Deepwater Horizon: As it Happened

Geoff Maitland looks back on the Gulf of Mexico oilspill, ten years ago this month

20 April 2010 was to be a special day for the rig and crew of Deepwater Horizon, Transocean’s semi-submersible offshore drilling rig contracted by BP to drill a 20,000 feet exploration well into the Macondo reservoir, situated 4 miles below the ocean surface in the Gulf of Mexico, 41 miles off the SE coast of Louisiana. The drilling had been taking place in one mile of deep water for some 4 months and the project was six weeks behind schedule – due to a series of delays arising from drilling through some quite sensitive and weak rock formations that required careful and circumspect drilling. However, today was the day when, having reached the target zone, the well was to be completed and left in a safe state of readiness for future production. The Deepwater Horizon, costing about US$1M a day to use, could finally be moved away to drill elsewhere with the Macondo well temporarily capped, ready to be re-entered and moved into production mode at a future date. This would bring to the surface the potential 50m barrels (bbl) of high-quality oil (worth about US$5bn) formed and trapped in the reservoir over geological time. Mission almost accomplished.

To celebrate the rig’s excellent safety record of seven years without a lost-time incident, BP...and Transocean executives were making a special visit to the rig to present awards and congratulate the crew

Not only was this the day for completion and moving on, but to celebrate the rig’s excellent safety record of seven years without a lost-time incident, BP Vice President of Drilling, Patrick O’Bryan, along with other BP and Transocean executives, were making a special visit to the rig to present awards and congratulate the crew. They arrived at around 14:30, and were given a full tour of the rig, meeting the crew, discussing safety issues along the way and being assured that the final stages of drilling and preparing to seal off the well were going fine. Night was beginning to fall, and at 19:00 in a conference room below deck the VIPs met with crew representatives to congratulate them on their superb seven-year safety record. Job done, they went up to meet the rig captain on the bridge. They were in the middle of trying out the drilling simulation tool used for training when suddenly the rig began to shake. The Captain opened a door and they could see drilling mud from the rig pouring down onto the support vessel Bankston, moored alongside. They quickly closed the door, only to hear a hissing sound followed by a loud noise which sounded like an explosion. The Deepwater Horizon tragedy was unfolding before their eyes.

Build-up to the disaster…a catalogue of problems

To understand what was happening, we need to rewind a little. The drilling of the Macondo well from the seabed, some 5,000 ft below the ocean surface, had proved troublesome. The drillpipe had got stuck in the wellbore, there were numerous “lost circulation” events (where the drilling mud leaks out of the well through cracks in the rock) and “kicks” due to gas at unexpectedly high pressures entering the well from the formation. All these caused costly delays, and by 20 April the project was 45 days behind schedule and over budget by US$58m. So there was some pressure to get this project finished without further delays and cost over-runs.

The lost circulation events...were a warning sign that the safe window for drilling, below the rock fracture pressure whilst staying above the hydrocarbon pressure in the rock pores, was quickly narrowing

The lost circulation events, whilst being solved by running viscous lost circulation pills to seal the fractures, were a warning sign that the safe window for drilling, below the rock fracture pressure whilst staying above the hydrocarbon pressure in the rock pores, was quickly narrowing. A lost circulation event on 9 April convinced the drilling engineers that with a mud of density 14.5 pounds per gallon (ppg) the risk of further fracturing, major mud losses and wellbore failure by drilling deeper were unacceptably high. The well was by now at a depth of 18,360 ft, already penetrating the payzone of porous hydrocarbon-containing rock that BP hoped to exploit. Although the target depth was 20,200 ft, BP decided to stop drilling further “for well integrity and safety reasons”. All that needed to be done now was to place a steel tube (a “production casing”) into this final section of the hole and to pump cement into the annulus between it and the formation rock to make sure that the hydrocarbons were sealed into the formation until BP and its partners were ready to produce them.

The drilling mud in the wellbore would not then be needed to keep the oil and gas within the rock formation and could be safely replaced by seawater before all valves at the wellhead on the seafloor were closed. With the drilling rig disconnected from the wellhead, Deepwater Horizon could sail away to its next destination to drill another deep sub-sea well, hopefully without all the problems it had encountered in getting Macondo (almost) to its target. The plan was for BP to return at a later stage to re-enter the well with a production platform and start to produce the 50m bbl of oil that Macondo held in its bounty. This was a relatively routine procedure carried out on hundreds of wells a year. What could possibly go wrong?

Crucial decisions and oversights: the blowout creeps up

Well, as it turned out, quite a lot in fact could, and did, go wrong. First, several decisions about the design and execution of the primary cementing job were made which increased the risk of problems. It was decided to use a “long string” steel casing reaching from the payzone all the way back to the surface, rather than an easier-to-cement liner that was connected just to the casing in the drilled section immediately above. Then, instead of using 21 centralisers, considered optimal to keep the long casing centred in the wellbore to ensure that cement was placed uniformly in the casing-formation annulus, avoiding slugs of undisplaced and unsettable drilling mud remaining in the section to be sealed off, only six were eventually deployed. This saved about 10 hours in mounting centralisers but compromised the chances of uniform cement placement.

The casing started to be lowered into the well on the morning of 18 April and once in place, by early afternoon the crew was ready to start the cementing job, carried out by specialist contractor Halliburton. The previous lost circulation concerns due to the fragility of the formation rock had now placed considerable constraints on the design of the cement slurry and process. The risk of fracturing the formation due to too high a pressure exerted by the slurry, a combination of hydrostatic (ruled by column height and density) and circulation (ruled by flowrate), was the number one concern.

So several compromises were made to reduce the stress imposed on the exposed rock:

• The time taken to condition the thixotropic mud, which gels as it sits in the well, to a low viscosity state more easily displaced by the cement, was cut by a factor of eight compared with normal practice.
• The pumping rate for the following cement slurry was set at a relatively low value (<4 bbl/min), which was far less than is optimal for best mud-displacement.
• The volume of cement used (60 bbl, 1 bbl being ~150 L) was also kept to a bare minimum to keep the height of the cement column as low as possible – reaching only 500 ft above the uppermost hydrocarbon zone compared with BPs normal guideline of 1,000 ft.
• Critically, the density of the cement slurry could not exceed the density where drilling mud had caused the last “lost circulation”, 14.5 ppg. So BP and Halliburton decided to use a foam cement where tiny nitrogen gas bubbles were dispersed in a 16.7 ppg cement slurry to reduce its density to 14.5 ppg.

Whilst mitigating the fracture and lost circulation risk, there are potential problems with foam cement if it does not remain stable until after the cement is set, causing it to be porous and permeable, with a much lower mechanical strength. Earlier lab testing by Halliburton had revealed unstable behaviour, but it seems these results were not fully taken into account before the final design was pumped. So all these factors meant that extra vigilance would have been expected to check that none of these changes from normal or best practice had compromised the goal of the primary cementing job, to ensure complete sealing off of the high pressure hydrocarbon zones delivering “well integrity”, from being achieved.

On completion of the primary cementing job at 00:40 on 20 April, the pumps were turned off. On opening a valve on the cementing unit, there was no significant flowback, indicating that cement was not migrating up the annulus. Halliburton and BP concluded that the job had been pumped as planned and that zonal isolation in the payzone had been achieved, ensuring well integrity.

On the basis of this rather slim and indirect evidence, they decided to dispense with carrying out more rigorous cement evaluation tests, using acoustic well logging tools to establish the full displacement of mud by cement and confirm good bonding between the cement and both the casing and the formation rock. At the 07:30 meeting the Schlumberger team, on board to carry out this test, was sent home and the rig crew moved on to the final phase: temporary abandonment to move Deepwater Horizon off the well, ready for it to be finally completed for hydrocarbon production in due course by a smaller and less costly rig. BP had made many changes to this abandonment procedure in the previous two weeks and it is not clear that the one used on 20 April went through any formal risk assessment or management of change process.

Key signals of impending disaster ignored

Before replacing much of the drilling mud still in the well with lighter seawater, it was necessary to fully check that the hydrocarbons in the payzone were indeed properly sealed off and did not anymore require the pressure of the 18,360 ft of heavy mud column to keep them in place. This was done with a series of pressure tests. First was a positive-pressure test, started at noon, in which the well was pressurised up to 2,500 psi for 30 mins. The pressure inside the well remained steady, showing there were no leaks from within the production casing to the outside. Next came a “negative-pressure test” which would check the integrity of not only the casing but also the bottomhole cement job. The crew set up the well to simulate the planned removal of mud from the riser pipe (over 5,000 ft joining the top of the well to the rig floor) and from the top of the well. To do this they ran drillpipe into the well and pumped seawater down to displace 3,300 ft of mud from the well to above the blowout preventer (BOP), the complex multi-valve device connecting the riser to the top of the well that was the device of last-resort for sealing the well. They separated the seawater from the mud by a slug of spacer fluid to prevent mixing at the interface. However, in this case, rather than a conventional spacer, they unusually used a heavy, viscous lost-circulation fluid now surplus to requirements not normally used as a spacer or tested for this purpose.

Once the mud was displaced above the BOP, the crew closed an annular valve on the BOP around the drillpipe to isolate the well from the hydrostatic pressure exerted by the mud and spacer in the riser, and then they opened the top of the drillpipe on the rig and bled the drillpipe pressure to zero. When the drillpipe was closed again to shut the well in, its pressure built quickly to over 1,200 psi indicating that under these “underbalanced” conditions, fluids were entering the well from the formation. The test was repeated three times and each time there was a pressure build up to about 1,000 psi. Instead of accepting that there was a well integrity problem, and that the primary cementing job had not secured the well, it was suggested that the observed pressure was due to pressure transmission from the heavy mud in the riser through the BOP annular seal (a “bladder effect” of unclear mechanism). It was decided to re-run the negative pressure test through the “kill line” – an alternative route to send fluids through the BOP into a shut-in well. The kill line was opened, the pressure bled down to zero and no flow or pressure build-up was observed for 30 mins. However, the drillpipe pressure remained at 1,400 psi, whereas it should have been the same as that in the kill line. Nevertheless, the negative pressure test on the kill line was deemed to be correct, and at 20:00 BP, in consultation with the rig crew, decided that the integrity of the well had been confirmed. This was the moment that the Macondo well was lost.

From this point forward, events moved on apace. Almost immediately, the order was given to open the BOP annular preventer valve and to begin displacing the mud and spacer from the riser. Preparations were started for the next stage of sealing off the well, with a cement plug, to be set deeper than normal at 8,367 ft – yet this would never happen. During the displacement procedure, the drillers and mud engineers should have been on the lookout for evidence of a “kick”– the unplanned entry of gas or oil into the well – if by chance the bottomhole cementing had not done its job. Inflowing gas can expand over a hundred times as it makes its journey up the 18,000 ft of well and riser towards the rig, accelerating to great speed as it does so and pushing the drilling mud up the well faster and faster as it expands.

There are indicators available if this is happening:

• the volume of mud in the active mud pits on the rig rises, the flowmeters show a mis-match between fluids entering and leaving the well, visual flow checks and cameras will show if fluids are flowing from the well; and
• the drillpipe pressure can indicate problems, particularly if it rises when the pumps are shut down.

In the crucial period after 20:00, all these indications were happening on the Macondo rig, yet no-one picked them up or acted on them.

At 21:00 the drillpipe pressure started to increase at constant pumprate. At 21:10, as the last of the 400 or so bbl of oil-based mud, displaced by seawater, arrived at the rig, the mud pumps were stopped to do a “sheen test” to check that the returning fluid was now the heavy water-based spacer, not oily mud, so that it could be dumped overboard as a “used well fluid” – the reason behind it being used as a spacer in the first place. By 21:14 the pressure had risen by 250 psi, and continued to do so after the pumps were switched on again. The drillers did notice that there was an unexpected difference between the drillpipe and kill line pressures at 21:30 and shut off the pumps to investigate, delaying the setting of the cement plug. The drillpipe pressure rose by 550 psi in 5 mins and when bled off continued to rise again. This was clear evidence of a kick, but was again ignored with no action to shut in the well using the BOP.

The beginning of the end

At around 21:40, mud and gas began spewing onto the drill floor. This was the scene observed by the VIPs from the bridge and was the first time the drillers realised that a kick was occurring. It was still not too late – there were still the multiple seals of the BOP that, if activated, could still seal off the well. The driller closed one annular preventer seal at 21:41, but it had little effect. Gas was already above the BOP and was rocketing up the riser “like a 550-tonne freight train”, according to one member of the Transocean crew. Meanwhile, another crucially-bad decision had been taken: to route the fluid flow from the riser into the limited size and pressure rating mud-gas separator rather than over the side of the rig. The separator was overwhelmed, gas spread rapidly over the rig floor, was probably ignited by the rig pump motors, and the first explosion occurred at 21:49. While this was only a few minutes after the alarms were raised, it was almost an hour since the first indications of a kick had started to appear – if only they had been heeded.

Desperate efforts to close the well continued. The variable bore ram which closes round the drillpipe was activated at 21:46 but was ineffective; the flowrates by then were probably too high. After the first explosion the bridge activated the Emergency Disconnect System (EDS) which should have closed the blind shear rams designed to sever the drillpipe, seal the well and disconnect the rig from the BOP. The EDS did not respond, maybe because by then the electrical and hydraulic cables to the BOP had been damaged. Yet the “deadman” automatic shutoff failsafe system should still have triggered the blind shear rams after all power and connections were lost, but that failed too. Subsequent investigation detected low batteries and defective solenoids on the control pods, indicating poor maintenance of the system.

It was a tragedy that could have been avoided, for this accident was eminently avoidable. Like any major accident, it arose when many failures came together at the same time

Emergency evacuation, though somewhat chaotic with some jumping for their lives, did manage to get most people off the rig. Eleven men lost their lives that night, with many serious injuries. It was a tragedy that could have been avoided, for this accident was eminently avoidable. Like any major accident, it arose when many failures came together at the same time; here the multiple barriers built into the drilling process, to prevent the uncontrolled release of flammable, high pressure hydrocarbons into the well and onto the rig, all failed due to poor decisions, maintenance and design and too many mistakes and oversights by BP, Transocean and Halliburton collectively. There followed many commissions and enquiries into the causes and details of who did what. Many of those precise details remain unknown today.

The failures behind the disaster

Yet beneath all the sequence of technical and human failures set out above, the root causes of the accident lie in many fundamental underlying failures of management, communication and regulation. The absence of formal decision-making processes, checks and balances that agreed procedures were being followed, training of both operators and contractors, peer- and expert review of risks and management of change – the list is long. Much of the decision-making was compartmentalised, with poor communication within the companies, between them and across the industry. Transocean failed to pass on the warnings and potential learnings from an almost similar incident on one of their rigs in the North Sea just a few months earlier where, as on Macondo, the Deepwater Horizon rig was exposed to just one barrier, the bottomhole cemented annulus, which if it failed had potentially catastrophic consequences. Fortunately on that rig the crew was able to shut the BOPs once mud spread onto the rig floor.

Similarly the industry was poor in alerting all operators to the dangers and lessons from similar, but less damaging, accidents such as that on the Montara platform off Northern Territory in Australia only a year earlier in August 2009. There was clearly a conflict at times between best practice risk mitigation and savings of time or money. To avoid such conflicts requires a top-down safety culture that rewards those, both employees and contractors, who take the right action to manage risks irrespective of whether this adds extra time or costs.

Alongside this, the Deepwater Horizon incident arose because of regulatory failures. It was clear that the Mineral  Management Service (MMS) regulatory system in place at the time was not fit for purpose to address the management of risks involved in deepwater drilling, or even more routine hydrocarbon recovery operations. The prescriptive rules-driven checklist system in place in the US at the time, with inadequate processes, resources and expertise to review decisions by operators and their contractors was a stark contrast to the goal-oriented safety case regulatory regime in place in the UK and other parts of the world. Here the responsibility is on the operator to identify all the possible hazards associated with drilling and completion of oil and gas wells, to evaluate the risks and to present a mitigation plan for how these risks will be managed to reduce them. This is to be done not by some method or to some level prescribed by the regulator, but by whatever procedures are required to make them as low as reasonably practicable – the well-known ALARP principle.

The aftermath of the Deepwater Horizon disaster led to improvement of technical procedures, such as operation and maintenance of BOPs and the provision of devices to cap wells under worst-case scenario situations such as the unrestricted flow of oil and gas from an open hole on the floor of the ocean (which nobody seemed to have thought of before this accident). It also led to a complete overhaul of offshore oil and gas regulatory procedures in the US, moving them much closer to the goal-oriented system in place elsewhere.

Lessons for the UK

That is not to say that having a goal-oriented safety-case system is guaranteed to avoid a disaster like the Deepwater Horizon incident. There is a need for continual review and improvement. In 2010, a root-and-branch review of the UK offshore regulatory system was carried out in the light of the Deepwater Horizon explosion and oilspill. This produced 27 recommendations for how the UK system needed to be improved in order to make the chances of a repeat accident in UK waters as low risk as possible. These covered areas such as:

• improving well planning and control, based on best engineering principles and practice;
• improving the learning culture and processes for spreading best practice;
• increased focus on competency and training of the workforce;
• enhanced workforce engagement and encouraging whistleblowing;
• strengthening mechanisms to assure implementation of safety and environmental management systems;
• ensuring the quality and high competence of regulators as well as competent and responsible operators;
• greater integration between the regulatory authorities in the UK and the further separation of licensing and regulation (as was not the case in the US in 2010);
• a clearer command and control structure in the event
  of a spill;
• robust arrangements to ensure operators’ level of liability and ability to pay in the event of a spill; and
• intensified R&D to develop improved avoidance, capping, containment, cleanup and impact monitoring of major offshore oil spill incidents.

Parallel improvements took place in Norway and within the EU, and the culture now is one of continual improvement and vigilance as some drilling continues to move into even deeper waters and more challenging environments.

Phase 2: ecological disaster

20 April 2010 was, of course, only the first phase of the Deepwater Horizon disaster. The rig was rapidly engulfed by fire, fuelled by the endless supply of oil and gas gushing up the riser to the deck. Despite all the efforts of floating firefighters, Deepwater Horizon could not be saved. Its structures began to buckle and by the morning of 22 April the rig had keeled over and sunk. The riser buckled and was torn away from the rig as oil and gas poured unabated into the Gulf of Mexico. It rapidly changed the disaster from an explosive inferno in which 11 people died and 17 were seriously injured, into an ecological disaster for the ocean and coastline of the Gulf – for its marine creatures and wildlife and for the livelihoods of the locals, who depend on the riches and beauty the sea and the coastline have to offer.

Once the riser was wrenched from the rig, it acted as a giant hosepipe, jetting huge volumes of oil and gas out into the Gulf of Mexico, a toxic poison for the fish and other marine life living in the ocean. This killed and damaged dolphins, endangered sea turtles, pelicans and other wildlife by polluting the water and coastline they live on, as well as the beaches and neighbouring waterways and having a hugely damaging impact on the whole ecosystem and habitat of the Gulf. The spill directly contaminated 68,000 square miles (180,000 km²) of ocean, and over 1,000 miles of coastline, from Texas to Florida, was affected. The economic and human costs have been enormous – BP alone has paid out US$65bn in fines, compensation, cleanup and legal costs, and the livelihoods of those living around the Gulf have been disrupted for a decade.

The long road to stopping the oil spill

At first, some kinks in the buckled riser helped to reduce the flow from the well but in order to try to cap the well it soon had to be cut away at various points and the full force of the pressurised reservoir unleashed thousands of barrels of oil into the Gulf every day. With no flowmeters to measure the amount, estimates of the released hydrocarbons varied: at first BP said it was a few hundred bbl/d, maybe 1,000. Then it was 5,000 bbl/d. Eventually, most experts agreed that up to 60,000 bbl/d was pouring out into the ocean, the equivalent of almost four olympic-sized swimming pools every day. By the time the well was finally capped, some 87 days later, almost 5m bbl, or 200m US gallons, of oil had been emptied into the Gulf of Mexico – the largest offshore oilspill ever.

Efforts to stem the flow of oil and cap the well started immediately by trying to activate and repair the existing valves on the BOP with remote subsea vehicles, but to no avail. This led to a sequence of trying increasingly complex containment solutions, some of them quite desperate with low chance of success, requiring “engineering on the fly”, as no customised equipment was available to cope with this worst-case scenario, a leaking open well on the seabed one mile beneath the surface. Early on, chemical dispersants were sprayed into the oil and gas jet emitting from the remaining part of the riser sprawled on the seabed in an attempt to emulsify the oil into small droplets to reduce its spread and aid collection (a technique used at surface and on beaches but never used on a deep leak before). Whether this helped contain the environmental impact is uncertain, and there has been much debate over the extent to which this increased the persistence of oil within the Gulf waters and perhaps worsened the impact on marine life and the ecological damage.

The well capping solutions attempted included a massive steel containment dome (“cofferdam”) which rapidly clogged with methane gas hydrates, which sometimes block production pipelines and formed under the particular pressure and temperature conditions on the seabed. On 26 May an attempt was made to inject heavy drilling mud into the choke and kill lines on the BOP (a “top kill”), followed by “junk shots” of potential plugging  debris consisting of golf balls, rubber waste and other detritus, to overcome the flow and pressure of the emerging oil and gas stream, but again to no avail.

It was possible eventually to siphon off some of the oil through a tube inserted into the broken riser connected to a drill ship. In the end the riser pipe was cut off close to the BOP so that better-fitting caps could be installed. A loose-fitting “top hat” managed to collect about 15,000 bbl/d to a surface ship and further collection of up to 10,000 bbl/d from the BOP kill and choke lines was sent to another surface ship which had no storage, so could only flare the hydrocarbon. Yet this 25,000 bbl/d was still less than half the amount of leaking hydrocarbon. However, by 10 July BP and other partners had designed and manufactured a much better “capping stack” which was essentially a scaled-down BOP and could be bolted on top of the original BOP. This could improve collection but also was capable of sealing the well in. On 15 July the valves were closed and for the first time since the explosion on 20 April, no oil was flowing into the Gulf of Mexico from the Macondo well. Eighty-five days, 16 hours and 25 mins of ecological disaster.

BP carefully monitored the well pressure and the surrounding seabed over a period of days to ensure that the pressure buildup was not causing fractures to the underground formation through which the contents of the reservoir could empty and find its way to the ocean floor via fresh faults and leaks.

By early August the experts were satisfied that this was not the case and the well was stable again. So on 3 August the go-ahead was given for a “static kill” to pump heavy drilling mud into the well to contain the oil and gas inside the formation by hydrostatic pressure, followed by a 1.5 km-long cement plug to seal in everything. The Macondo well was almost tamed, but not quite permanently put to sleep. Five weeks later on 19 September, a relief well started on 2 May finally reached the original well, tapping into it at a total depth of 17,977 ft, about 800 ft above the reservoir. Cement was pumped into the annulus, forming a final seal and preventing further oil and gas from leaving the reservoir. The US Coast Guard declared Macondo 252 well as effectively dead. The cleanup of the 5m bbl of oil it spilled into the Gulf of Mexico continued for many years and its legacy is still with us today.

---

This article is part of series called Deepwater Horizon: a Decade On. Read the rest of the series here

Further reading

1. National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling, Report to the US President, January 2011, https://bit.ly/3aSHtyy

2. Offshore Oil and Gas in the UK – an independent review of the regulatory regime, December 2011 (The Maitland Report), https://bit.ly/33n2QVZ

3. Government response to an independent review of the regulatory regime, https://bit.ly/33meSz2