihood of the BSR shearing the pipe, not sealing it.
The West report indicates that drill pipe of a particular weight and grade
may be the only pipe that a particular BOP shear ram is capable of cutting. In
addition, the shear ram is unlikely to be able to sever drill pipe tool joints or
heavy wall pipe such as drill collars. This means that careful housekeeping must
be maintained to ensure that the correct type of pipe is in the correct position
inside the BOP stack, particularly if only one shear ram exists on the BOP stack.
Also, there is no automated means of ensuring that there is no tool joint in the
BSR. This has to be done by (accurate) measurement and calculation.
The second study conducted by West Engineering Services, Inc., Shear
Ram Capabilities Study, was submitted in September 2004. It expanded on the
first study with theoretical and statistical studies of shear ram data from manu-
facturers, a review of BOP stack configurations, and a review of known BOP
failures to shear and seal. The second report amplified the conclusions and ob-
servations of the first and made several additional points:
Section 3.2 of the report states the following: “Improved strength in
drill pipe, combined with larger and heavier sizes resulting from deeper drilling,
adversely affects the ability of a given ram BOP to successfully shear and seal
the pipe in use. WEST is currently aware of several failures to shear when con-
ducting shear tests using the drill pipe that was to be used in the well. Only half
of the operators accepting a new-build rig chose to require a shear ram test dur-
OCR for page 54
54 Macondo Well Deepwater Horizon Blowout
ing commissioning or acceptance. This grim snapshot illustrates the lack of pre-
paredness in the industry to shear and seal a well with the last line of defense
against a blowout.”
The report reviewed one notable BOP “failure to shear and seal a
well,” the Pemex blowout in the Bay of Campeche in 1979, which released 3.3
million barrels of oil before the well was killed. The report states the following:
“Reportedly they were pulling the drill string too quickly without proper fluid
placement and the well started coming in. They had no choice but to close the
shear rams; unfortunately, drill collars were in the stack and shearing failed”
(West Engineering Services 2004, 3-4). (Note: Drill collars are thick pieces of
pipe used to provide weight and stiffness at the bottom of the drill string. The
tool joint for the 6 5 8 -inch drill pipe had an outer diameter of 8.25 inches and an
inner diameter of 4.625 inches at the upset for a wall thickness of 1.8125 inches.
The drill collar would normally be thicker than this. For example, an 8¾-inch
outer diameter drill collar could have an inner diameter around 3.25 inches for a
wall thickness of 2.75 inches.)
The method used by several BOP manufacturers for predicting
whether the shear rams will successfully shear pipe and seal the well should be
more accurate. Currently only tests can demonstrate the reliability of a shear ram
with the particular pipe being used. The September 2004 study called on indus-
try to develop better predictive methods and to establish a database that can be
shared by all.
In the cutting process, the shear rams collapse or mash the pipe, and
as the pipe is crushed, the blade angle pulls the metal into tension and breaks it
in a tensile mode of failure (Figure 3-3). Depending on the ram blade design, the
blade can flatten the pipe to a great extent, which in turn can prevent the ram
from closing completely and sealing even if the pipe is centered.
CSRs were introduced to shear large-diameter, thick-walled pipe
such as casing. These rams do not have a sealing mechanism so that the blade
can be made strong enough to shear the thicker wall pipe. CSRs are installed in
the BOP stack below the BSR so that the casing rams can be used to sever
thicker pipe, and then the drill string above the casing rams can be raised out of
the way so that the BSR can be closed and the well sealed. Some BOP stacks
use a second BSR below the CSR to create a second opportunity to shear and
seal the well, which basically ensures that at least one BSR will not have a drill
pipe tool joint in front of it. However, in this situation, if the severed pipe cannot
be removed from the BSR area it will likely not close sufficiently to seal.
The various control systems on the rig are not integrated. Information
from the BOP system is shown as indicator lights on the control panel on the rig,
but no communication is made to the pipe-handling system to ensure that the
pipe is in the correct position within the BOP system for well control operations.
The second study also illustrated the challenge of keeping long-lived
BSR designs from becoming obsolete. West stated: “There are two basic types
of sealing shear ram designs: single [the type in the BSR of the Deepwater Hori-
OCR for page 55
55
Blowout Preventer System
zon] and double ‘V’ blades—rams with double ‘V’ blades appear to have 15%
to 20% lower shear forces than single blade designs. The data received primarily
included shear rams having both blades ‘V’ shaped.4 The two data points from
shear rams that did not have both blades ‘V’ shaped [as was the case on the
Deepwater Horizon] were excluded from statistical consideration” (West Engi-
neering Services 2004, 4-2).
When a signal is sent from the drilling rig to the BOP (on the seafloor) to
execute a command, the BOP sends a message back that the signal has been
received. However, there are no devices to send a signal that any command has
been executed, such as pressure or displacement sensors confirming that hydrau-
lics were actuated or that rams have moved or that pipe has been cut, nor are
there any flow sensors measuring whether the well has been sealed.
Additional conclusions can be drawn from the two West Engineering stud-
ies. Clearly, the operating success of the BSR was recognized to be much less
than 100 percent years before the Macondo well blowout. It appears to be no
better than 50 percent, on the basis of the results of the Mini Shear Study de-
scribed above. This success ratio is inconsistent with the expectations placed on
the BOP system as a fail-safe mechanism to close an out-of-control well. If well
pressure is assumed to be contained by the annular preventer (assume the maxi-
mum rating of the annular preventer to represent this pressure) and if the well
pressure differential across the BOP is assumed to be much larger than the hy-
drostatic pressure exerted by the drilling mud (as was the case in the Macondo
well by at least two times), the shear success percentage demonstrated by the
first study would decrease even further.
At no time is the drill pipe placed in compression during the tests dis-
cussed in the first West Engineering study. In fact, care is taken “to prevent ex-
cessive bending of the pipe” (API Specification 16A, Part B4.3.d [1997] (as
cited in West Engineering Services 2004, 9-1)). The pipe section below the
shear ram is not confined and is free to fall out of the shearing ram during opera-
tion. In contrast to this ideal test situation, if the pipe is in compression it may
buckle as soon as the ram begins to shear it. The shear ram may not be able to
cut the pipe in this condition. If the pipe is cut but cannot move out of the area
of the closing rams, the rams may not seal. Sealing was not even considered in
the study.
The careful housekeeping necessary to ensure that the correct type of pipe
is in the correct position in the BOP stack may be difficult to accomplish in a
well control emergency, further decreasing the chance that the shear rams will
function correctly. Even with the addition of a CSR, the ability to seal the well is
questionable if the pipe either above or below the CSR must be moved out of the
way after the CSR cuts the pipe to allow one or more BSRs to seal the well. In a
well control emergency there is no assurance, or even a likelihood, that the pipe
can be moved at the appropriate moment to allow the BSR to seal. And obvi-
4
See Figure 4.1 of West Engineering Services (2004).
OCR for page 64
64 Macondo Well Deepwater Horizon Blowout
But BP (2010, 156) has observed, not wholly inconsistently with Transocean’s
claim:
In an effort to actuate and open the autoshear valve, the autoshear rod was
cut at approximately 07:40 hours on April 21, 2010. Incident management
team (IMT) responders, who were monitoring ROV operations when the
autoshear was activated, reported that movement was observed on the
BOP stack. This movement was consistent with stack accumulators dis-
charging. A short time later, a leak on the ST lock hydraulic circuit, which
was downstream of one of the BSR bonnet sequence valves, was ob-
served, indicating that the lock circuit and the BSR were closed.
DNV (2011a, I, 169) independently observed:
While the conditions necessary for AMF/Deadman existed immediately
following the first explosion/loss of rig power, because of the inconsistent
behavior of original Solenoid 103Y and the state of the 27V battery bank
on the Blue Control Pod, it is at best questionable whether the sequence
was completed.
The weight of the evidence appears to support the conclusion of BP and
DNV that the BSR was activated by the autoshear, but for additional reasons not
addressed in their reports. All parties appear to agree that the upper and middle
VBRs successfully sealed the well a minute or two before the explosions, ac-
counting for the large pressure spike in the drill string starting at 21:47 (BP
2010, 105). Both these VBRs were found with their ST locks set (DNV 2011a, I,
31), meaning that they stayed applied, irrespective of flow or pressure, until the
BOP was retrieved. Thus, until they were eventually eroded, the annulus of the
BOP remained sealed by these VBRs. During this period the only flow path for
hydrocarbons from the formation to the rig was the drill string. If Transocean
was correct, this flow path was interrupted “within minutes” by the AMF acti-
vating the BSR. It appears undisputed that the BSR sheared the drill string off
center in the manner illustrated by Figure 3-6, which is from the DNV report
addendum (DNV 2011b, 17). If Transocean is correct and the AMF functioned
“within minutes” of 21:50, then the entire hydrocarbon communication with the
Macondo well must have been through the small flow area that would exist at
that time from the sheared end of Pipe Segment 94 (End 94B) (DNV 2011a, I,
95). Note on Figure 3-6 in Frame 23 that the sheared pipe end is shown with
only 277,000 pounds of ram load applied where the BSR will ultimately apply
approximately 900,000 pounds of ram force at the regulated pressure of 4,000
psi (DNV 2011a, 14). Thus, substantially less cross-sectional flow area will be
available to well hydrocarbons than is shown in Frame 23.
If the AMF functioned for at least some time, there should have been a
significant reduction in hydrocarbon flow from the well that would have become
OCR for page 65
65
Blowout Preventer System
FIGURE 3-6 Progression of off-center BSR shear model, isometric view (top) and top
view showing deformation of drill pipe outside of shearing blade surfaces (bottom).
Source: DNV 2011b, p. 17. Reprinted with permission; copyright 2011, DNV.
apparent after the initial hydrocarbons that had leaked into the riser before the
rams were activated blew out on the surface. This statement is true even if the
explosions completely severed the drill string at the surface. After the drill string
contents blew out, it would no longer have significant communication with the
well for a period of time in the face of 900,000 pounds of clamping pressure on
the output end of the severed drill string.
However, this scenario does not appear to be borne out by witness descrip-
tions of the fire. “It was quickly apparent to the bridge team that it was impossi-
ble to regain control of the well or to fight the fires” (Transocean 2011a, I, 32).
Several crew members jumped into the sea as the fire continued to grow in in-
tensity (Transocean 2011a, I, 32). Thus, there appears to have been no interrup-
tion in flow from the well during the crucial minutes after the initial explosions,
and the BSR rams appear not to have closed until the autoshear was activated.
Given the timing of the BSR activation, attention can now turn to the po-
tential sources of the compression in the drill string that produced an off-center
position in the BSR. Transocean produced several calculations consistent with
the DNV hypothesis purporting to show that the pressure in the formation was
sufficient to lift the drill string and create the necessary compression. The first is
OCR for page 66
66 Macondo Well Deepwater Horizon Blowout
2
set forth as: “5.5-in. drill pipe = 23.75 in. 7,000 psi = 166,250 lb. lift” (Trans-
ocean 2011a, I, 157, Footnote E). This is Transocean’s assumed loading on the
drill string after the VBR’s activation and presumably at the time of the postu-
lated AMF activation, “within minutes” of the explosions. While the formula is
mathematically correct, its application to the Macondo well drill string is diffi-
cult to see. To start with, 1 minute before the explosions, after the VBR activa-
tion, the internal drill string pressure on the rig shot up to more than 5,600 psi
(BP 2010, 105). The bottom of the 5½-inch section of the drill string reached a
depth of 7,546 feet below the drill rig floor (Transocean 2011a, I, 89). On the
basis of the assumption that the entire length of drill string was filled with sea-
water being used to displace the drilling mud, at 0.445 psi per foot the seawater
added another 7,546 0.445 = 3,358 psi of hydrostatic head to the internal drill
pipe pressure measured on the rig, for a total pressure inside the end of the 5½-
inch section of drill string of approximately 5,600 psi + 3,358 psi = 8,958 psi.
The pressure measured on the rig in the drill string could only increase from
about 1,200 psi to about 5,600 psi in 2 minutes if the formation pressure being
exerted at the tip of the drill string was greater than the drill string pressure plus
the hydraulic head of the total drill string (about 5,600 psi + 3,70712 psi), or
about 9,307 psi, and flow was going into the drill string.
A different calculation of the same loading is set forth in Appendix M of
Transocean (2011a): “In the shut in condition, the pressure below the VBR is
8,000 – 8,500 psi. With an assumed hydrocarbon density of 2 ppg above the
VBR, the pressure above the VBR is 500 psi. Thus, the pressure drop across the
VBR is about 8,000 psi, which corresponds to a net compression of about 120
kips” (Transocean 2011, Appendix M, 29). Needless to say, the two calculations
do not agree.
Matters are different if it is postulated that the explosions on the rig rup-
tured the drill string and allowed the high drill string internal pressure to bleed
down to atmospheric pressure at the rig. Such an event would leave only the
3,358 psi of hydrostatic internal pressure in the drill string, acting on the 4.8-
inch internal diameter at the end of the 5½-inch section, for a total hydrostatic
load of 60,765 pounds. This would be sufficient to reduce Transocean’s postu-
lated lift by almost half and Transocean’s total calculated lift well below the
compressive force level necessary at the BOP calculated by DNV. However,
Transocean’s first lift calculation also ignored the weight of the drill string be-
low the BOP. On the basis of the data for drill string dimensions and weights
(Transocean 2011a, I, 89), this is calculated as 62,232 pounds dry weight, which
corrects to 53,301 pounds buoyed by seawater. Transocean’s calculation in Ap-
pendix M would appear to take cognizance of the drill string weight, but neither
appears to consider the pressure internal to the drill string. In both calculations
Transocean treats the drill string as a piston, when in reality it is more like a
straw, open at the bottom and the top after the explosions. The hydrostatic pres-
12
8,367 total feet of drill string 0.445 psi/ft.
OCR for page 67
67
Blowout Preventer System
sure internal to the end of the 5½-inch drill string section and the buoyed weight
of drill string below the BOP together produce 114,065 pounds of load. This
must be overcome before the first pound of compression will be felt by the drill
string in the BOP under any postulated failure scenario consistent with DNV’s
hypothesis. An additional 821 feet of 3½-inch tubing is attached to the end of
and hanging below the 5½-inch drill string, which is included in the calculations
of buoyed weight but whose hydrostatically induced internal pressure would be
even greater due to an additional 821 feet of head. Since the end of the 3½-inch
tubing is opened to the flow from the formation and the top of the drill string has
clearly been ruptured by the explosions, the area of the 3½-inch drill string is a
“straw” that cannot be used in a calculation of compression load from pressure,
so it is difficult to postulate a situation, short of some incredibly high flow rates,
under which a significant pressure differential could be established between the
inside and the outside of the drill string. Production of 115,000 pounds of drill
string compression in the BOP as postulated by DNV requires that flow friction
and pressure below the BOP generate a total of almost 230,000 pounds of verti-
cal lift. There is a total of about 3,337 feet of drill string below the BOP. For
fluid drag to produce the required vertical lift would require an average of 69
pounds of vertical fluid drag per linear foot of drill string. However, it is
unlikely that the drag between the 3½-inch tubing and the 5½-inch drill string
would be uniform, given that the flow is predominantly up the drill string, as
evidenced by the erosion wear at the VBRs, which remain applied until the BOP
is recovered. While the fluid drag is likely to be significantly greater in the 3½-
inch tubing than in the 5½-inch drill string, use of even the 69-pound average
means that the top of the 3½-inch tubing would experience a compressive load
of 56,650 pounds. Whether the walls of this 9.3-pound-per-foot tubing can
transmit a compressive load of 28 tons without local wall buckling is unknown.
Given the technical challenge of developing the 115,000 pounds of verti-
cal compressive load on the drill string postulated by DNV through flow fric-
tion, gravity is a simple and attractive alternative. Above the BOP sit approxi-
mately 134,045 pounds of 6 7 8 -inch drill string and 19,710 pounds of 5½-inch
drill string, for a total dry weight of 153,755 pounds of drill string. Corrected for
buoyancy, this results in a net drill string weight at the BOP of 135,904 pounds.
This is slightly more than the 115,000 pounds postulated by DNV as necessary
to produce the observed elastic buckling in the drill string. While the rig’s trav-
eling block was observed to fall about 30 minutes after the explosion, when ver-
tical support of the drill string was lost is unknown. For the vertical mass of the
drill string above the BOP to be the source of the compressive load in the BOP
at the time of the application of the autoshear, the drill string must remain intact
above the BOP. Transocean calculates that the drill string parted above the up-
per annular preventer through excessive tensile load at 21:56, approximately 6
minutes (Transocean 2011a, I, 157) after the explosions, as the powerless Deep-
water Horizon drifted off station. Transocean’s assumptions about the integrity
OCR for page 68
68 Macondo Well Deepwater Horizon Blowout
of the derrick after the explosions and its support of the weight of the drill string
are not set out.
DNV (2011a) hypothesized that the drill string “would have been set in
slips to remove the suspended load from the derrick or travelling block.” How-
ever, there is no available evidence of this or of how the slips would have fared
in the two explosions even if they had been used. As illustrated by BP (2010,
105, Figure 17), the hook load measured the weight of the drill pipe, top drive,
blocks, and so forth right up to the moment of explosion. The slips were not set.
While DNV (2011a) did not consider it likely that the two VBRs applied simul-
taneously with full rig hydraulics still connected could have generated the grip-
ping force necessary to support the compression, no data or tests were presented
in support of this hypothesis.
FINDINGS
Summary Finding 3.1: The loss of well control was not noted until
more than 50 minutes after hydrocarbon flow from the formation
started (see timeline in Figure 3-4), and attempts to regain control by
using the BOP were unsuccessful. The BSR failed to sever the drill
pipe and seal the well properly, and the EDS failed to separate the
lower marine riser and the Deepwater Horizon from the well.
The EDS failed to operate because of the loss of MUX communica-
tion in the explosion or the subsequent fire which burned for 7 minutes on
the rig floor before EDS activation was attempted.
Finding 3.2: The crew did not realize that the well was flowing until
mud actually exited and was expelled out of the riser by the flow at
21:40. Early detection and control of flow from a reservoir are critical
if an impending blowout is to be prevented by a BOP whose use
against a full-flowing well is untested.
Finding 3.3: Once mud began to flow above the rig floor, the crew at-
tempted to close the upper annular preventer of the BOP system, but
it did not seal properly. The BOP system had been used in the month
previously to strip 48 tool joints, and apparently it was untested for
integrity afterwards. Annulars are often unable to seal properly after
stripping. In addition, the flowing pressure inside the well may have
been larger than the preset annular closing pressure could overcome.
What tests of sealing against flow have been done on this design of
annular are unknown.
Finding 3.4: The crew also closed the VBRs. The damaged pipe under
the upper annular demonstrated its failure to seal, and the well was
OCR for page 69
69
Blowout Preventer System
only sealed, resulting in the final pressure spike, when these VBRs
were closed. The DNV investigation also found that these rams closed,
and they could only be closed by command from the rig control panels
and not by an ROV. At this point the flow from below the VBRs
would have been closed off, but gas and oil had already flowed into
the marine riser above the BOP system and continued to rise to the
surface, where the gas exploded.
Finding 3.5: The internal BOP, which functions as a safety valve on
the top of the drill pipe, was not closed (BP 2010, 25). Also, approxi-
mately 30 minutes after the explosion the traveling block was ob-
served to fall and the rotary hose (used to conduct drilling fluid) could
have been destroyed. The growing fire indicates that the drill pipe was
broken in the initial explosion and the fall of the traveling block could
have allowed even more flow to escape up the drill string. This was the
likely path of hydrocarbon flow before the closure of the BSR (see
Chapter 2).
Finding 3.6: Once the fire started on the rig, an attempt was made (af-
ter 7 minutes) to activate the EDS, which should have closed the BSR
and disconnected the LMRP. This appears to have failed because the
MUX communication cables were destroyed by the explosion or fire.
Finding 3.7: Once hydraulic and electrical connection with the rig was
lost at the BOP, the AMF should have activated the BSR. It might
have failed at this time because of a low battery charge in one control
pod and a miswired solenoid valve in the other, but both these points
are in dispute. However, no short-term reduction in hydrocarbon flow
from the well was observed after the initial fire and explosion (see
Figure 3-4). Such a reduction would necessarily have resulted from
the VBRs sealing the annulus in the BOP and the failed BSR shearing
action effectively choking, at least for a brief period of time, virtually
the entire cross section of the 5½-inch drill string. Viewed in total, the
evidence appears more supportive of the autoshear activation of the
BSR.
Finding 3.8: The BSR appears to have been activated after 07:40 on
April 22, 2010, if not earlier, when the hydraulic plunger to the
autoshear valve was cut by an ROV. However, regardless of when the
BSR was activated, the well continued to flow out of control.
Finding 3.9: DNV hypothesized that the drill pipe below the annular
preventer was being forced upward by the pressure of the flowing
well, resulting in a 115,000-pound net compressive force on the drill
pipe in the BOP sufficient to buckle the drill pipe until it came in con-
OCR for page 70
70 Macondo Well Deepwater Horizon Blowout
tact with the inside of the BOP system (DNV 2011a, I, 174). However,
the fluid mechanics inherent in this assumption are dubious. The
135,000 pounds of buoyed drill string weight above the BOP appears
to be a more plausible source of the compression.
Finding 3.10: When it was activated, the BSR was unable to center the
drill pipe in its blades and failed to cut the pipe completely. The
blades of the ram were of the old straight and V combination, which
has been shown to be inferior in its shearing performance to the dou-
ble-V blade geometry (West Engineering Services 2004). Because the
BSR blades did not fully span the BOP annular, a mashed segment of
pipe was caught between the rams and prevented them from closing
to the point where they could seal (DNV 2011b, 17) (see Figure 3-6).
An alternative hypothesis for compressive loading on the drill pipe is that
the loading could have occurred if the drill string were dropped from the top
drive in the derrick. This equipment likely had been damaged or destroyed by an
explosion and fire. A closed VBR would act to restrict the motion of the drill
pipe. The drill pipe above the BOP would go into a long helical buckle above
the ram and in the marine riser, placing a considerable compressive load on the
drill pipe in the BOP system. On the basis of solid mechanics, a pressurized tube
reacts as if it is under compressive load.
Under either of the scenarios mentioned above, the buckling force would
have occurred as soon as the elements of the BOP system prevented the upward
or downward motion of the drill string, and clearly there are several plausible
reasons why the drill string would have been in compression.
Finding 3.11: After the rig lost power and drifted off station, the ma-
rine riser kept the vessel tethered to the BOP system.
Finding 3.12: Flow from the well then exited the partially severed drill
pipe in the BSR and began to erode parts of the ram and BOP stack
by fluid flow.
Finding 3.13: After the vessel sank at 10:22 on April 22, 2010, the ma-
rine riser with the drill pipe inside was bent at a number of places, in-
cluding the connector to the BOP, and oil and gas began to flow into
the ocean.
Finding 3.14: The effect of closing the CSR on April 29, 2010, was to
provide a new flow path exiting the severed drill pipe below the CSR
and passing the CSR rams that were not designed to seal. Severe fluid
erosion occurred past the CSR, with deep cuts made in the surround-
ing steel of the BOP housing itself, endangering the integrity of the
housing.
OCR for page 71
71
Blowout Preventer System
Finding 3.15: Unfortunately, even if the BSR had functioned after be-
ing activated by the EDS or the AMF, it would not likely have pre-
vented the initial explosions, fire, and resulting loss of life, because
hydrocarbons had already flowed into the marine riser above the
BOP system. If the BOP system had been able to seal the well, the rig
might not have sunk, and the resulting oil spill would likely have been
minimized.
Summary Finding 3.16: The BOP system was neither designed nor
tested for the dynamic conditions that most likely existed at the time
that attempts were made to recapture well control. Furthermore, the
design, test, operation, and maintenance of the BOP system were not
consistent with a high-reliability, fail-safe device.
Finding 3.17: Regulations in effect before the incident required the
periodic testing of the BOP system. However, they did not require
testing under conditions that simulated the hydrostatic pressure at the
depth of the BOP system or under the condition of pipe loading that
actually occurred under dynamic flow, with the possible entrained
formation rock, sand, and cement, and no such tests were run. Fur-
thermore, because of the inadequate monitoring technology, the con-
dition of the subsea control pods at the time of the blowout was un-
known.
Finding 3.18: The committee’s assessment of the available informa-
tion on the capabilities and performance of the BOP system at the
Macondo well points to a number of deficiencies (listed below) that
are indicative of deficiencies in the design process. Past studies suggest
that the shortcomings also may be present for BOP systems deployed
for other deepwater drilling operations.
1. The committee could find no evidence that the BOP design
criteria or performance envelope was ever fully integrated into an
overall well control system perspective, nor that BOP design was con-
sistent with the BOP’s critical role in well control.
2. While individual subsystems of various BOP designs have
been studied on an ad hoc basis over the years, the committee could
find no evidence of a reliability assessment of the entire BOP system,
which would have included functioning at depth under precisely the
conditions of a dynamic well blowout. Furthermore, the committee
could find no publicly available design criteria for BOP reliability.
3. The entire BOP system design is characterized by a previ-
ously identified lack of redundancy:
There is only one BSR.
One shuttle valve is used by both control pods.
OCR for page 72
72 Macondo Well Deepwater Horizon Blowout
Each MUX cable is incapable of monitoring the entire
BOP system independently.
4. No design consideration appears to have been given to
BSR performance on pipe in compression.
5. The BSR was not designed to shear all types and sizes of
pipe that might be present in the BOP system.
6. The BSR probably did not have the capability of shearing
or sealing any pipe in significant compression.
7. There was a lack of BOP status monitoring capabilities on
the rig, including
Battery condition,
Condition of the solenoid valves,
Flow velocity inside the BOP system,
Ram position,
Pipe and tool joint position inside the BOP system, and
Detection of faults in the BOP system and cessation of
drilling operations on that basis.
Finding 3.19: The failure of the AMF to activate might have been due
to malfunctions in the control pods that could not be detected. In view
of the state of the pipe in the well after the explosion, whether the BSR
would have functioned properly is uncertain. This issue is moot if the
rams could not perform their intended functions whenever they were
activated.
Finding 3.20: The regulations did not require that the design of the
equipment allow for real-time monitoring of critical features, such as
the battery condition in the control pod, so that maintenance issues
could be readily discovered. The current test protocol for the BSRs,
for example, is designed for near-ideal surface conditions rather than
the harsher conditions found on the ocean floor.
Finding 3.21: When a signal is sent from the drilling rig to the BOP
(on the seafloor) to execute a command, the BOP sends a message
back that the signal has been received. However, there are no trans-
ducers that detect the position or status of key components, and there
are no devices to send a signal that any command has been executed
(such as pressure or displacement sensors confirming that the hydrau-
lics have been actuated, that rams have moved, or that pipe has been
cut). Furthermore, there are no sensors to communicate flow or pres-
sures in the BOP to the rig floor.
OCR for page 73
73
Blowout Preventer System
OBSERVATIONS
Observation 3.1: In the confusion of an emergency such as the one on
the Deepwater Horizon, it is not surprising that a drill crew would not
take the time to determine whether a tool joint was located in the
plane of the BSR or whether tension was properly maintained in the
drill pipe.
Observation 3.2: In terms of emergency procedures, such as an emer-
gency disconnect or autoshear function of the BOP system on its own,
there is no ability to manipulate the tool joint position or the level of
tension or compression in the drill pipe. The BSR was not designed to
work for the full range of conditions that could be realistically antici-
pated in an emergency.
RECOMMENDATIONS
Summary Recommendation 3.1: BOP systems should be redesigned to
provide robust and reliable cutting, sealing, and separation capabili-
ties for the drilling environment to which they are being applied and
under all foreseeable operating conditions of the rig on which they are
installed. Test and maintenance procedures should be established to
ensure operability and reliability appropriate to their environment of
application. Furthermore, advances in BOP technology should be
evaluated from the perspective of overall system safety. Operator
training for emergency BOP operation should be improved to the
point that the full capabilities of a more reliable BOP can be compe-
tently and correctly employed when needed in the future.
Recommendation 3.2: The design capabilities of the BOP system
should be improved so that the system can shear and seal all combina-
tions of pipe under all possible conditions of load from the pipe and
from the well flow, including entrained formation rock and cement,
with or without human intervention. Such a system should be de-
signed to go into the “well closed” position in the event of a system
failure. This does not mean that the BOP must be capable of shearing
every drill pipe at every point. It does mean that the BOP design
should be such that for any drill string being used in a particular well,
there will always be a shearable section of the drill pipe in front of
some BSR in the BOP.
OCR for page 74
74 Macondo Well Deepwater Horizon Blowout
Recommendation 3.3: The performance of the design capabilities de-
scribed in the preceding recommendation should be demonstrated
and independently certified on a regular basis by test or other means.
Recommendation 3.4: The instrumentation on the BOP system should
be improved so that the functionality and condition of the BOP can be
monitored continuously.
Summary Recommendation 3.5: Instrumentation and expert system
decision aids should be used to provide timely warning of loss of well
control to drillers on the rig (and ideally to onshore drilling monitors
as well). If the warning is inhibited or not addressed in an appropriate
time interval, autonomous operation of the BSRs, EDS, general alarm,
and other safety systems on the rig should occur.13
Recommendation 3.6: An unambiguous procedure, supported with
proper instrumentation and automation, should be created for use as
part of the BOP system. The operational status of the system, includ-
ing battery charge and pressures, should be continuously monitored
from the surface.
Recommendation 3.7: A BOP system with a critical component that is
not operating properly, or one that loses redundancy in a critical
component, should cause drilling operations to cease. Drilling should
not resume until the BOP’s emergency operation capability is fully
cured.
Recommendation 3.8: A reliable and effective EDS is needed to com-
plete the three-part objective of cutting, sealing, and separating as a
true “dead man” operation when communication with the rig is lost.
The operation should not depend on manual intervention from the
rig, as was the case with the Deepwater Horizon. The components used
to implement this recommendation should be monitored or tested as
necessary to ensure their operation when needed.
If the consequence of losing communication and status monitoring of
the BOP system is an automatic severing of the drill pipe and discon-
nection from the well, the quality and reliability of this communica-
tion link will improve dramatically.
Recommendation 3.9: BOP systems should be designed to be testable
without concern for compromising the integrity of the system for fu-
ture use.
13
This recommendation is also presented in Chapter 4 as Recommendation 4.1.
