The Deepwater Horizon Accident: What Happened and Why?

Stanford University good evening everyone welcome welcome to the first of two lectures on the topic of the Deepwater Horizon disaster and the future of drilling in the Gulf of Mexico I'm Pamela Matson dean of the school of our sciences and I'm very pleased to see you all here tonight you all know what happened on April 20th of this year an explosion on the Deepwater Horizon drilling rig and the Gulf of Mexico killed five workers and injured 17 others and the subsequent fire burned for about 36 hours sinking the rig on April 22nd it's estimated that 4.9 million barrels or 185 million gallons of crude oil spilled into the Gulf the well cap the wellhead was capped on July 15th and on September 19th finally the federal government declared the well effectively dead the national and international conversation about this however is hardly effectively dead it literally dominated the news for weeks if not months and it still continues that conversation still continues much of it concerns three different questions how did it happen and what are the long-term consequences of the spill why are we drilling there at all and what can we do to ensure that this kind of accident never happens again these questions are all questions that we will be covering in the two lectures of the series the ideas for these lectures came from several different individuals sort of independently but at the same time and it made us realize that we actually can contribute to the conversation we can add something meaningful and I think this should be a really interesting couple of days there is a change in tonight's program however our plan for tonight was to hear from to school of Earth Sciences faculty members mark zubik and Roland Horne both of whom were instrumental in the for this series but mark heard mark zubik heard late last week that he would instead be needed and be spending today in Washington DC and by now he should have already briefed the Department of Energy and the Department of Interior and the Office of Science and Technology Policy on the interim report of the National Academy of Sciences committee of which he is a member and that committee was charged with analyzing the causes of the Deepwater Horizon explosion fire and spill in order to identify measures to prevent similar accidents in the future so that that committee has some insights that are now being reported and if you're interested by the way you can look on the National Academies website tomorrow when the report or the interim report is released at any rate mark is not here tonight but he will be back here in a couple of weeks when we have the second in this series I'm very delighted that Professor Roland horn is here tonight and I'm very much looking forward to his talk Roland is the Thomas Davies Barrow professor in the department of energy resources engineering in the school of Earth Sciences he's an expert in well test interpretation production optimization and analysis of geothermal reservoirs and he is a senior fellow of both the Precourt Institute of energy and the woods Institute for the environment a member of the National Academy of Engineering Roland has received the John Franklin Karl award and the Leicester yeren award from the Society of petroleum engineers and he is their Distinguished Lecture Rowland served as the chair of our department of petroleum engineering from 1995 to 2006 and then was instrumental in transitioning that department into the department of energy resources engineering in 2006 so he's going to be taking the podium in just a moment and he'll give us his insights on what happened and why in the Gulf but two weeks from now on November 3rd you will then hear from mark zubik the oil and gas production and why we're in the Gulf how it fits in the larger resource issues and you'll hear from meg Caldwell who is the co-director of the Center for ocean solutions and a faculty member in the law school and a senior fellow at the woods Institute and she'll be talking about the impacts of the spill and regulatory reform and then at the end of that session on the 30th two weeks from today all three of these speakers Roland mark zubik and Meg Caldwell will join in a panel discussion so that that session will be a little longer than tonight but I think it will be very interesting and I hope you can all come to that this these lectures are co-sponsored by the school of Earth Sciences the Center for ocean solutions the woods Institute for the environment environment the Precourt Institute for energy and I think that that really indicates the multiple players at Stanford from many different disciplines many different perspectives who have something to contribute to these really complicated complicated issues okay well for tonight it is my pleasure to introduce Professor Roland horn and he's going to give us his insights into what happened and why Roland Thank You Pam and thanks to all of you for coming as you've heard this three-part collection of lectures includes technical issues people issues and regulatory issues tonight you get the technical issues as you've heard I'm a petroleum engineer and if you like to think of it that represents my bias but anyway you begin by knowing what my bias is I'm going to be talking about the engineering aspects of the accident in an attempt to clarify what actually happened on April 20th why do we want to do that the the reasons I'm sure is the same for all of you this is a catastrophe of immense proportion and it's difficult to get your head around exactly what happened and what the consequences of it may ultimately B and therefore Fordland forward-looking people as I'm sure we all are would like to know exactly what this all means it's clear that things will need to change in the development of oil and gas in the Deepwater Gulf of Mexico however those changes need to be made based upon intelligent interpretation of actual facts not people's jumping to conclusions or emotive responses we should do this based upon a full understanding what happens we don't want this to ever happen again and therefore we first have to understand exactly what was it that happened that we need to prevent now I'm certain there are going to be a great many lawsuits passing back and forth with as a consequence of the Deepwater Horizon incident and I would be very happy not to be the target of one and therefore I am going to state clearly here I was not aboard the Deepwater Horizon I don't know anybody who was and therefore what you will hear from me as an interpretation not necessarily the collection of the facts this is based upon a quite considerable series of sources that you see listed here talk about the momentarily and I have been through them all during the summer and up till today this is my interpretation of these individual collections there have been several investigations the House Energy and environment subcommittee conducted one in June and a very significant one is taking place even until today the joint investigation by the United States Coast Guard and the Bureau of Ocean Energy Management that used to be the MMS they are still in process now there are literally thousands of pages of testimony that took place in that investigation up to this point which is very revealing as to actually who did what and what they saw and what was happening where BP has done its own investigation which they published on September 8th their investigation report is available on the web and I have read it and you'll see quite a number of diagrams which I shamelessly stole from them in that report tonight because they're revealing in showing what happened Halliburton also issued a report or at least a PowerPoint presentation refuting actually some of what was in bp's report i'll show you some of that as well and then as you heard from pam a few minutes ago the National Academy of Engineering has an investigation which is issuing today its first interim report and it will issue a full report next next June several individual groups made presentations to that committee monk as our back is on it and I will show you some of the things that they did to in addition to that there's quite a number of issues that were associated with the spill particularly the well testing the pressure transits things like that which I was personally asked about by the government committees that were were considering the actual recovery of the situation so some of those were personal communications so tonight I'm broken my talk into four principal parts I'm going to take a few minutes right at the beginning to address some of the issues so that you can all understand what comes later I'm not going to talk first of all about the spill itself I'm going to talk about the technology and the mechanisms by which deepwater drilling takes place to emphasize some of the differences between that situation and what takes place for example in a land rig I'm going to talk about some of the questionable issues that have been discussed in the press in the TV and also in the investigations that I mentioned previously there is many of them I'm going to talk about a small number and then I'm going to talk about a still smaller number the four principal events if you like which ultimately caused the Gulf spill to happen that's our section three and finally I'll end up with some discussion about how we might do this better so let's talk first of all about how deepwater drilling is conducted and how it differs from drilling onshore and I want to draw attention to a number of things some of which I'll go to in a bit more detail the principle difference between onshore and offshore drilling is that when you are drilling onshore you have control of the wellhead directly under the rig now we're going to talk a lot today about the blowout preventer bo p bo p sits on top of the well if we're drilling a well on land it's sitting at the surface of the ground the drilling rig striveth straddles over it and they're in direct connection from one to another when you're drilling offshore that's not the case the blowout preventer is still attached to the top of the well but it's at the bottom of the ocean in this case of the Deepwater Horizon it was five thousand feet below the rig between the two is a pipe known as the riser which allows for the mud circulation down to the blowout preventer allows for the drill pipe and the casing and everything to go through the important thing to comprehend and this is really something I'd like to emphasize very strongly in my talk tonight the thing that you have to understand about the riser is it provides no mechanism whatsoever of control at the surface where it is attached to the vessel all of the control of the well takes place at the blowout preventer and between the two is five thousand feet in this case of open pipe what that means is that if the blowout preventer or the crew who are managing the well for any reason whatsoever allow hydrocarbons to enter the riser then they're coming to the rig there is no way to prevent it after the hydrocarbons and to the rosin secondly dynamic positioning the vessel in such deep water the vessel basically has to keep itself in position all of the time with some fairly exotic technology can be done in a couple of different ways the Deepwater Horizon was a dynamically positioned vessel it had motors and propellers or whatever which were continuously operating to keep it in the same location or some other kinds of vessel we have just anchored to the seafloor but even those have to pull in the anchors and moved around if they have currents and wind like that necessarily because these vessels are far away there is the issue of crew rotation it isn't something I'm going to talk about tonight but you might contemplate what's involved here the Deepwater Horizon had 126 people on board in two shifts every 12 hours they changed okay in addition every 21 days every three weeks they sent a new crew offshore and the old crew came in so there's four separate crews if you like to think of it that way bear in mind the complexity of what was being done it in fact required 62 well divided 26 and half it divided half that many people 60 odd people to continuously operate what was going on on the vessel and every 12 hours they all changed they actually staggered slightly so you imagine doing a complex task and every 12 hours a whole new set of people come in it's far out to sea so anything that you need you have to send out there it's hard to get things when you need them instantly it's difficult to access the subsurface because it's far below the water which means that anything you want to do is difficult involved in the process of drilling multiple companies I see that some of you here are old enough to remember the Apollo program you remember NASA you know when you're launching the launching Apollo 11 or whatever you've got you know Capcom go navigation go life-support go and you see those people on television one's got McDonnell Douglas on the back and one's got Boeing on his back one's got a B M on his back that's what drilling a deep water well is like there's a cementing company there's a mud company there's a tubeless company there's a logging company there's a drilling company and there's alchemy and lots of other companies - all of them have their own people there on the rig they're all doing their part of the job and they all have to coordinate collectively at the same time and finally it's really expensive the Deepwater Horizon was costing about $600,000 per day anything that was done is going to cost a lot of money any delay is going to cost a lot of money that has to affect the way people work let's talk about the blowout prevention the blow preventer separation for the rig again comprehend exactly the issue of the razor the razor is a pipe which is about this big it's 5,000 feet long okay if you from where you're sitting today if you go down palm drive the we may be at the wellhead the blowout preventer is just on El Camino that's how far away it is imagine how much fluid is contained in that volume once you get fluids into that they're coming at you you can't prevent it the well itself was an additional 13,000 feet having a retail Camino you turn right and you go down south you don't reach the bottom of the well until you hit San Antonio Road okay it's a very large amount of tubulars fluid volumes etc between you and the bottom of the well secondly I want to talk in a little more detail about the dynamic positioning you understand here you're looking at two vessels this is the drilling rig and it's it's writing on the second vessel this is how they're delivered this is not the Deepwater Horizon this is the Deepwater Nautilus which is its sister ship it's basically identical except the north was a anchored vessel whereas the Deepwater Horizon was a dynamically positioned vessel so it has on its pontoons thrusters which keep it moving backwards and forwards to stay in one position over the well the important thing about either kind of vessel but most importantly for the Deepwater Horizon which was a dynamic position variable if you lose power you're in serious trouble because those thrusters have to have power all of the time if you lose power on the vessel then you lose your ability to stay on station and something bad is able to happen in the case where you have a power failure or in it can also happen that the thrusters have insufficient capacity for example to go against the current like a hurricane hurricanes a lot in the Gulf of Mexico then you've got to let go quickly you're attached to the wellhead at the blowout preventer this is what it looks like we'll talk about it several times tonight the blowout preventer has two parts this lower part here is the blowout preventer itself the top part is the M L R P the lower marine riser package this is attached to the riser this is attached to the wellhead if you want to let go of the wellhead you actually separate the two at this particular Junction right here so you have a mechanism which separates the ML RP from the blowout preventer and then the ship can drift away right well not quite because you've got to remember the drill pipe is inside the drill pipe goes down the riser and all the way down into the wellbore the vessel cannot drift away unless you have a way to separate the drill pipe as well how do you do that you cut it off and right here is a particularly important device again is very significant to the Deepwater Horizon accident called the blind shear Ram and the blind shear Ram is a component of the blowout preventer which which cuts through the pipe and also at the same time blocks that the well it's like a steel pair of steel gates touch the pipe and closes over the top of the well then allows nothing further to come out of the pipe finally the remote location of the seafloor one mile below the water will never be touched by a human hand or everything which is done on the seafloor has to be done by remotely operated vehicles like this one here they don't have a person inside them they're actually controlled from the surface they play a part in this story - all right my second topic a series of questionable issues these are all the things that you heard about on television and when we were preparing for this talk this is a list which I which I discussed with Megan mark I refer to as a sequence of yellow lights if you are driving again on El Camino and the light turns yellow you have to make a decision these are decisions which needed to be made in the process of drilling this well and there was a lot of assumptions made in the press about you know whether risks were being taken whether safety was being compromised all of those things these are the kind of decisions that you take every day you're driving along the road the road traffic light turns yellow are you going to hit the brake or are you going to hit the gas okay and either one could be the wrong decision if you're really close to the intersection you're better not to hit the brake because you know you might lose control of a vehicle you might slide into somebody whatever better to hit the gas but this sequence although many of these things discussed a great length in the press and on TV some of these had nothing in the end not very much to do with the accident at all but if you put them all together what you will see is that what they represent is a group of companies that basically hit the gas a lot rather than the brake okay I don't think I'm going to go through all I mentioned a couple of the long string there are different ways to complete the well the long string is one it is the cheaper of the two alternatives the more expensive one is a liner and tie back some companies in the Deepwater Gulf of Mexico always use liner and tie back other companies including the companies involved here more commonly used a long string it takes less time it's cheaper to do but the difference between the two is that the long string as has only two barriers to flow whereas a liner and tie back has three it's not to say that the long string is unsafe it just has one less degree of safety than the others there's a lot of discussion about the lockdown sleeve the when the casing is put in place there's a sleeve that locks it in place so it doesn't float out of the wellhead there was a great deal of discussion and technical hand-wringing about whether or not the casing had actually floated out of the blog preventer which prevented it from working the fact of the matter was that they were ready to install the lockdown sleeve but they actually hadn't done it at the time of the accident we'll talk about the cement design that plays an important part here to the design of the cement job was intended to ensure that the well the casing would be sealed from the formation so hydrocarbons couldn't enter there were several reasons that that was difficult for this particular well it was a relatively large casing in a small hole which means effectively not very much cement there's a question about the number of centralizers that were used which may have affected the ability of the hole to be sealed by its cement and finally there was no cement bond log run a cement bond log would have been used to determine whether or not the cement was actually adequate negative pressure test was a mechanism that they used to decide in a whether or not the well was safe before they continue with the operations that they were doing it's a standard practice to perform in the industry and yet quite remarkably I was astonished to learn this from the testimony there is no standard procedure published in the industry by which a negative pressure test should be conducted or interpreted people who do them and interpret them do it based upon their experience people have discussed whether or not this negative test was done too soon after the cement job that perhaps the cement hadn't yet set there's an important issue associated with the fluids that were in the hall at the time of the negative test which in fact probably contributed to the difficulty of its interpretation whatever it was the interpretation of the negative tests by the by the crew or the people on board turned out not to be correct fourthly one of the most important things in drilling a well is keeping track of fluid volumes you have a circulating system down the drill pipe and up through the casing and the riser if you want to be aware which you always do of whether or not the well is flowing hydrocarbons in you keep careful track of how much fluid you put in and how much fluid you take out as long as those two are the same you know that there's no fluid actually entering from the formation and therefore they watch them all of the time but in this particular case because of the fact that the negative tests suggested that the well was all sealed off and because they were getting ready to move off the well they were in the process of unloading the the cement tanks onto another vessel to move it off somewhere else so that made it very confusing to keep track of the pit volumes net consequence was they got hydrocarbons in the well bore and ultimately because they hadn't understood that that was the case those Hydra Cubs entered the riser so as I mentioned Hydra comes in the riser means they're coming on board okay once you have Hydra comes entering onto the rig floor there was a number of they could choose to do with them they could have diverted them off over the side or they as they actually did divert them through the separators what that meant then was instead of going into the ocean the hydrocarbons came onto the rig the oil the particular which is found in the formation penetrated by the Deepwater Horizon is a very gassy oil so as the pressure is lowered it evolved a great deal of gas so those gas on the rig floor gas entered into the engine rooms of the vessel that we're providing power the engines over sped and in doing so the engine this is electrically different driven rig the engines over sped they over sped the generator they produced a gigantic amount more electricity than the rig was designed to take people described computer monitors exploding light bulbs exploding all around the rig as a consequence of that that provided a source of ignition the gas around the rig exploded the blowout preventer is designed to recover from any disaster such as that the entire purpose of the blowout preventer is to shut the well so that in the case of accident hydrocarbons are not released into the ocean or anywhere else in the process of the blowout the crew closed the blowout preventer all of you who know what a blowout preventer is who watched this on television when it happened the first thing was why didn't they close the blowout preventer well they did they closed the Brooke blowout preventer very early however it didn't seal the well as I mentioned to you in the case of loss of power you have to make this emergency disconnection between the LMR P and the blowout preventer it's a so-called Deadman switch they had two ways to activate it one is that the crew on board can press the button let go get out of here now or it has in the case of loss of connection power hydro and communication electrical signals if all of those are cut the device automatically does an EDS emergency disconnect shears the pipe and let's go of the razor that's what it's supposed to do it didn't okay that's the automatic function and then finally even then there was another line of of recovery the blowout preventer itself could be activated by the ROV the submersible little submarines they had those are Ovie's in the water within 12 hours of the accident it wasn't the Deepwater Rosen's ROV but they brought in another one and they attempted to activate the blowout preventer to close the well that didn't work either so my third topic this the list of things I told you about that list of yellow lights and the fact of the matter is actually there's rather more than I listed I just told you about some of the ones that were discussed a lot in the press and on TV this is my interpretation these are the four things which basically caused the Deepwater Horizon catastrophe and importantly the thing to note here is that if any one of these things had not happened none of this would have happened okay for for you to see what you saw daily on television all four of these things had to happen and they did first of all the hydrocarbons had to enter the wellbore they weren't supposed to do that they're sealed off by the cement and they're sealed off by the casing itself so first of all the cement failed and secondly the casing seal failed so hydrocarbons were in the wellbore Hydra Cubs were heading for the surface the people on board had the mechanisms to recognize that fact however they did not because of that they didn't activate the BA prevented the hydrocarbons in the wellbore entered the riser and once again you understand once the hider comes are in the riser they're going to come on board thirdly hydrocarbons on board don't necessarily mean an explorer in a fire but in this case the hydrocarbon gas found an ignition source it blew up and importantly in the process of blowing up took away the source of power of the rig once the rig had lost power it lost its ability for dynamic positioning and therefore it drifted off station and finally the blowout preventer none of those things ahead would have mattered if the blowout preventer had closed the rig would have been in a very serious situation however had the blowout preventer not failed the spill that you see would not have happened so let's go through these one by one starting here with the cement job and I'll talk about this diagram on the right in bigger picture in a few moments there isn't currently agreement about why the cement job failed the cement job was designed and and processed by Halliburton Halliburton was a cementing company BP was actually in control of the job saying how it was going to be done they perhaps understandably disagree on who caused the problem I'm not intending tonight to talk about who is the blame for anything so you can make your own decisions about that there is however no question whatsoever that the cement job failed there is no other path for the hydrocarbons into the wellbore except going through the cement that was supposed to have blocked it so let's talk about that cementing is actually a lot more technical than you might think it's not just a matter of mixing up some pen some cement and squirting it in the hole it's a lot more technical than that what you see here at the base of the casing bear in mind that what they had done just before the accident a couple of days before was to run the final length of casing the so-called long string the base of the of the casing is this device which is cool called the shoe track and float collar and if you imagine that you're going to put a pipe into a small pipe into a bigger pipe and cement it in place you have to run that pipe down 18,000 feet into the ground you can't run a sealed pipe ultimately the pipe has to be sealed but you can't run it into the hole sealed otherwise it would float okay so this device is called a float collar for that reason it actually has an opening in it like a ball valve you see it right here this green pipe when it's running the hole sits in this gap right here allows the mud in the hole to pass up through into the casing so the casing can be run in at that point they're going to inject the cement down through the casing it runs out through the base of the casing shoe down here and back up this the hole you see it over here on the right the cement comes down goes around and fills in the gap between the casing and the hole sealing off the formations now after the cement is in place you don't want fluids to go back up the hole like you do when you run in the casing therefore this float collar has to change its function from allowing fluid to pass up to stopping allowing fluids from passing up its so-called conversion and the way that they do that is they pressure up on the up side of the casing they blow this fill tube out of this space and there are flat valves in here like the ones you see on the top of an exhaust of a big truck and they spring closed and prevent any fluid from flowing backwards up through the casing now they had some problems with this the float collar is supposed to convert at about 4 to 700 PSI they increase the pressure of the pipe and blow it out but they couldn't do that they try to nine separate attempts to convert the flow collar and ultimately they pressured as high as 3,000 psi that's important because down here in the formations themselves what you can see is that we have the ability to transmit pressure from the inside of the casing out through the bottom of the chute and against the formations if you pressurize against formations then you can fracture them and if you fracture the formation then you have the ability to lose fluids and in particular you can lose the cement and that therefore loses your ability to seal secondly there was a very small window of pressure I talk about that in a moment this was a very delicately designed cement job if you have a very high gradient of pressure caused by heavy cement you can actually fracture the formation simply by the hydrostatic pressure of the of the cement itself so they had to use light cement and in order to do that they nitrified the cement they basically phoned it with nitrogen to lower its density so it wouldn't exceed the fracture pressure of the formation and nitrified presh nitrified cement is a it's a it's a high-tech operation if you like to think of it as such it isn't very commonly applied at these kind of depths in the Gulf of Mexico although importantly it has been this wasn't the first time anybody had done this but it's the kind of thing that you might imagine is a possible source of problem in fact one of the two parties insist that it was the other ones insist that it wasn't the well itself had lost circulation zones already during the construction during the drilling they had been losing fluids earlier in the process there was the potential that the cement wouldn't go into place could be lost into the formation and there's finally the issue about the centralizers and let me talk about that in a moment and ultimately whether or not the cement job was good a common procedure to evaluate whether or not you have a good cement job is to run a log a measurement which determines whether or not it's been completed successfully in this particular case the logging crew to run the cement bond log was on board with their devices and they were released and sent ashore without the cement Bob log being done they chose not to do it okay let me just talk briefly about the pressure windows I mentioned this is the reason why they use nitrified cement which is or was kind of a delicate solution one of the characteristics of the Deepwater Gulf of Mexico is that the fluid pressures in the formations are extremely high and as we go down into the earth they increase apps like hydrostatic or somewhat less than that we have two pressures we have the pressure of the rock and we have the pressure of the fluids inside of the rock okay the it's the pressure of the fluids that are high in the Gulf of Mexico so called geo pressure what that means is that you have to have a sufficient pressure inside of the wellbore to hold back those reservoir fluids the hydrocarbons but the rock pressure isn't very high and that means if you push too hard on the rock you are going to fracture it and have a problem the window between those two pressures is extremely small in the Gulf of Mexico in general which means the margin for error in the weight of the cement which gets injected is very small okay now this is a slide which I took from the Halliburton presentation I changed the words very slightly because they're accusing somebody else and I took the name of the person who accusing out we're interested here only in the technical issues there's the issue of the centralizers now in advance of running the cement job that they had designed Halliburton determined that the process of centralizing the whole the you can see that the image up here if the pipe is not in the middle of the whole cement is not a Newtonian fluid it tends to move into the larger spaces so therefore if you have a pipe which is not centralized the cement moves into the larger space and leaves a gap on the other side that means the formation is not sealed in order to prevent that from happening the pipe has kind of little springing things on the side that hold it in the center of the hole they're called Sandra lasers they had six on board this particular casing string which had been designed and put in place already and based upon the design Halliburton did in advance they determined that that was likely to cause lack of centralization and channeling which is what you see up here leaving gaps in the cement they determined that they should be 21 centralizes to prevent channeling from occurring and that was a design that they delivered there were only six centralizers on board so they ordered and out of fifteen fifteen centralizers were sent but they were not installed okay thus fifteen centralizers remain on the deck the string was run with only six which halliburton's simulation suggested in advance would cause channeling this is what it was supposed to look like over here on the right okay now that's the cement even with failure of the cement the casing is supposed to be closed okay so even if in the annular space around the casing you have hydrocarbon you still have a seal that prevents it coming into the wellbore there are two places where it's sealed one is the casing shoe itself and remember the casing shoe is now filled with cement and it's a hundred and ninety feet long it's 190 feet of pipe filled with cement at the top of the casing is the seal casing seal which is basically rubber rings and whatever which sit up here just below the blower preventer stops the flow of fluid up the back and into the riser either one of them have to fail before we can get fluids actually going up the casing a lot of discussion about this this particular slide comes directly from bp's report and these are the reasons why BP believed that it was the casing shoe that failed and not the casing seal and i have spoken to people have seen the casing seal actually after they finally took the blowout preventer off and it appears in fact as if this explanation was the correct one it looks very much as if quite remarkable it might seem the hydrocarbons actually enter the casing through the chute track down over here it's actually this scenario that they put in their report truly astounding in order for that to happen the hydrocarbon had to go through 190 feet of cement or what that means is that oh sorry yes 190 feet that 190 feet had to be damaged in some fashion he had to get past the two flapper valves which is sprung back into position after the the float collar had converted what happened well ultimately we don't know we have to remember that difficulty they had converting the float collar they had to raise it up raise it up to 3,000 psi it seems likely that that was the source of the problem but unfortunately we will never know because right now that float collar is cemented in the bottom 18,000 feet below the sea and nobody will ever see it we won't actually know the answer to this question however it is clear that one or the other failed hydrocarbons entered the wellbore number two up at the surface they were conducting the negative tests to ensure the integrity of the casing and the cement before they've got ready to complete the rest of the well they did it twice and both times accepted it as a successful tap test I mentioned to you previously that there isn't a standard procedure so therefore they didn't necessarily have clear guidance as to whether it you know what it should be in order for it to be successful I mentioned to you that as a second level of monitoring the well they could take account of what flowed in and what flowed out that was made confusing by the fact that mud was being unloaded off the vessel at the time now let me talk come down and talk about this confusing mixture of fluids in the wellbore and I'll show you a picture in a moment and funnily enough this is actually how I first got involved in taking interest in a Deepwater Horizon because a woman called me reporter from the LA Times in late April and said well is it normal for companies to be injecting lost circulation material she named these commercial trade names here into a well and I said of course it is they do that all the time they they do that to prevent loss circulation of the mud however I subsequently was astonished to learn that isn't what they were doing with this lost circulation material and although this is not by itself what caused the the accident to me this is this is not necessarily the smoking gun but anyway there's certainly a strong smell about this after they finished the negative test they moved on to the next stage of the job which was to circulate the mud out of the hole they displaced the mud out of the hole with water so they could get ready to disconnect the riser and sail away they can't disconnect the riser when it's full of mud otherwise all the mud goes into the ocean in order to separate the mud from the water they've circulate with seawater they use a spacer which is a kind of a viscous material which stops the mud and the water from mixing in this particular case however they happen to have on board 400 barrels of lost circulation material that they had mixed in preparation for difficulties they'd had further up in the hole and you heard about you know the well from hell or whatever they called it on the television they'd had difficulty with this well they had losses of circulation they tried to fix they had 400 barrels of this stuff that one of the people in testimony referred to as like snot that lost circulation materials gooey sloppy stuff that's supposed to bug up holes and they had to get rid of it now this material is a is a material a dischargeable material it's allowed to being discharged to the ocean because it's water-soluble however it couldn't by regulation be discharged to the ocean unless it had been used in the process of drawing the well so they used it okay the original design that was approved by the mineral Management Service for the circulation did not approve this particular use of this material they did call for a spacer of about 100 barrels this is a whole lot more and it's a whole lot heavier gooier stuff this didn't cause the accident however it made very things very confusing for the negative tests let me show you here's the mud filled well and they're circulating through the drill pipe that blew here is water and there's pushing the mud back up towards the surface here is the spacer which was separating the two they're putting the water in the in the well to make it lighter so that it has a lower pressure than the formation if the if the seal is intact it won't allow flow into that lower pressure so they pumped the spacer up above the bark preventer and they closed the annular valves right here in the blowout preventer so that this heavy weight of column of fluid didn't sit on this on this inside of the well and it lowered the pressure the the annular valve but the annular RAM on the blowout preventer didn't seal properly and that caused the space at the flow back down into the well and remember this is a very big space of four times what they normally would have used 50 barrels flowed back down into the well and at that point the spacer was sitting in the blowout preventer so what happened next when they did the second- test they had pressures that they weren't comfortable with in the first one that they measured on the drill pipe the specification of the negative test said they were supposed to monitor the pressure on the kill line the kill line is a smaller pipe here on the side which comes below the blowout preventer allows for control of pressures inside of the casing so they monitored the pressure on the kill line and it was supposed to be static and at zero pressure that's actually what they measured but in fact because they had flowed this funny snot like spacer down through the blowout preventer it once it was pressured up we don't know this this is speculation here it flowed up through the kill line and did something either the weight of this very heavy material it's almost twice as heavy as water either the weight of it caused the hydrostatic pressure gradient or maybe it simply blocked it it's a very viscous material so what they saw at the surface in the second test they had 1,400 psi on the drill pipe they had zero on the kill line these are connected there's no blockage anywhere between them and therefore they should have been the same they were not that the piece of paper they had for the negative test said they should have zero pressure on the kill line and it should be static and it was that's why they accepted it but you can recognize from here this disparity between the pressures was a very significant uncertainty that you know should have at the time in fact was at the time be called into question all right now this is kind of complicated but I promise to you it's worth understanding what you're looking at here is a record of the pressures and the flows from the cementing unit which was operated by Sperry Sun you hear this talk about in reports as this very Sun record and these the cementing unit actually transmitted its information to shore and therefore this was recorded in Houston the rest of the there were other units which measured these things but they were basically lost on board what you're looking at here is basically there's a prude a film of the Deepwater Horizon accident this actually shows what happens and we could see what was taking place actually in the last hour of the job so after they did a negative test they started displacing the spacer as they came towards the service what you see here is the injection of the water in yellow this big yellow band and the red one is what comes out I was coming back out of the razor they're not exactly the same measuring the flow rates is not that accurate that's why the pit volumes are important but they're basically consistent they have material balance what came in was the same as what went out at this point it started to get confusing because they were sending mud overboard and that mud passed through the flow outline so at this particular point the difference between the N and the art became confusing at least on the cementing unit what you do see here is that the drill pipe pressure began to increase and it's not supposed to have been doing that because they were lightening the column of fluid in the riser drop by pressure should have been going down this is the first indication that the well had started to flow this is 9 o'clock 2100 once the space have reached the surface they shut in the pumps but you'll notice here that the flow line continued to flow out whether or not that's because of the trip volume or not it's not particularly clear at this particular point they rigged up to discharge the spacer overboard and therefore after this we have no further vision of the flow out that's not what the driller sought this is what the cementing unit saw because the diversion was between the two the driller could see the flow out but we cannot because it's not recorded here they began once they were sure that they they had no oil-based mud in the spacer they started discharging it overboard at this particular point and again you'll notice that when the wells were was shut in the drill pipe pressure was rising again it's flowing in here okay let's move to the right so they continued the displacement with seawater they raised the spacer all the way to the surface they discharged it overboard and at this particular point they stopped because they reached there were they got water back servus now what you see the drill pipe pressures increasing very rapidly and again that's not supposed to be happening the well it was nominally sealed so with the pumps shut off they had a strong increase in the drill pipe pressure again a third indication of flow now after this point it's not exactly clear what happens because although there's a lot of testimony from people who were making phone calls etc through here after this point we don't really know all that much this point here is simulated by bp's investigation we don't actually know this for sure but this is the point where they calculated hydrocarbons entered the riser and let me remind you for a third time once the hydrocarbons come into the riser they're coming on board so let's look at the last little bit this is 2149 this is when the explosion happened this is just about 10 minutes this is where they calculated the hydrocarbons entered the riser right here about two minutes later mud shot out of the drill floor now the only mud in the hole was below the drill pipe everything else had been displaced with water there's no way for mud to be coming out of the rig floor unless it came from deep in the well okay it furthermore shot up to the derrick top there's significant amounts of fluid coming out it was lifted by the gas that was coming out of solution there was a phone call between the rig floor and the the offshore installation manager that's the guy in charge who said that well is blowing out and we're shutting it in now what you see here is that the drill pipe pressure began to go up because they closed this is speculated they closed the annular but it didn't go up as fast as it's supposed to so again the speculation is that the annular was leaking and remember that's what it did in the first negative test and ultimately what they did here is they closed a second component of the blowout preventer there are seven Rams that can close the well so then the drill pipe pressure went up very substantially however by this time there serious stuff going on the gas was discharging onto the well onto the rig they had gas alarms the engine over sped the explosion and and 11 people died so Hydra Cubs coming on board it's not necessarily you know the end 11 people already killed by that it was the ignition you know Hydra comes on board doesn't necessarily mean a fire had they diverted the hydrocarbons overboard which would have been a spill then they would have had a little more time they had closed the blowout preventer the only hydrocarbons that were coming their way were in the riser the well itself was not flowing once the riser had discharged then that would have been the end of it but as I mentioned to you the engine intakes drew in the gas they over sped and they basically exploded the electrical devices on board causing a loss of power this is a simulation from BP saying where the gases were and here this is a picture again this is the Nautilus is a picture that mark took these are the intakes of the of the engines there are six two of them were actually running at the time drew the gas into the engines and that's what caused them to over speed BP made this observation in their report and I quoted it because I didn't want to say the words any differently their conclusion was which is completely I think evident from the testimony that the hydrocarbon entry into the engines caused the explosion there's safety devices to prevent that from happening however they were not automatic the safety of devices issued the gas alarms and it depended on somebody to actually shut them off they had automatic governor's on the motors that stopped them from over speeding but the governors of course to shut off the cut off the fuel they don't shut off anything else the fuel was provided X through the air intakes of the engine and the governors were not functional last is the blowout preventer okay now the blowout preventer is like a crash helmet safety belt and airbag all at once it's supposed to stop anything bad from happening it can be closed in many different ways they can close it on the rig floor with the hydro hydraulic pressure they have the emergency disconnect system which they press a button and it automatically disconnects cuts off everything they have the Deadman switch the AMF automatic mode function which in loss of communication to the rig automatically shuts it off let's go the ML RP closes the blown Sheeran ceiling off the well and if all of those fail they have the capacity to do the same thing with the ROV okay so these next two slides I took directly from bp's presentation because they show this very clearly remember at the end of the sperry sun record they had closed one annular and they had closed a variable or ram so at the end of the what we saw last the annular up here on the LM RP is closed and they also have one of the variable Rams closed these are closed around the pipe so the annulus doesn't allow flow up okay now what happens was explosion and fire the annular valve here is the annular Ram is actually closed by hydraulic pressure once they lost hydraulic pressure on the rig then the annular slowly open okay no problem they still had a very ballboy ram which was closed right here so the well is sealed at this point now remember that the vessel is dynamically positioned then it has lost power and it's subject to the current and the wind it drifted off station it's connected still here to this wellhead so what happens it was 5,000 feet up at drift 500 feet off station what happened then is that the drill pipe actually is pulled up through the blowout preventer the drill pipe has wider sections called the tool joints where they screwed together pull the tool joint through the very bora-bora and forced it open now the well is open to flow okay and it continues then to fill the riser and go up to the rig okay so this is the condition they were in when they abandoned the vessel so after that now they head down there with our Ovie's the ROV is attempted to do a couple of things the first thing they wanted to do here was to cut this pin this is a non electronic device that simply when they left off the ML RP it pulls out this pin causes the blown shear Ram to close so they wanted to simulate that they cut it with a grinder with the ROV so they shared that off and then what happened the the blowout preventer has its own hydraulic power there's these accumulators it closed the blinds year round but it didn't seal the well they had a number of other things that they tried to do but they basically did not work and the important thing to recognize in all of this in spite of the fact that there were seven elements in the blowout preventer to close off the well six of them only worked in the annular space or five actually the blind shear Ram was the only one actually that they could use in this circumstance to close off the well it had to work it was a single mode of failure if I back up just a second underneath the blinds here am is a casing shear ram which also has the capacity to share off the pipe but it doesn't seal the well and I have not seen testimony in any circumstance where anybody has discussed trying to close the casing shear ram and why that is I actually don't know so why did those things fail once they lost communication to the rig the automatic mode function was supposed operate it was supposed to release doing EDS and closed the well why did it not it had a duplex function there were two separate control systems that were supposed to cause that to happen if one of them failed the other one was supposed to make it work the infamous blue pod and yellow pod you heard about them a lot the blue pod had a flat battery it couldn't function the devices the yellow pod had a good battery although one of them was not so good but one of the solenoid valves used to close the blind she ran was not functioning they activated it once they got it back to the surface it did not work so neither of the two pods was actually capable of operating the blind she REM how about the ROV s the RVs have robot friendly knobs on them that they can turn them you know from inside of the vessel they can attach to the blowout preventer and provide hydraulic pressure and activate the Rams using pressure from you know external to the blowout preventer they didn't work because there were hydraulic leaks on the blowout preventer and the reason this picture is green is because they pumped green hydraulic fluid into the blowout preventer and what you see is that the green fluid completely surround it so basically they had no capacity to operate the Rams from the ROV why they did you know once they cut the auto ship in why did the blind shear em not cut the pipe well it turns out that the blind shear Ram only has the capacity to cut drill pipe it can't cut anything bigger than a drill pipe it can't cut a casing and it can't cut a tool John so when a well is normally drilled they call it spacing the pipe they always space the pipe so the tool joints are not through the block preventer otherwise they wouldn't be able to close them this was in a completely uncontrolled situation they don't know what was actually in the blind when they tried to close it they will find out I guess quite soon what do we learn from this how do we imagine doing things better there's several people involved the Bureau of Ocean Energy Management used to be MMS that's the government there's the US Coast Guard which is in charge of vessels offshore American Petroleum Institute is a as an industry body if you like there's the flag state the Deepwater Horizon was registered in the Republic of the Marshall Islands and in principle was not an American vessel at all Republican Marshall Islands it has an office in Virginia actually registers and certifies the vessel boem well these are their suggestions they made these suggestions the National Academy investigation you know they're going to post safety alerts on their website they do have some substantial suggestions in here one of them is that the cementing program should be certified by a registered professional engineer well you know that's a good idea however importantly here the cementing program was in fact seemingly adequately designed but it wasn't actually installed the way that it was been designed and finally they're going to take a lot more care in examining the blowout preventers the API the industry group has a lot more substantive suggestions what they're going to do I won't go through these one by one but some of these that you can see we've actually talked about tonight they insist that the lock ring on the casing should be installed as soon as the casing goes in there should be two independent barriers to flow the negative tests should be run in a specified manner the blowout preventer should be closed when they're circulating under balanced fluid columns that isn't what was happening here they can circulate without having to keep the blowout preventers open they can circulate through the kill and in the boost line last one here's important one make sure that whatever in the bore of the blinds here Ram is something that's actually sharable and again I remind you that underneath the blinds here M is the second round which can share anything that's in the pipe whether it's a tool joint casing or whatever why that was not used here is not clear at all test the blowout preventer before it's put on the ocean bottom and continue to test it when it sits on the ocean bottom make sure that the ROV has sufficient hydraulic power to actually operate the Rams they couldn't do that when they first went up to this well of the ROV they had to bring in extra accumulators to try to operate the Rams one of the strangest ones right here this is a little story the ROV that they got on site the next morning within remarkably six or seven hours had a receptacle not represented by API 17 H it had a 17 D receptacle and therefore it wasn't compatible with the ports on the BRP they had to bring in converters to change to seven teenagers okay these are my suggestions based upon what we've been talking about tonight this dependent on a single device that one blind shear Ram had to work to prevent this accident from happening let's put another one on okay this stack is 50 feet high standing in the corner it will go all the way up to the ceiling stick another one on and have it independently activatable in the case of an emergency you can always close it in Norway and in Brazil they have a third mechanism to operate the emergency disconnect it's like a audio clicker like you have on your TV they can send a sonar signal in the water they can do it from a vessel on the surface which causes the activation of the emergency disconnect big difficulty they had in a Deepwater Horizon they couldn't tell what the status of the provender was they didn't know which rams were open and which ones were closed it should surely be possible to make that visible in some sort of position indicator so that the RV's can see it we saw this very Sun data just by chance because the cementing unit was still happy to be transmitting but normally that was not the case but it should be it's like the what I call it the black box on an airplane we should have this information going ashore all the time so that whatever is happening can be seen everywhere final point I promised you four but I've actually got five I've stopped in two minutes I promise why don't we just give this all that way should we take the risk of all of this well the point of the matter is that the Gulf of Mexico represents 30% of the US oil production currently 80% of it is from deepwater wells like the one that the Deepwater Horizon was drilling there for one quarter of all US oil production comes from deepwater oil fields if we stop production from deepwater oil remember that the US imports half of its oil so deepwater oil production is one-eighth of our oil production one eighth of you have to stop driving if we are going to abandon the Deepwater Gulf of Mexico you can say well let's get the oil from somewhere else get somewhere else in the world the fact of the matter is there lots of other places in the world which are now producing from deepwater West Africa Brazil and other places too a lot of the new oil Bev discovered in the world is in deep water in other places so if we have to do it can we do it safely in the last 10 years there have been 8,500 wells drilled in the Gulf of Mexico about 2,000 of them in deepwater so how many of those wells actually caused a major accident well actually there was one and you'll notice I didn't say only one because don't want to imply that one is just a small number it shouldn't be one even out of two thousand it needs to be none out of two thousand and what we need to learn from this accident is how to prevent this ever happening again so with that I'll conclude and thank you very much we have time for a few questions if anyone has some there are microphones on each side of the room certainly I've learned a lot from your talk but I was curious from what I know is from 60 minutes where they interviewed someone who claimed that the annular had been they seal the RAM had been broken during a test a few weeks earlier and pieces of rubber had come up through that riser just wondering if that what that means in the context of your explanation yes that's correct I they there was a lot of testimony about that also the it's not clear why the annular didn't properly seal the well and it happened twice once during a negative test and secondly later on that could have been due to damage to the annular earlier in the job and the the difference between the the blind shear ram and the annual the an is like an inner tube it's pressurized with hydraulic fluid and it seals like a doughnut around the hole so it's rubber and if you pull things through it can get broken the blind shear Ram is steel cuts they're different kind of device all together so stripping something through the annular actually risks damaging it and there is in fact testimony that that happened there were however two of them there were two annulus why they continue to use the one that was damaged or if they knew which one was damaged I don't know one of oh my turn over there and then here okay when you when you began your talk you discussed the fact that there were twelve hours on in twelve hours off as if that were an unusual event and there are tens of thousands of jobs like that critical jobs the US Navy runs that way all kinds of power plants refineries you you overlap for half an hour and you discuss the issues and you I think you know what you're doing so that was my one criticism yes you're quite right I didn't intend to imply that that was unusual in any way but you recognize the difficulty of conducting a complex operation when you have to pass a complex task to somebody else every 12 hours and you're right it's done successfully in a significant number of of situations and in this particular case it doesn't seem to have caused or increase the the damage of the accident at all but it was one of the things that people talked about as being a potential source of difficulty which I didn't think it was one of the things that you glossed over was the logging issue you said that the logging team was sent home who made that decision to send them home well I don't know who they were I mean somebody on board who was in charge of the job had a tree died decision tree diagram and it's given in evidence it's exhibit on the website I showed you and according to the decision tree they said if they had full returns on the cement job and if the the pressure test was successful then a cement bond log would not be required and based upon that decision they sent them away and they is BP they is Halliburton they is who's they the the people in charge of the job if you read the Testament you'll see who it was I'm not going to say it here oh okay my second question is of this Ram Shearer you have this this huge amount of annular material you have this casing and you have the the well pipe and something shears that off and and all of us know if we have a hacksaw it's really hard to get through that stuff how do they how does that Ram work how do you get to bust through all that and seal off they push it really hard it's like it's like a pair of scissors basically or tin snips if you like when you'll cut it I mean you can cut metal with tin snips because you have a large amount of leverage and it actually shares the metal it doesn't cut it like you would paper it actually shares it through and a shear Ram works the same way it's like to knife edges which are at an angle so they basically hit it here and they hit it here and they push it up just crimp them she sort of a crimp job exactly like it it pushes the two parts apart yeah so the RAM didn't work this I was wondering what was the success rate for those it was a how was it before like say how many times was success it does this happen all the time the the blind shear Rams are designed specifically for this purpose and they are tested you know in design and in you know initial construction to do exactly this they're tested for that function so in principle you know the answer is no it doesn't help very often again I will make the comparison to seatbelt and and airbags I believe in my car if I run into a brick mall walled at my airbag and seatbelt are going to save me but I've never tried them okay and I probably won't however important it's important to note that about 12 months ahead of this accident or whenever Hurricane Ida was ADA at 2009 the Deepwater Horizon actually EDS during hurricane Ida they actually pushed the button release the ML RP and shared the drill pipe so they had done exactly what this thing was supposed to have done successfully about you know within the two years prior up there's two more here this goes more to the overall issue of development out there in the Gulf or anywhere else I guess in the offshore as I recall it was said that the Santa Barbara Channel spill in 1979 involved hydraulic fracturing to the surface outside the well is that something that has been observed in the the Gulf area and are there means at hand of combating that yes the the Santa Barbara spill was actually rather different it was it was a sort of equally horrible result but the causes of it were quite different in the case of the santa barbara's build a well itself failed so it was a casing failure after the well was in operation in terms of fracturing of the surface formations that allow Hydra cubs to come to the surface they as I mentioned the difference between the fracture gradient and the pore pressure in the Gulf is actually quite small however you got to remember this is 13,000 feet below the seabed unlike the Santa Barbara Channel which is much much shallower so the kind of accident that happened in Santa Barbara is probably not very likely in the Gulf of Mexico there are I actually don't know but I would say tens of thousands of operating wells in the Gulf of Mexico remembrance it's one quarter of our total oil production largely with safety Hurricane Katrina there are 3,000 structures in the Gulf of Mexico Hurricane Katrina wiped out 80 of them how much oil was spilled none yes one more question you said that you know for very unfortunate things happen in order for this to actually make the news and if only three had happened it would have been costly but probably wouldn't have made the headlines how often are there close calls and is anybody monitoring that I don't know the answer to the first question but the answer to the second is that the anytime that there is an incident on a rig it's required to be reported to the mineral management services so for example a Deepwater Horizon reported six spells to the mineral management services in the 12 months prior to the event with a total of 10 gallons of oil put into the ocean so they're required to report anything that goes overboard at any time we'll get back to that issue I think in a couple of weeks when meg Caldwell speaks and Mark so Beck and Roland will be back then so join me in thank you for more please visit us at stanford.edu

Channel: Stanford

Views: 398,929

Keywords: Environment, Earth Science, Petroleum Engineering, Marine Life, Ecological Disaster, Ecology, Biology, Gulf of Mexico, Gas Production, Oil Rig, exploration, energy resource, leak, BP, spill, investigation, off-shore drilling, energy, hydrocarbon, Riser

Id: aN2TIWomahQ

Length: 81min 9sec (4869 seconds)

Published: Tue Nov 23 2010