Mark ở vũ trụ khácVIMark học AI
Mark ở vũ trụ khác · Another Universe Anatomy of a Disaster · Oil and gas · Reading data

Deepwater Horizon

1,400 ≠ 0 psi

Macondo well · 20 April 2010 · Gulf of Mexico, off Louisiana

What happenedthe well blew out; the rig exploded, burned and sank two days later
Toll11 dead, 17 seriously injured
Root causefailed cement at the bottom of the well; a warning test read as a "pass"
Main sourcesUS National Commission (Jan 2011), CSB (2016)

Source: deaths and injuries per CSB (2016), executive summary, p. 6; sinking date per National Commission (2011), ch. 1.

Reread in 1 minute

Essence

Two gauges disagreeThe drill pipe read 1,400 psi, the kill line read 0. One of them had to be wrong.
The comforting explanationThe "bladder effect" sounded plausible but was not real. Nobody checked it.
Nearly an hour unseenGas was entering the well from about 20:52. Mud reached the rig floor at 21:40.
The last barrier jammedThe blowout preventer did close, but the pipe was buckled off-centre, so the shear ram could not seal.
Not one companyBP, Transocean, Halliburton and the regulator all share blame, in every investigation.

Source: pressures and times per BP's investigation report (Sep 2010), timeline appendix, consistent with the US National Academy of Engineering (NAE, 2011), ch. 2; "bladder effect" per National Commission (2011), ch. 1 and NAE, ch. 2; blowout preventer per CSB (2016), executive summary, pp. 12–13.

Part 1

The question of the case

The last test before temporarily abandoning the well gave a clearly abnormal result. Experienced drillers saw it, discussed it, and then chose the explanation that reassured them. Why do capable people read bad data as good data?

April 2010A late, expensive wellAlmost six weeks behind schedule, more than $58 million over budget.
→
20 Apr, 17:00–19:55A test misread1,400 psi on the drill pipe. The line next to it read 0. Verdict: "pass".
→
20 Apr, 21:49ExplosionGas reached the rig. Eleven men never came home.

Source: schedule and budget per National Commission (2011), ch. 1; times and pressures per BP's report (2010), timeline appendix.

Part 2

What happened

Clock times come from the timeline in BP's investigation report. The key points (21:40, 21:47, 21:49) match the NAE and CSB reports.

Timeline for the evening of 20 April 2010. 16:54 negative pressure test begins. By 18:35 drill pipe pressure has risen to 1,400 psi while the kill line reads 0. 19:55 the test is accepted as a pass. 20:00 displacement of mud with seawater resumes. About 20:52 hydrocarbons start entering the well. 21:08 pressure rises with the pumps off. 21:40 mud on the rig floor. 21:49 power lost and explosions. gas entering,nobody sees it negative pressure test · about 3 hours 16:54test begins 18:00–18:351,400 psi ≠ 0 19:55 · "pass"displacement from 20:00 ~20:52well starts to flow 21:08pumps off, pressure rises 21:40 mud on the floor blast21:49 local time, evening of 20 Apr 2010 · from mud on the floor to the first blast: 9 minutes
Three hours to test, nearly an hour to notice, nine minutes to run. The test ended at 19:55 with a "pass". Almost an hour later the well began to flow and nobody knew.Source: times and pressures per BP's report (Sep 2010), timeline appendix; 21:40 and 21:49 also in NAE (2011), ch. 3; "9 minutes" and "almost an hour" per CSB (2016), vol. 3, pp. 33–35.
Early 2010 · A hard wellWater depth 4,992 ft (about 1,520 m). The well went more than 18,300 ft (about 5,600 m) below sea level. The rig lease "reportedly cost as much as $1 million per day".
20 Apr · Almost six weeks late, over $58 million over budgetThe original budget: $96.2 million and 51 days.
20 Apr · The cement evaluation crew is sent homeNo cement evaluation log was run. That saved time and a $128,000 fee.
20 Apr, 18:00–18:35 · 1,400 psiDrill pipe pressure crept up to 1,400 psi. Kill line: 0. The crew called it the "bladder effect".
20 Apr, 19:55 · "Pass"No flow and no pressure on the kill line for 30 minutes. The crew took that as proof the well was sealed.
20 Apr, 21:49 · Power lost, two explosionsAbout 126 people on the rig. 11 died.
22 Apr · The rig sinksOn Earth Day, about 36 hours after the first explosion.
15 Jul · The well is cappedJust before capping, oil was still flowing at about 53,000 barrels a day.

Source: water depth, lease cost, budget, cement evaluation crew, people aboard, sinking date per National Commission (2011), ch. 1, pp. 2–6 and 19; well depth per NAE (2011), ch. 2; pressures and times per BP's report (2010); 30 minutes per CSB (2016), vol. 3, pp. 33–34; capping date and flow rate per the Flow Rate Technical Group (FRTG), US Department of the Interior, 2 Aug 2010.

Episode 1

What happened

1,400 psi19:55 "pass"9 minutes11 men
Episode 2

Why

four barriersbladder effect9 decisionsmyths
Episode 3

Work lessons

criteria firstconflicting numberssomeone outside the room
Part 3

Why: four barriers, all breached

An oil well is kept closed by several layers. At Macondo every layer failed, and each later layer assumed the one before it was fine.

Overview: four layers of protection

barriers · defense in depthBP 2010, key findings; CSB 2016
Four shields in a row. Shield 1: cement at the bottom of the well, failed. Shield 2: the negative pressure test, misread. Shield 3: well monitoring, missed the influx for nearly an hour. Shield 4: the blowout preventer, did not seal. An arrow of gas passes through holes in all four. gas 1 · cementdid not hold the gas 2 · the testread as a "pass" 3 · monitoringnearly 1 h unseen 4 · BOPclosed, did not seal each layer assumed the previous one had held
There was no single fault. BP's own report lists eight key findings, from the cement to the fire and gas system. The CSB calls people "critical barriers" against major accidents.Source: BP's report (Sep 2010), eight key findings; CSB (2016), executive summary, finding 8; "nearly 1 hour" per CSB, vol. 3, pp. 34–35 and NAE, finding 3.1 ("more than 50 minutes").

Layers 1–2: the negative pressure test

negative pressure testNAE, ch. 2; CSB, vol. 3
Diagram of the negative pressure test. The drill pipe runs down the middle of the well, the kill line runs alongside outside, and both connect below the blowout preventer on the seabed. The crew lowers the pressure in the well. If the bottom cement holds, both gauges should go to zero and stay there. In fact the drill pipe rose to 1,400 psi while the kill line read 0. The CSB later concluded the kill line was likely plugged by spacer. seabed BOP bottom cement gas leaks past drill pipe1,400 psi kill line0 psi 1 · the method: lower the pressure simulates the abandoned well, held only by cement 2 · pass: no flow, no pressure build-up the two lines connect, so they must agree 3 · reality: 1,400 psi and 0 psi crew trusted the 0, set aside the 1,400
Two gauges measuring the same place, showing two different numbers. Over three attempts the drill pipe pressure was 273, then 1,250, then 1,400 psi. The kill line showed no flow for 30 minutes, and the crew "considered this as evidence that the well was sealed". The CSB found spacer had not been fully pushed above the BOP and likely plugged the kill line.Source: NAE (2011), ch. 2 (273, 1,250, 1,400 psi); CSB (2016), vol. 3, pp. 28–34 (method, plugged line, 30 minutes); BP's report (2010), timeline 18:00–18:35. 1,400 psi ≈ 97 bar.

The human layer: the comforting explanation

"bladder effect" · confirmation biasNational Commission, ch. 1 and 4; NAE, ch. 2
Three readings of the same 1,400 psi. The right reading: the cement failed, gas is pushing up, stop. The reading chosen: the bladder effect, heavy mud pressing on a valve makes the number false. The missing step: bleed off the drill pipe and see whether pressure returns. the right reading "the cement failed,gas is pushing up" → stop, redo the cement the reading chosen "bladder effect":heavy mud presses ona valve, number is false → trust the 0, carry on the missing step bleed off the drillpipe and see whetherpressure comes back → one test, minutes NAE: the "bladder effect" was an erroneous theory, unrelated to the situation in the test.
An explanation that was never tested. According to BP witnesses, toolpusher Jason Anderson had seen this before and explained it as the "bladder effect". He was highly respected for well control, and he died in the explosion. The NAE observed that bleeding off the drill pipe at the end of the test would likely have revealed that the well was connected to the reservoir.Source: National Commission (2011), ch. 1, p. 6 (Anderson, "bladder effect"; the exact conversation is disputed, see ch. 4); NAE (2011), ch. 2 and observation 2.2.

No common criteria

This rig had used at least six different negative test procedures between August 2007 and April 2010 (CSB, vol. 3, p. 30).

Nobody outside the room looked

No one onshore or at the regulator was required to review the test data before work continued (NAE, finding 2.10).

Hindsight is easy

The CSB reminds us that behaviour is only called an error after a bad outcome. The crew was "doing what made sense to them at the time" (vol. 3, pp. 23 and 36).

The decision layer: 9 choices that raised risk

risk-enhancing decisionsNational Commission, ch. 4
Nine decisions the National Commission listed as increasing risk. Seven saved time, two unclear. Seven were made by BP onshore, one by Halliburton and perhaps BP, one by BP on the rig and perhaps Transocean, and bypassing the pits with simultaneous operations by Transocean and perhaps BP. The Commission: every decision had a less risky alternative. 1 · not waiting for more preferred centralizers 2 · not waiting for foam stability tests 3 · not running a cement evaluation log 4 · unusual spacer to avoid waste disposal 5 · displacing mud before the surface plug 6 · plug 3,000 ft below mud line in seawater 7 · no extra physical barriers 8 · no further checks after the odd test 9 · bypassing pits, simultaneous operations saved time (7) unclear (2) Who decided: BP onshore 7 · Halliburton 1 (perhaps BP) · BP on rig 1 (perhaps Transocean) · Transocean on rig 1 (perhaps BP) The Commission: all 9 decisions had a less risky alternative.
This was saving time, not necessarily calculated "cost-cutting". The Commission wrote that "whether purposeful or not", many risk-enhancing decisions saved the companies significant time (and money). The well was almost six weeks late.Source: National Commission (2011), table of decisions that increased risk (repeated in the Recommendations section, Figure 3, p. 14); quote from the co-chairs' testimony to Congress, 26 Jan 2011. The decision-maker count exceeds 9 because some decisions involved two parties.

Layers 3–4: monitoring and the blowout preventer

kick detection · blowout preventerCSB, vols. 2 and 3; NAE, ch. 3
Left: signs of gas entering the well in the last hour. 21:01 drill pipe pressure rose from 1,250 to 1,350 psi at a constant pump rate. 21:08 pumps off, pressure still rose from 1,017 to 1,263 psi. 21:40 mud on the floor. Right: the blowout preventer. The drill pipe was buckled and off-centre, so the blind shear ram could not seal the well. A battery in the blue pod was drained by miswiring; a solenoid in the yellow pod was also miswired. signals already on screen 21:01–21:081,250 → 1,350 psi, pumps steady 21:08–21:14pumps off, pressure up 1,017 → 1,263 21:40mud spills onto the rig floor two pressure sensors on the BOP: no alarms blind shear ramclosed butdid not seal drill pipe buckled, off-centre
The last barrier worked, but not enough. The CSB concluded the automatic emergency system "most likely functioned", but the drill pipe had buckled from "effective compression" and sat off-centre, so the blind shear ram could not fully close. The blue pod was miswired, draining a battery; a solenoid in the yellow pod was also miswired.Source: pressures per BP's report (2010), timeline; sensors without alarms per CSB (2016), vol. 3, p. 48; blowout preventer per CSB (2016), executive summary, findings 2a, 2b, 4, 5, pp. 12–13 and NAE (2011), ch. 3.

Aftermath: how much oil?

flow rate · spill volumeFRTG 2010; court 2015
Two estimates of total oil. The US government's Flow Rate Technical Group: about 4.9 million barrels, plus or minus about 10 percent, of which about 800 thousand barrels were captured. The federal court in 2015: 3.19 million barrels. FRTG (government, 2010) 4.9 M dark part: ~0.8 million barrels captured federal court (2015) 3.19 M unit: million barrels (1 barrel ≈ 159 litres) · just before capping: about 53,000 barrels a day
The sources disagree. The FRTG estimated about 4.9 million barrels (±10%), starting at about 62,000 barrels a day. In 2015 the federal court in New Orleans found 3.19 million barrels, less than the government's estimate and more than BP's figure. This piece shows both.Source: FRTG, US Department of the Interior press release, 2 Aug 2010; ruling of Judge Carl Barbier, Jan 2015, as reported by NPR (press source).
Part 4

Fact check: what is true and what is myth

12 things often said about Deepwater Horizon, checked against the primary record. Click each row to see why.

SOLIDThe negative pressure test showed the well was not sealed, yet was judged a "pass"

Every investigation agrees. The Commission: the test "identified a cementing failure but was incorrectly judged a success because of insufficiently rigorous test procedures" (co-chairs' testimony, Jan 2011). NAE, CSB and BP's report reach the same conclusion.

SOLID11 men died

National Commission (ch. 1) and CSB (executive summary, p. 6). Seriously injured: the CSB says 17; the Commission says 16 were medevaced.

SOLIDThe well was behind schedule and over budget

Almost six weeks late and more than $58 million over a budget of $96.2 million and 51 days (National Commission, ch. 1).

SOLIDThe cement evaluation crew was sent home without running a log

On 20 April the Schlumberger team was sent home, saving time and a $128,000 fee (National Commission, ch. 1). NAE: no cement bond log was run (finding 2.9).

SOLIDThe blowout preventer had maintenance faults

CSB: the blue pod was miswired, draining a critical battery; a solenoid in the yellow pod was also miswired; the blind shear ram did not meet the manufacturer's published design (executive summary, findings 2a, 2b, 12).

CAUTION"It was only BP cutting costs"

Partly true, but incomplete. In 2014 the federal court split fault: BP 67%, Transocean 30%, Halliburton 3%, and called BP's decisions "profit-driven" (per the Christian Science Monitor). The National Commission named the root cause as "a failure of management by BP, Halliburton and Transocean", said the time-saving decisions were made "whether purposeful or not", and pointed to an under-funded regulator (MMS) under pressure to increase production. The CSB stresses human factors and how the whole industry manages safety barriers.

CAUTIONThe drill crew were careless and did not watch the well

They did miss the signs for nearly an hour. But the CSB points to poor tools: two pressure sensors on the BOP had no alarms, there was no common test procedure, and the crew was doing several things at once. The CSB says they were "doing what made sense to them at the time" (vol. 3, pp. 36 and 48).

CAUTION4.9 million barrels of oil spilled into the sea

That is the FRTG estimate (±10%), and about 800,000 barrels of it were captured. The 2015 court found 3.19 million barrels. The National Commission and the CSB say "over 4 million barrels".

CAUTIONToo few centralizers caused the blowout

It was one of the 9 risk-raising decisions the Commission lists, not the sole cause. The NAE says it is unclear whether the casing was adequately centralized, and points to the unstable foam cement as the bigger problem (ch. 2).

FALSEThe "bladder effect" is a real phenomenon that explains the 1,400 psi

The NAE calls it "an erroneous theory", and says the term as used in industry is "unrelated" to the situation in the test (ch. 2).

FALSEThe blowout preventer did nothing at all

CSB: the automatic emergency system "most likely functioned" and the blind shear ram closed, but the pipe was buckled and off-centre so it could not seal (executive summary, findings 4–5). The NAE notes that the evidence on the emergency systems is disputed.

FALSEThe rig sank right after the explosion

The rig burned for about 36 hours and sank on 22 April 2010 (National Commission, ch. 1). Oil kept flowing from the well on the seabed until 15 July.

Part 5

Assessing the case

Scores are Mark's assessment based on the sources in Part 8, not figures from a study.

Could have been avoided
5/5
Warning signs existed
5/5
Transparent investigation
4/5
Lessons retained
3/5
Done right afterwards
  • Four major investigations, published openly
  • The Commission named all three companies and the regulator
  • The court split fault clearly between the parties
Not done right
  • The CSB's final report took six years (2016)
  • The companies blamed each other for years
  • The Commission warned the regulator was still under production pressure

The information that could have saved 11 lives was on the gauges from 18:00. What was missing was not data, but a rule that made people believe the bad number.

More: what the Commission said about the whole industry

The Commission wrote that the blowout "could have been prevented", and that the mistakes revealed "such systematic failures in risk management that they place in doubt the safety culture of the entire industry". It called this the cost of "a culture of complacency".

On the regulator, the Commission noted that MMS's budget "decreased or remained static while deepwater oil production in the Gulf of Mexico boomed", and that safety functions needed insulating from the pressure to increase production and lease revenue.

Source: National Commission (2011), Foreword, pp. vii and ix; Recommendations, p. 8.

Part 6

Work lessons: when the data look bad, don't reach for the comforting explanation

Applies to every "final check": pre-launch testing, data reconciliation, building inspection, reviewing documents before signing.

Four steps when a check gives a strange result: write the pass criteria first, treat two conflicting numbers as a fail, test any new explanation, and show the data to someone outside the room. 1 · criteria firstwhat "pass" meansfixed before you see data 2 · conflict = fail1,400 and 0don't pick the nice number 3 · test the explanationif true, what would we see?then check exactly that 4 · outside eyessend the raw databefore moving on A plausible explanation is not evidence.
Each step patches one failure of 20 April. No common criteria (six different procedures), two gauges in conflict, an untested "bladder effect", and nobody onshore required to look at the data.Source: CSB (2016), vol. 3, p. 30; NAE (2011), ch. 2, observation 2.2 and finding 2.10.
Believe the bad number until you disprove itWhen two sources disagree, the burden of proof sits with "safe", not with "there's a problem".
Don't monitor while doing three other thingsThe Commission lists bypassing the pits and simultaneous operations among the 9 risk-raising decisions.
Turn signals into alarmsA sensor with a number but no alarm is close to no sensor. Set thresholds; let the machine prompt the person.
Don't let barriers lean on each otherEach check must stand on its own, without assuming the previous one was fine.
Human performance is often only deemed erroneous in the aftermath of a negative outcome.CSB, Macondo investigation report, vol. 3 (2016), p. 23. A reminder: the lesson is to fix the process, not just to find someone to blame.
Part 7

Further reading

National Commission, Deep Water: The Gulf Oil Disaster and the Future of Offshore Drilling (2011)Chapter 1 retells the evening of 20 April like a long-form report. Chapter 4 dissects the negative pressure test.
Andrew Hopkins, Disastrous Decisions (2012)A safety sociologist on why the crew believed a test that had failed.
Earl Boebert and James Blossom, Deepwater Horizon: A Systems Analysis of the Macondo Disaster (2016)Treats the case as a system and pushes back on the "one culprit" story.
Anatomy of a Disaster #08: Boeing 737 MAXA hidden assumption in the design, and who was allowed to know what.
Part 8

Sources

Primary documents first. Wherever only a press source exists, it is flagged in the Fact check section.

  1. National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling, Deep Water: The Gulf Oil Disaster and the Future of Offshore Drilling, Report to the President, Jan 2011: Foreword, ch. 1, ch. 4, Recommendations. govinfo.gov
  2. B. Graham and W. Reilly (Commission co-chairs), testimony to the US Congress, 26 Jan 2011. house.gov
  3. U.S. Chemical Safety and Hazard Investigation Board (CSB), Drilling Rig Explosion and Fire at the Macondo Well, 4 vols., Apr 2016: executive summary, vol. 2 (blowout preventer), vol. 3 (human and organizational factors). csb.gov
  4. National Academy of Engineering and National Research Council, Macondo Well Deepwater Horizon Blowout: Lessons for Improving Offshore Drilling Safety, 2011: ch. 2, ch. 3, Appendix C. nationalacademies.org
  5. BP, Deepwater Horizon Accident Investigation Report, 8 Sep 2010, timeline appendix (report by an interested party). sec.gov
  6. Flow Rate Technical Group, US Department of the Interior press release, "U.S. Scientific Teams Refine Estimates of Oil Flow from BP's Well Prior to Capping", 2 Aug 2010. doi.gov
  7. Rulings of Judge Carl Barbier, 4 Sep 2014 (fault) as reported by the Christian Science Monitor, and Jan 2015 (volume) as reported by NPR. csmonitor.com · npr.org