3

Blowout Preventer System

If hydrocarbons unexpectedly flow into the well during drilling or other operations despite the use of primary barriers in the well, the blowout preventer (BOP) system serves as a secondary means of well control (i.e., preventing undesired hydrocarbon flow from the well). During offshore drilling, the system is deployed and attached to the wellhead to seal an open wellbore, close the annular portion of the well around the drill pipe or casing, or cut through the drill pipe with steel shearing blades and then seal the well. A typical BOP system also has more routine functions such as enabling certain well pressure tests and injecting and removing fluid from the well through its “choke” and “kill” lines. This chapter discusses the basic well control function of the BOP system that was part of the Deepwater Horizon mobile offshore drilling unit (MODU),1 general studies of BOP system reliability, the role of the BOP failure in the incident, and the results of forensic analyses of the recovered BOP system. The committee found several past studies and incident reports that documented the limitations of BOP effectiveness and reliability concerns, and they are discussed below. Unfortunately, it appears that neither industry nor the Minerals Management Service (MMS) responded to these past accidents in an appropriate manner. The chapter provides the committee’s findings and observations, as well as its recommendations for improving BOP system reliability.

BOP SYSTEM FOR DEEPWATER HORIZON

The BOP system for Deepwater Horizon was a massive, 57-foot-tall, approximately 400-ton well control system located at the wellhead (DNV 2011a, I, 15). A riser pipe attached to the top of the BOP system extended to the drilling platform on the Deepwater Horizon to permit drilling fluids to circulate between the borehole and the rig, passing through the BOP system. The bottom of the BOP rests on top of a remotely detachable connection to the wellhead, which allows the BOP to be released after well completion.

____________________

1The term “rig” is intended to be synonymous with mobile offshore drilling unit.



The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 45
3 Blowout Preventer System If hydrocarbons unexpectedly flow into the well during drilling or other operations despite the use of primary barriers in the well, the blowout preventer (BOP) system serves as a secondary means of well control (i.e., preventing un- desired hydrocarbon flow from the well). During offshore drilling, the system is deployed and attached to the wellhead to seal an open wellbore, close the annu- lar portion of the well around the drill pipe or casing, or cut through the drill pipe with steel shearing blades and then seal the well. A typical BOP system also has more routine functions such as enabling certain well pressure tests and injecting and removing fluid from the well through its “choke” and “kill” lines. This chapter discusses the basic well control function of the BOP system that was part of the Deepwater Horizon mobile offshore drilling unit (MODU),1 gen- eral studies of BOP system reliability, the role of the BOP failure in the incident, and the results of forensic analyses of the recovered BOP system. The commit- tee found several past studies and incident reports that documented the limita- tions of BOP effectiveness and reliability concerns, and they are discussed be- low. Unfortunately, it appears that neither industry nor the Minerals Manage- ment Service (MMS) responded to these past accidents in an appropriate man- ner. The chapter provides the committee’s findings and observations, as well as its recommendations for improving BOP system reliability. BOP SYSTEM FOR DEEPWATER HORIZON The BOP system for Deepwater Horizon was a massive, 57-foot-tall, ap- proximately 400-ton well control system located at the wellhead (DNV 2011a, I, 15). A riser pipe attached to the top of the BOP system extended to the drilling platform on the Deepwater Horizon to permit drilling fluids to circulate between the borehole and the rig, passing through the BOP system. The bottom of the BOP rests on top of a remotely detachable connection to the wellhead, which allows the BOP to be released after well completion. 1 The term “rig” is intended to be synonymous with mobile offshore drilling unit. 45

OCR for page 45
46 Macondo Well Deepwater Horizon Blowout The BOP system was formed from two basic structural assemblies. The lower assembly, referred to as the BOP stack, rests on the wellhead connector. The upper assembly, referred to as the lower marine riser package (LMRP), was placed through a remotely detachable connection on top of the BOP stack and had roughly the same gross dimensions as the BOP stack. These assemblies, and basic functional components discussed below, are shown schematically in Fig- ure 3-1. The LMRP had two annular preventers, and the BOP stack had four principal sealing elements: one blind shear ram (BSR) and three variable bore rams (VBRs). It also had a casing shear ram (CSR) that could shear drill pipe and casing but was not designed to seal the well. In addition, various control systems were located on the BOP system. In the event of an emergency discon- nect, the LMRP was supposed to separate from the BOP stack, and the rig, riser, and LMRP were to move away from the well, which was to have been sealed by that point by the BSR in the BOP stack. Annular Preventers The LMRP contained two well-sealing components: the upper annular preventer and the lower annular preventer. The preventers were, as the name implies, annular in shape, and they were essentially flexible, elastomeric “doughnut” seals backed by steel elements that could accommodate a range of diameters of pipe and seal the annular space between the drill pipe and the LMRP. The annular seals were used so that the well could be tested, for exam- ple, for the so-called “negative test” discussed in Chapter 2, or potentially to stop any unwanted flow up or down the annulus. In a blowout-prevention situation, the annular seals (if intact) could be ac- tivated and seal off the annular space between the pipe and the LMRP, although a blowout could still occur as a result of flow through the drill pipe itself if the drill pipe was not sealed. A limiting factor was the maximum allowable differential pressure across the annular preventers. Reportedly, the upper annular preventer was designed for up to 10,000-psi differential pressure for sealing against a drill pipe or 5,000 psi when sealing the entire hole. The lower annular preventer was apparently de- signed for a 5,000-psi differential pressure for sealing around a drill pipe (BP 2010; Transocean 2011a). Blind Shear Ram The BSR was the uppermost of the five rams of the BOP stack and is shown for nominal operation in Figure 3-2. A BSR is like a massive metal scis- sors with two opposing blades that are designed to slice through the drill pipe as the blades pass by each other, as shown in Figure 3-3, and seal the well. The design intent was that, when the two blades of the “scissors” passed by each other and fully penetrated into the “side packers” on the other side, the seal

OCR for page 45
47 Blowout Preventer System across the BOP bore was to be effected and thus seal off the entire throat of the BOP. The BSR was, by design, a device of last resort in a hierarchy of well con- trol strategies: when all else failed, the BSR was to slice the drill pipe and seal the well. Even if no drill pipe was present in the BOP system, the BSR was de- signed to seal the well when the “scissor blades” passed by each other and into the side packers. FIGURE 3-1 Deepwater Horizon BOP port side. Source: DNV 2011a, I, p. 14. Reprinted with permission; copyright 2011, DNV.

OCR for page 45
48 Macondo Well Deepwater Horizon Blowout FIGURE 3-2 Sketch of intended nominal operation of BSR in the Macondo well. Source: DNV 2011a, I, p. 155. Reprinted with permission; copyright 2011, DNV. FIGURE 3-3 Upper and lower shear blades crushing the drill pipe and beginning the shearing (or breaking) operation. Source: West Engineering Services, Inc. 2004, p. 2-2. Reprinted with permission; copyright 2004, West Engineering Services, Inc.

OCR for page 45
49 Blowout Preventer System The BSR was designed to be capable of activation in several ways (DNV 20011a, I, 2):  By personnel on the Deepwater Horizon directly via either one of two control panels;  Through the activation of the emergency disconnect system (EDS, with options EDS 1 and EDS 2) (BOEMRE 2011, 133), which was to function via either of the two control panels on the rig (the EDS was meant to be trig- gered when the drilling rig was to come off the well in an emergency for what- ever reason);  By the circuits located on either of two pods on the BOP system if the automatic mode function (AMF) was activated by loss of communications and hydraulic connection with the rig;  By the autoshear function located on the BOP stack if the connection to the LMRP was physically broken; and  By a subsea remotely operated vehicle (ROV). The BSR is the only ram on the BOP that has automatic modes of opera- tion: the AMF mode, which depends on the blue and the yellow pods, and autoshear mode, which does not depend on the control pods. All the other rams on the BOP are manually activated through the control pods. Casing Shear Ram The CSR was located below the BSR. It consisted of two pieces of metal with opposed V-shaped cutting tools above and below the plane of the slice. The CSR was designed to cut larger, thicker pipe than the BSR was designed to cut, such as casing rather than drill pipe. But the CSR, unlike the BSR, was not de- signed to seal off the BOP; it was designed only to cut pipe or casing. Variable Bore Rams Three VBRs were located near the base of the BOP stack, below the BSR and CSR. These rams had metal-reinforced elastomeric annular elements that, similar in function to the annular preventers in the LMRP, were designed to seal off the annular space between the drill pipe and the BOP system. The VBRs were more structurally robust than the annular preventers but were to close on only a narrow range of pipe diameters. The bottom VBR had been reversed to create a “test ram” that would seal against pressure in the riser instead of pres- sure in the well. Control System A number of components of the BOP control system were located on the BOP system itself, and the remainder were on the Deepwater Horizon. Two

OCR for page 45
50 Macondo Well Deepwater Horizon Blowout electrohydraulic systems, termed blue and yellow “control pods,” which were housed on the LMRP, were key system control components on the BOP. The control pods each contained electronic control units, which were con- nected to the drill rig with multiplexer (MUX) communication cables. A hydrau- lic line from the drill rig to the LMRP enabled the pressurization of the cylinder bank on the BOP system that held pressurized hydraulic fluid. The electronic control system opened and closed valves that allowed the pressurized hydraulic fluid to flow and to activate all rams and the seals in the upper and lower annular preventers. The annular preventers and shear rams were driven by high-pressure hy- draulic fluid that could have come from the rig, or—if connection with the rig was lost—from eight pressurized 80-gallon hydraulic accumulators on the BOP system. The accumulators contained high-pressure gas that was intended to push on the elastomeric bladders storing the hydraulic fluid. The high-pressure fluid initially pumped into the accumulators “charged” these accumulators. Electronic devices, when commanded, opened solenoid-driven valves that enabled the high-pressure hydraulic fluid to exit (driven by the gas in the accumulators). The high-pressure hydraulic pressure drove the rams (pistons) that displaced the pre- venters and rams. The electronic systems were complex and permitted control from the drilling rig, or—if communications were lost—were designed to self- initiate automated actions such as operation of the BSR. Comments on Emergency Operations The BSR is designed to be the true emergency sealing ram—it is the only one of the various rams on the BOP system that is designed to cut the pipe and seal the BOP system and hence the well. Sealing off the BOP system after slic- ing the drill pipe is a technical challenge but is well within the capabilities of current technology. The differential pressure above and below the BSR, if it works and seals, can be immense—thousands of pounds per square inch— creating enormous force and the need for high structural integrity, carefully en- gineered seals, and adequate testing under extreme conditions. After the metal pipe is sliced, fugitive metal from the sliced drill string cannot be permitted to become wedged between the slicing elements, which would prevent the slicing devices from fully closing and effecting a seal. Further complicating the ram design envelope is the fact that the drill pipe joints (“tool joints”) are necessarily thicker than the drill pipe itself to accom- modate geometrically the threaded portions of connecting drill pipe and to transmit the drilling torque between them. Transocean’s 2008 document Well Control Complications/Emergency provides background on the intended func- tion of the BSRs. The Transocean document notes that “most BSRs are designed to shear effectively only on the body of the drill pipe. Procedures for use of BSRs must therefore ensure that there is no tool joint opposite the ram prior to drilling” (Transocean 2008, 2). Time and care are needed to ensure that no tool

OCR for page 45
51 Blowout Preventer System joint is located in the plane of the BSR. Furthermore, the BOP system did not contain monitoring devices that would directly indicate the location of tool joints within the BOP system to the crew on the rig. Thus, to ensure that a tool joint is not present in the plane of the BSR, the drilling crew would have to posi- tion a tool joint at a known location, either by measurement and calculation of the tool joint positions or by “hanging” a tool joint on an underlying VBR. The 2008 Transocean document does not address determination of tool joint location during time-critical situations. The documents states that “opti- mum shearing characteristics are obtained when the pipe is stationary and under tension” (Transocean 2008, 2). By analogy, cutting a string or cord with scissors is always easier if the string or cord is taut. But unlike regular string, drill pipe can transmit high compressive loads, particularly when it can use the side walls of the BOP for lateral stability. In the case of the Deepwater Horizon on April 20, 2010, the drill string above the BOP had a “dry weight”2 of more than 150,000 pounds.3 If an attempt is made to shear a drill string in compression, additional friction can be substantial. When a BSR is slicing the pipe, the slice is much easier to facilitate when the pipe is in tension (being pulled) rather than under compression. Under tension, the two pieces being cut are being pulled apart, away from the cut. If, instead, the drill pipe is in significant compression, the two pieces being cut are pressed against one another and pressing on the shearing blades, making the required shearing force much higher. Furthermore, under tension, the cut pipe would be pulled away from the rams, clearing the way for the rams to seal. Under compression, the pipe would tend to be jammed into the rams and therefore block full sealing. To keep the long slender drill pipe string in tension, it is hung off a “hook” that is attached to a “traveling block” whose vertical location can be moved up and down by a huge cable hoist in the drilling derrick. At the time of the explosion on the Deepwater Horizon, the dry weight of the entire drill string was 217,000 pounds, entirely borne by the hook and traveling block, and the total hook load hovered around 360,000 pounds (BP 2010, 105). Witness statements indicate in the case of the Deepwater Horizon that the rig’s traveling block, which carries the hook load (weight of the drill pipe string and upper works), fell at 22:20 (Transocean 2011a, I, 31), although the hook load itself could have been lost earlier as a result of damage from the explosions. The design of the BOP system for the Deepwater Horizon focused on the use of the BSR under controlled conditions when tension in the drill pipe can be assured, and this appears to be the only way that BOP shear rams are tested. Tension would be lost, for example, if the drill pipe and the drill rig became disconnected because of an accident or explosion and the drill pipe moved downward into the well. Tension might be assured under carefully controlled 2 The actual compressive load of this string at the BOP is slightly less due to the “buoyancy” of the steel relative to the weight of the fluids in the string, but not greatly. 3 Transocean (2011a, I, 89), assuming 4,103 feet of 6 5 8 -inch string at 32.67 pounds per foot and 900 feet of 5½-inch string at 21.9 pounds per foot.

OCR for page 45
52 Macondo Well Deepwater Horizon Blowout conditions, but not in an emergency (such as that encountered on the Deepwater Horizon) or in a number of other possible situations. Furthermore, since BOP ram testing is invariably done on the surface, the effects of a huge compressive pressure differential across the ram blocks are not revealed by the tests. Some BOP systems have two BSRs as a remedy for the problem of a tool joint being in the wrong place, which can occur with a single BSR during an emergency. “All subsea BOP stacks used for deepwater drilling should be equipped with two blind-shear rams” was the conclusion of SINTEF (Stiftelsen for Industriell og Teknisk Forskning) in a study for MMS in 2001 (Holand and Skalle 2001, 96). The practice of using a single BSR that is incapable of cutting a tool joint raises serious questions about the overall reliability of the system in an emergency. The goal of future BOP designs should be high reliability under emergency conditions. How this requirement is met need not be prescriptively specified in regulation and may or may not require multiple BSRs. Regulation should require that emergency BOP reliability be empirically demonstrated by impartial testing under the most demanding conditions that would be encoun- tered in an emergency. AREAS OF INVESTIGATION The committee investigated the role that the BOP system failure played in the Macondo well–Deepwater Horizon disaster and identified what might be done in terms of BOP system design, operation, and maintenance to prevent such an occurrence in the future. Prior Warnings That Existing BOP System Designs Were Inadequate Before the Macondo well blowout, there were numerous warnings to both industry and regulators about potential failures of existing BOP systems. While the inadequacies were identified and documented in various reports commis- sioned over the years by industry operators and regulatory organizations alike, it appears that there was a misplaced trust by responsible government authorities and many industry leaders in the ability of the BOP to act as a fail-safe mecha- nism. West Engineering Studies West Engineering Services, Inc., conducted two studies (West Engineer- ing Services 2002, 2004) on BOPs at the behest of MMS, now known as the Bureau of Ocean Energy Management, Regulation, and Enforcement (BOEMRE). The first, Mini Shear Study, apparently a preliminary study, was submitted in December 2002. The study was a review of shear ram test proce- dures from American Petroleum Institute (API) Specification 16A and results of

OCR for page 45
53 Blowout Preventer System shear tests performed by rig operators on seven BOP systems. Fourteen cases were examined, but only seven included testing of BOP shearing capabilities. The study made several important points:  “This study was designed to answer the question ‘Can a given rig’s BOP shear the pipe to be used in a given drilling program at the most demand- ing condition to be expected?’ This can only be demonstrated conclusively by testing.”  “Of the seven [BOPs] tested, five successfully sheared and sealed based on shop testing only. If operational considerations [increased hydrostatic pressure] of the initial drilling program were accounted for, shearing success dropped to three of six (50%).”  “This limited data set from the latest generation of drilling rigs paints a grim picture of the probability of success when utilizing this final tool in se- curing a well after a well control event.”  “WEST is unaware of any regulatory requirements that state the ob- vious: that the BOP must be capable of shearing pipe planned for use in the cur- rent drilling program.” The West Engineering study addressed the challenge of increased hydro- static head to the BSR but did not address the even greater challenge of a large pressure differential across the rams as they attempt to seal. The West study addressed only the likelihood of the BSR shearing the pipe, not sealing it. The West report indicates that drill pipe of a particular weight and grade may be the only pipe that a particular BOP shear ram is capable of cutting. In addition, the shear ram is unlikely to be able to sever drill pipe tool joints or heavy wall pipe such as drill collars. This means that careful housekeeping must be maintained to ensure that the correct type of pipe is in the correct position inside the BOP stack, particularly if only one shear ram exists on the BOP stack. Also, there is no automated means of ensuring that there is no tool joint in the BSR. This has to be done by (accurate) measurement and calculation. The second study conducted by West Engineering Services, Inc., Shear Ram Capabilities Study, was submitted in September 2004. It expanded on the first study with theoretical and statistical studies of shear ram data from manu- facturers, a review of BOP stack configurations, and a review of known BOP failures to shear and seal. The second report amplified the conclusions and ob- servations of the first and made several additional points:  Section 3.2 of the report states the following: “Improved strength in drill pipe, combined with larger and heavier sizes resulting from deeper drilling, adversely affects the ability of a given ram BOP to successfully shear and seal the pipe in use. WEST is currently aware of several failures to shear when con- ducting shear tests using the drill pipe that was to be used in the well. Only half of the operators accepting a new-build rig chose to require a shear ram test dur-

OCR for page 45
54 Macondo Well Deepwater Horizon Blowout ing commissioning or acceptance. This grim snapshot illustrates the lack of pre- paredness in the industry to shear and seal a well with the last line of defense against a blowout.”  The report reviewed one notable BOP “failure to shear and seal a well,” the Pemex blowout in the Bay of Campeche in 1979, which released 3.3 million barrels of oil before the well was killed. The report states the following: “Reportedly they were pulling the drill string too quickly without proper fluid placement and the well started coming in. They had no choice but to close the shear rams; unfortunately, drill collars were in the stack and shearing failed” (West Engineering Services 2004, 3-4). (Note: Drill collars are thick pieces of pipe used to provide weight and stiffness at the bottom of the drill string. The tool joint for the 6 5 8 -inch drill pipe had an outer diameter of 8.25 inches and an inner diameter of 4.625 inches at the upset for a wall thickness of 1.8125 inches. The drill collar would normally be thicker than this. For example, an 8¾-inch outer diameter drill collar could have an inner diameter around 3.25 inches for a wall thickness of 2.75 inches.)  The method used by several BOP manufacturers for predicting whether the shear rams will successfully shear pipe and seal the well should be more accurate. Currently only tests can demonstrate the reliability of a shear ram with the particular pipe being used. The September 2004 study called on indus- try to develop better predictive methods and to establish a database that can be shared by all.  In the cutting process, the shear rams collapse or mash the pipe, and as the pipe is crushed, the blade angle pulls the metal into tension and breaks it in a tensile mode of failure (Figure 3-3). Depending on the ram blade design, the blade can flatten the pipe to a great extent, which in turn can prevent the ram from closing completely and sealing even if the pipe is centered.  CSRs were introduced to shear large-diameter, thick-walled pipe such as casing. These rams do not have a sealing mechanism so that the blade can be made strong enough to shear the thicker wall pipe. CSRs are installed in the BOP stack below the BSR so that the casing rams can be used to sever thicker pipe, and then the drill string above the casing rams can be raised out of the way so that the BSR can be closed and the well sealed. Some BOP stacks use a second BSR below the CSR to create a second opportunity to shear and seal the well, which basically ensures that at least one BSR will not have a drill pipe tool joint in front of it. However, in this situation, if the severed pipe cannot be removed from the BSR area it will likely not close sufficiently to seal.  The various control systems on the rig are not integrated. Information from the BOP system is shown as indicator lights on the control panel on the rig, but no communication is made to the pipe-handling system to ensure that the pipe is in the correct position within the BOP system for well control operations.  The second study also illustrated the challenge of keeping long-lived BSR designs from becoming obsolete. West stated: “There are two basic types of sealing shear ram designs: single [the type in the BSR of the Deepwater Hori-

OCR for page 45
55 Blowout Preventer System zon] and double ‘V’ blades—rams with double ‘V’ blades appear to have 15% to 20% lower shear forces than single blade designs. The data received primarily included shear rams having both blades ‘V’ shaped.4 The two data points from shear rams that did not have both blades ‘V’ shaped [as was the case on the Deepwater Horizon] were excluded from statistical consideration” (West Engi- neering Services 2004, 4-2). When a signal is sent from the drilling rig to the BOP (on the seafloor) to execute a command, the BOP sends a message back that the signal has been received. However, there are no devices to send a signal that any command has been executed, such as pressure or displacement sensors confirming that hydrau- lics were actuated or that rams have moved or that pipe has been cut, nor are there any flow sensors measuring whether the well has been sealed. Additional conclusions can be drawn from the two West Engineering stud- ies. Clearly, the operating success of the BSR was recognized to be much less than 100 percent years before the Macondo well blowout. It appears to be no better than 50 percent, on the basis of the results of the Mini Shear Study de- scribed above. This success ratio is inconsistent with the expectations placed on the BOP system as a fail-safe mechanism to close an out-of-control well. If well pressure is assumed to be contained by the annular preventer (assume the maxi- mum rating of the annular preventer to represent this pressure) and if the well pressure differential across the BOP is assumed to be much larger than the hy- drostatic pressure exerted by the drilling mud (as was the case in the Macondo well by at least two times), the shear success percentage demonstrated by the first study would decrease even further. At no time is the drill pipe placed in compression during the tests dis- cussed in the first West Engineering study. In fact, care is taken “to prevent ex- cessive bending of the pipe” (API Specification 16A, Part B4.3.d [1997] (as cited in West Engineering Services 2004, 9-1)). The pipe section below the shear ram is not confined and is free to fall out of the shearing ram during opera- tion. In contrast to this ideal test situation, if the pipe is in compression it may buckle as soon as the ram begins to shear it. The shear ram may not be able to cut the pipe in this condition. If the pipe is cut but cannot move out of the area of the closing rams, the rams may not seal. Sealing was not even considered in the study. The careful housekeeping necessary to ensure that the correct type of pipe is in the correct position in the BOP stack may be difficult to accomplish in a well control emergency, further decreasing the chance that the shear rams will function correctly. Even with the addition of a CSR, the ability to seal the well is questionable if the pipe either above or below the CSR must be moved out of the way after the CSR cuts the pipe to allow one or more BSRs to seal the well. In a well control emergency there is no assurance, or even a likelihood, that the pipe can be moved at the appropriate moment to allow the BSR to seal. And obvi- 4 See Figure 4.1 of West Engineering Services (2004).

OCR for page 45
64 Macondo Well Deepwater Horizon Blowout But BP (2010, 156) has observed, not wholly inconsistently with Transocean’s claim: In an effort to actuate and open the autoshear valve, the autoshear rod was cut at approximately 07:40 hours on April 21, 2010. Incident management team (IMT) responders, who were monitoring ROV operations when the autoshear was activated, reported that movement was observed on the BOP stack. This movement was consistent with stack accumulators dis- charging. A short time later, a leak on the ST lock hydraulic circuit, which was downstream of one of the BSR bonnet sequence valves, was ob- served, indicating that the lock circuit and the BSR were closed. DNV (2011a, I, 169) independently observed: While the conditions necessary for AMF/Deadman existed immediately following the first explosion/loss of rig power, because of the inconsistent behavior of original Solenoid 103Y and the state of the 27V battery bank on the Blue Control Pod, it is at best questionable whether the sequence was completed. The weight of the evidence appears to support the conclusion of BP and DNV that the BSR was activated by the autoshear, but for additional reasons not addressed in their reports. All parties appear to agree that the upper and middle VBRs successfully sealed the well a minute or two before the explosions, ac- counting for the large pressure spike in the drill string starting at 21:47 (BP 2010, 105). Both these VBRs were found with their ST locks set (DNV 2011a, I, 31), meaning that they stayed applied, irrespective of flow or pressure, until the BOP was retrieved. Thus, until they were eventually eroded, the annulus of the BOP remained sealed by these VBRs. During this period the only flow path for hydrocarbons from the formation to the rig was the drill string. If Transocean was correct, this flow path was interrupted “within minutes” by the AMF acti- vating the BSR. It appears undisputed that the BSR sheared the drill string off center in the manner illustrated by Figure 3-6, which is from the DNV report addendum (DNV 2011b, 17). If Transocean is correct and the AMF functioned “within minutes” of 21:50, then the entire hydrocarbon communication with the Macondo well must have been through the small flow area that would exist at that time from the sheared end of Pipe Segment 94 (End 94B) (DNV 2011a, I, 95). Note on Figure 3-6 in Frame 23 that the sheared pipe end is shown with only 277,000 pounds of ram load applied where the BSR will ultimately apply approximately 900,000 pounds of ram force at the regulated pressure of 4,000 psi (DNV 2011a, 14). Thus, substantially less cross-sectional flow area will be available to well hydrocarbons than is shown in Frame 23. If the AMF functioned for at least some time, there should have been a significant reduction in hydrocarbon flow from the well that would have become

OCR for page 45
65 Blowout Preventer System FIGURE 3-6 Progression of off-center BSR shear model, isometric view (top) and top view showing deformation of drill pipe outside of shearing blade surfaces (bottom). Source: DNV 2011b, p. 17. Reprinted with permission; copyright 2011, DNV. apparent after the initial hydrocarbons that had leaked into the riser before the rams were activated blew out on the surface. This statement is true even if the explosions completely severed the drill string at the surface. After the drill string contents blew out, it would no longer have significant communication with the well for a period of time in the face of 900,000 pounds of clamping pressure on the output end of the severed drill string. However, this scenario does not appear to be borne out by witness descrip- tions of the fire. “It was quickly apparent to the bridge team that it was impossi- ble to regain control of the well or to fight the fires” (Transocean 2011a, I, 32). Several crew members jumped into the sea as the fire continued to grow in in- tensity (Transocean 2011a, I, 32). Thus, there appears to have been no interrup- tion in flow from the well during the crucial minutes after the initial explosions, and the BSR rams appear not to have closed until the autoshear was activated. Given the timing of the BSR activation, attention can now turn to the po- tential sources of the compression in the drill string that produced an off-center position in the BSR. Transocean produced several calculations consistent with the DNV hypothesis purporting to show that the pressure in the formation was sufficient to lift the drill string and create the necessary compression. The first is

OCR for page 45
66 Macondo Well Deepwater Horizon Blowout 2 set forth as: “5.5-in. drill pipe = 23.75 in.  7,000 psi = 166,250 lb. lift” (Trans- ocean 2011a, I, 157, Footnote E). This is Transocean’s assumed loading on the drill string after the VBR’s activation and presumably at the time of the postu- lated AMF activation, “within minutes” of the explosions. While the formula is mathematically correct, its application to the Macondo well drill string is diffi- cult to see. To start with, 1 minute before the explosions, after the VBR activa- tion, the internal drill string pressure on the rig shot up to more than 5,600 psi (BP 2010, 105). The bottom of the 5½-inch section of the drill string reached a depth of 7,546 feet below the drill rig floor (Transocean 2011a, I, 89). On the basis of the assumption that the entire length of drill string was filled with sea- water being used to displace the drilling mud, at 0.445 psi per foot the seawater added another 7,546  0.445 = 3,358 psi of hydrostatic head to the internal drill pipe pressure measured on the rig, for a total pressure inside the end of the 5½- inch section of drill string of approximately 5,600 psi + 3,358 psi = 8,958 psi. The pressure measured on the rig in the drill string could only increase from about 1,200 psi to about 5,600 psi in 2 minutes if the formation pressure being exerted at the tip of the drill string was greater than the drill string pressure plus the hydraulic head of the total drill string (about 5,600 psi + 3,70712 psi), or about 9,307 psi, and flow was going into the drill string. A different calculation of the same loading is set forth in Appendix M of Transocean (2011a): “In the shut in condition, the pressure below the VBR is 8,000 – 8,500 psi. With an assumed hydrocarbon density of 2 ppg above the VBR, the pressure above the VBR is 500 psi. Thus, the pressure drop across the VBR is about 8,000 psi, which corresponds to a net compression of about 120 kips” (Transocean 2011, Appendix M, 29). Needless to say, the two calculations do not agree. Matters are different if it is postulated that the explosions on the rig rup- tured the drill string and allowed the high drill string internal pressure to bleed down to atmospheric pressure at the rig. Such an event would leave only the 3,358 psi of hydrostatic internal pressure in the drill string, acting on the 4.8- inch internal diameter at the end of the 5½-inch section, for a total hydrostatic load of 60,765 pounds. This would be sufficient to reduce Transocean’s postu- lated lift by almost half and Transocean’s total calculated lift well below the compressive force level necessary at the BOP calculated by DNV. However, Transocean’s first lift calculation also ignored the weight of the drill string be- low the BOP. On the basis of the data for drill string dimensions and weights (Transocean 2011a, I, 89), this is calculated as 62,232 pounds dry weight, which corrects to 53,301 pounds buoyed by seawater. Transocean’s calculation in Ap- pendix M would appear to take cognizance of the drill string weight, but neither appears to consider the pressure internal to the drill string. In both calculations Transocean treats the drill string as a piston, when in reality it is more like a straw, open at the bottom and the top after the explosions. The hydrostatic pres- 12 8,367 total feet of drill string  0.445 psi/ft.

OCR for page 45
67 Blowout Preventer System sure internal to the end of the 5½-inch drill string section and the buoyed weight of drill string below the BOP together produce 114,065 pounds of load. This must be overcome before the first pound of compression will be felt by the drill string in the BOP under any postulated failure scenario consistent with DNV’s hypothesis. An additional 821 feet of 3½-inch tubing is attached to the end of and hanging below the 5½-inch drill string, which is included in the calculations of buoyed weight but whose hydrostatically induced internal pressure would be even greater due to an additional 821 feet of head. Since the end of the 3½-inch tubing is opened to the flow from the formation and the top of the drill string has clearly been ruptured by the explosions, the area of the 3½-inch drill string is a “straw” that cannot be used in a calculation of compression load from pressure, so it is difficult to postulate a situation, short of some incredibly high flow rates, under which a significant pressure differential could be established between the inside and the outside of the drill string. Production of 115,000 pounds of drill string compression in the BOP as postulated by DNV requires that flow friction and pressure below the BOP generate a total of almost 230,000 pounds of verti- cal lift. There is a total of about 3,337 feet of drill string below the BOP. For fluid drag to produce the required vertical lift would require an average of 69 pounds of vertical fluid drag per linear foot of drill string. However, it is unlikely that the drag between the 3½-inch tubing and the 5½-inch drill string would be uniform, given that the flow is predominantly up the drill string, as evidenced by the erosion wear at the VBRs, which remain applied until the BOP is recovered. While the fluid drag is likely to be significantly greater in the 3½- inch tubing than in the 5½-inch drill string, use of even the 69-pound average means that the top of the 3½-inch tubing would experience a compressive load of 56,650 pounds. Whether the walls of this 9.3-pound-per-foot tubing can transmit a compressive load of 28 tons without local wall buckling is unknown. Given the technical challenge of developing the 115,000 pounds of verti- cal compressive load on the drill string postulated by DNV through flow fric- tion, gravity is a simple and attractive alternative. Above the BOP sit approxi- mately 134,045 pounds of 6 7 8 -inch drill string and 19,710 pounds of 5½-inch drill string, for a total dry weight of 153,755 pounds of drill string. Corrected for buoyancy, this results in a net drill string weight at the BOP of 135,904 pounds. This is slightly more than the 115,000 pounds postulated by DNV as necessary to produce the observed elastic buckling in the drill string. While the rig’s trav- eling block was observed to fall about 30 minutes after the explosion, when ver- tical support of the drill string was lost is unknown. For the vertical mass of the drill string above the BOP to be the source of the compressive load in the BOP at the time of the application of the autoshear, the drill string must remain intact above the BOP. Transocean calculates that the drill string parted above the up- per annular preventer through excessive tensile load at 21:56, approximately 6 minutes (Transocean 2011a, I, 157) after the explosions, as the powerless Deep- water Horizon drifted off station. Transocean’s assumptions about the integrity

OCR for page 45
68 Macondo Well Deepwater Horizon Blowout of the derrick after the explosions and its support of the weight of the drill string are not set out. DNV (2011a) hypothesized that the drill string “would have been set in slips to remove the suspended load from the derrick or travelling block.” How- ever, there is no available evidence of this or of how the slips would have fared in the two explosions even if they had been used. As illustrated by BP (2010, 105, Figure 17), the hook load measured the weight of the drill pipe, top drive, blocks, and so forth right up to the moment of explosion. The slips were not set. While DNV (2011a) did not consider it likely that the two VBRs applied simul- taneously with full rig hydraulics still connected could have generated the grip- ping force necessary to support the compression, no data or tests were presented in support of this hypothesis. FINDINGS Summary Finding 3.1: The loss of well control was not noted until more than 50 minutes after hydrocarbon flow from the formation started (see timeline in Figure 3-4), and attempts to regain control by using the BOP were unsuccessful. The BSR failed to sever the drill pipe and seal the well properly, and the EDS failed to separate the lower marine riser and the Deepwater Horizon from the well. The EDS failed to operate because of the loss of MUX communica- tion in the explosion or the subsequent fire which burned for 7 minutes on the rig floor before EDS activation was attempted. Finding 3.2: The crew did not realize that the well was flowing until mud actually exited and was expelled out of the riser by the flow at 21:40. Early detection and control of flow from a reservoir are critical if an impending blowout is to be prevented by a BOP whose use against a full-flowing well is untested. Finding 3.3: Once mud began to flow above the rig floor, the crew at- tempted to close the upper annular preventer of the BOP system, but it did not seal properly. The BOP system had been used in the month previously to strip 48 tool joints, and apparently it was untested for integrity afterwards. Annulars are often unable to seal properly after stripping. In addition, the flowing pressure inside the well may have been larger than the preset annular closing pressure could overcome. What tests of sealing against flow have been done on this design of annular are unknown. Finding 3.4: The crew also closed the VBRs. The damaged pipe under the upper annular demonstrated its failure to seal, and the well was

OCR for page 45
69 Blowout Preventer System only sealed, resulting in the final pressure spike, when these VBRs were closed. The DNV investigation also found that these rams closed, and they could only be closed by command from the rig control panels and not by an ROV. At this point the flow from below the VBRs would have been closed off, but gas and oil had already flowed into the marine riser above the BOP system and continued to rise to the surface, where the gas exploded. Finding 3.5: The internal BOP, which functions as a safety valve on the top of the drill pipe, was not closed (BP 2010, 25). Also, approxi- mately 30 minutes after the explosion the traveling block was ob- served to fall and the rotary hose (used to conduct drilling fluid) could have been destroyed. The growing fire indicates that the drill pipe was broken in the initial explosion and the fall of the traveling block could have allowed even more flow to escape up the drill string. This was the likely path of hydrocarbon flow before the closure of the BSR (see Chapter 2). Finding 3.6: Once the fire started on the rig, an attempt was made (af- ter 7 minutes) to activate the EDS, which should have closed the BSR and disconnected the LMRP. This appears to have failed because the MUX communication cables were destroyed by the explosion or fire. Finding 3.7: Once hydraulic and electrical connection with the rig was lost at the BOP, the AMF should have activated the BSR. It might have failed at this time because of a low battery charge in one control pod and a miswired solenoid valve in the other, but both these points are in dispute. However, no short-term reduction in hydrocarbon flow from the well was observed after the initial fire and explosion (see Figure 3-4). Such a reduction would necessarily have resulted from the VBRs sealing the annulus in the BOP and the failed BSR shearing action effectively choking, at least for a brief period of time, virtually the entire cross section of the 5½-inch drill string. Viewed in total, the evidence appears more supportive of the autoshear activation of the BSR. Finding 3.8: The BSR appears to have been activated after 07:40 on April 22, 2010, if not earlier, when the hydraulic plunger to the autoshear valve was cut by an ROV. However, regardless of when the BSR was activated, the well continued to flow out of control. Finding 3.9: DNV hypothesized that the drill pipe below the annular preventer was being forced upward by the pressure of the flowing well, resulting in a 115,000-pound net compressive force on the drill pipe in the BOP sufficient to buckle the drill pipe until it came in con-

OCR for page 45
70 Macondo Well Deepwater Horizon Blowout tact with the inside of the BOP system (DNV 2011a, I, 174). However, the fluid mechanics inherent in this assumption are dubious. The 135,000 pounds of buoyed drill string weight above the BOP appears to be a more plausible source of the compression. Finding 3.10: When it was activated, the BSR was unable to center the drill pipe in its blades and failed to cut the pipe completely. The blades of the ram were of the old straight and V combination, which has been shown to be inferior in its shearing performance to the dou- ble-V blade geometry (West Engineering Services 2004). Because the BSR blades did not fully span the BOP annular, a mashed segment of pipe was caught between the rams and prevented them from closing to the point where they could seal (DNV 2011b, 17) (see Figure 3-6). An alternative hypothesis for compressive loading on the drill pipe is that the loading could have occurred if the drill string were dropped from the top drive in the derrick. This equipment likely had been damaged or destroyed by an explosion and fire. A closed VBR would act to restrict the motion of the drill pipe. The drill pipe above the BOP would go into a long helical buckle above the ram and in the marine riser, placing a considerable compressive load on the drill pipe in the BOP system. On the basis of solid mechanics, a pressurized tube reacts as if it is under compressive load. Under either of the scenarios mentioned above, the buckling force would have occurred as soon as the elements of the BOP system prevented the upward or downward motion of the drill string, and clearly there are several plausible reasons why the drill string would have been in compression. Finding 3.11: After the rig lost power and drifted off station, the ma- rine riser kept the vessel tethered to the BOP system. Finding 3.12: Flow from the well then exited the partially severed drill pipe in the BSR and began to erode parts of the ram and BOP stack by fluid flow. Finding 3.13: After the vessel sank at 10:22 on April 22, 2010, the ma- rine riser with the drill pipe inside was bent at a number of places, in- cluding the connector to the BOP, and oil and gas began to flow into the ocean. Finding 3.14: The effect of closing the CSR on April 29, 2010, was to provide a new flow path exiting the severed drill pipe below the CSR and passing the CSR rams that were not designed to seal. Severe fluid erosion occurred past the CSR, with deep cuts made in the surround- ing steel of the BOP housing itself, endangering the integrity of the housing.

OCR for page 45
71 Blowout Preventer System Finding 3.15: Unfortunately, even if the BSR had functioned after be- ing activated by the EDS or the AMF, it would not likely have pre- vented the initial explosions, fire, and resulting loss of life, because hydrocarbons had already flowed into the marine riser above the BOP system. If the BOP system had been able to seal the well, the rig might not have sunk, and the resulting oil spill would likely have been minimized. Summary Finding 3.16: The BOP system was neither designed nor tested for the dynamic conditions that most likely existed at the time that attempts were made to recapture well control. Furthermore, the design, test, operation, and maintenance of the BOP system were not consistent with a high-reliability, fail-safe device. Finding 3.17: Regulations in effect before the incident required the periodic testing of the BOP system. However, they did not require testing under conditions that simulated the hydrostatic pressure at the depth of the BOP system or under the condition of pipe loading that actually occurred under dynamic flow, with the possible entrained formation rock, sand, and cement, and no such tests were run. Fur- thermore, because of the inadequate monitoring technology, the con- dition of the subsea control pods at the time of the blowout was un- known. Finding 3.18: The committee’s assessment of the available informa- tion on the capabilities and performance of the BOP system at the Macondo well points to a number of deficiencies (listed below) that are indicative of deficiencies in the design process. Past studies suggest that the shortcomings also may be present for BOP systems deployed for other deepwater drilling operations. 1. The committee could find no evidence that the BOP design criteria or performance envelope was ever fully integrated into an overall well control system perspective, nor that BOP design was con- sistent with the BOP’s critical role in well control. 2. While individual subsystems of various BOP designs have been studied on an ad hoc basis over the years, the committee could find no evidence of a reliability assessment of the entire BOP system, which would have included functioning at depth under precisely the conditions of a dynamic well blowout. Furthermore, the committee could find no publicly available design criteria for BOP reliability. 3. The entire BOP system design is characterized by a previ- ously identified lack of redundancy:  There is only one BSR.  One shuttle valve is used by both control pods.

OCR for page 45
72 Macondo Well Deepwater Horizon Blowout  Each MUX cable is incapable of monitoring the entire BOP system independently. 4. No design consideration appears to have been given to BSR performance on pipe in compression. 5. The BSR was not designed to shear all types and sizes of pipe that might be present in the BOP system. 6. The BSR probably did not have the capability of shearing or sealing any pipe in significant compression. 7. There was a lack of BOP status monitoring capabilities on the rig, including  Battery condition,  Condition of the solenoid valves,  Flow velocity inside the BOP system,  Ram position,  Pipe and tool joint position inside the BOP system, and  Detection of faults in the BOP system and cessation of drilling operations on that basis. Finding 3.19: The failure of the AMF to activate might have been due to malfunctions in the control pods that could not be detected. In view of the state of the pipe in the well after the explosion, whether the BSR would have functioned properly is uncertain. This issue is moot if the rams could not perform their intended functions whenever they were activated. Finding 3.20: The regulations did not require that the design of the equipment allow for real-time monitoring of critical features, such as the battery condition in the control pod, so that maintenance issues could be readily discovered. The current test protocol for the BSRs, for example, is designed for near-ideal surface conditions rather than the harsher conditions found on the ocean floor. Finding 3.21: When a signal is sent from the drilling rig to the BOP (on the seafloor) to execute a command, the BOP sends a message back that the signal has been received. However, there are no trans- ducers that detect the position or status of key components, and there are no devices to send a signal that any command has been executed (such as pressure or displacement sensors confirming that the hydrau- lics have been actuated, that rams have moved, or that pipe has been cut). Furthermore, there are no sensors to communicate flow or pres- sures in the BOP to the rig floor.

OCR for page 45
73 Blowout Preventer System OBSERVATIONS Observation 3.1: In the confusion of an emergency such as the one on the Deepwater Horizon, it is not surprising that a drill crew would not take the time to determine whether a tool joint was located in the plane of the BSR or whether tension was properly maintained in the drill pipe. Observation 3.2: In terms of emergency procedures, such as an emer- gency disconnect or autoshear function of the BOP system on its own, there is no ability to manipulate the tool joint position or the level of tension or compression in the drill pipe. The BSR was not designed to work for the full range of conditions that could be realistically antici- pated in an emergency. RECOMMENDATIONS Summary Recommendation 3.1: BOP systems should be redesigned to provide robust and reliable cutting, sealing, and separation capabili- ties for the drilling environment to which they are being applied and under all foreseeable operating conditions of the rig on which they are installed. Test and maintenance procedures should be established to ensure operability and reliability appropriate to their environment of application. Furthermore, advances in BOP technology should be evaluated from the perspective of overall system safety. Operator training for emergency BOP operation should be improved to the point that the full capabilities of a more reliable BOP can be compe- tently and correctly employed when needed in the future. Recommendation 3.2: The design capabilities of the BOP system should be improved so that the system can shear and seal all combina- tions of pipe under all possible conditions of load from the pipe and from the well flow, including entrained formation rock and cement, with or without human intervention. Such a system should be de- signed to go into the “well closed” position in the event of a system failure. This does not mean that the BOP must be capable of shearing every drill pipe at every point. It does mean that the BOP design should be such that for any drill string being used in a particular well, there will always be a shearable section of the drill pipe in front of some BSR in the BOP.

OCR for page 45
74 Macondo Well Deepwater Horizon Blowout Recommendation 3.3: The performance of the design capabilities de- scribed in the preceding recommendation should be demonstrated and independently certified on a regular basis by test or other means. Recommendation 3.4: The instrumentation on the BOP system should be improved so that the functionality and condition of the BOP can be monitored continuously. Summary Recommendation 3.5: Instrumentation and expert system decision aids should be used to provide timely warning of loss of well control to drillers on the rig (and ideally to onshore drilling monitors as well). If the warning is inhibited or not addressed in an appropriate time interval, autonomous operation of the BSRs, EDS, general alarm, and other safety systems on the rig should occur.13 Recommendation 3.6: An unambiguous procedure, supported with proper instrumentation and automation, should be created for use as part of the BOP system. The operational status of the system, includ- ing battery charge and pressures, should be continuously monitored from the surface. Recommendation 3.7: A BOP system with a critical component that is not operating properly, or one that loses redundancy in a critical component, should cause drilling operations to cease. Drilling should not resume until the BOP’s emergency operation capability is fully cured. Recommendation 3.8: A reliable and effective EDS is needed to com- plete the three-part objective of cutting, sealing, and separating as a true “dead man” operation when communication with the rig is lost. The operation should not depend on manual intervention from the rig, as was the case with the Deepwater Horizon. The components used to implement this recommendation should be monitored or tested as necessary to ensure their operation when needed. If the consequence of losing communication and status monitoring of the BOP system is an automatic severing of the drill pipe and discon- nection from the well, the quality and reliability of this communica- tion link will improve dramatically. Recommendation 3.9: BOP systems should be designed to be testable without concern for compromising the integrity of the system for fu- ture use. 13 This recommendation is also presented in Chapter 4 as Recommendation 4.1.