BP is incompetent. The facts are even worse than you imagine. BOP valve was leaking, defective, installed wrong, and too weak to function in the first
Climate Progress
Stupak stunner: Oil well’s blowout preventer had leaks, dead battery, design flaws, “How can a device that has 260 failure modes be considered fail-safe?”
Coast Guard Captain slams industry "self-certification" of BOP: "Manufactured by industry, installed by industry, with no government witnessing oversight of the installation or the construction." And the rig flew the Marshall Island flag to further escape U.S. oversight
A senior House Democrat said that the blowout preventer that failed to stop an oil leak in the Gulf of Mexico had a dead battery in its control pod, leaks in its hydraulic system, a “useless” test version of one of the devices that was supposed to close the flow of oil and a cutting tool that wasn’t strong enough to shear through joints that made up 10 percent of the drill pipe.
That’s the lede of the WashPost coverage on the devastating opening statement by Rep. Bart Stupak (D-MI) in a hearing of the House Energy and Commerce Committee.
It simply becomes more and more astounding that BP ever called this blowout disaster ‘inconceivable,’ ‘unprecedented,’ and unforeseeable. It was quite literally an accident waiting to happen. A 30-second video of the undersea volcano finally released by BP is above.
You can read comments by the Coast Guard on how the rig minimizes regulatory oversight in the WP piece and also at Nola.com, which reports:
The Coast Guard inspections follow up on the monitoring done by the classification society for the flag state. Gifford said the Deepwater Horizon used the Marshall Islands’ flag as a “flag of convenience” so it could comply with that country’s standards, and not the U.S. regulations.
The Nola.com story relates more shocking testimony from the Coast Guard and MMS:
Summarizing testimony by Mike Saucier, a regional supervisor for field operations for the federal Minerals Management Service, which oversees offshore drilling, Capt. Hung Nguyen said:
“So, MMS approves the design of the well, but they don’t check what type of pipe is used. And we have a study some time ago about whether a shear ram would cut a certain pipe (to shut off a well in an emergency), but we don’t know what was installed here. I don’t understand that.”
The testimony from Saucier established that the government agency he works for doesn’t do any certification of blowout preventers, the massive devices that are supposed to be the final cut off of an out-of-control well. Saucier said most of the action MMS has taken to control blowout preventers has been through “notices to lessees,” letters that go to drill operators but are not enforceable.
“We have self-certification of critical equipment and safety notices that are not enforceable…” Nguyen said, digesting the testimony before tailing off, pursing his lips and moving on to his next question.
The panel of three Coast Guard officials and three MMS representatives also appeared disappointed to learn from Saucier that tighter rules for monitoring deepwater drilling safety systems were proposed nine years ago, but got lost in the shuffle and never were adopted.
Saucier said new rules were written in 2001 to require secondary control systems for blowout preventers, the stacks of valves and pistons on the seafloor that are supposed to shut a well in an emergency, but MMS higher-ups in Washington never approved the regulations.
“As far as I know, they’re still up in headquarters,” he said.
If the rules had been adopted, they may not have prevented the catastrophe at Deepwater Horizon.
Hmm. I wonder what former Halliburton CEO was in charge of U.S. oil policy in 2001.
Also worth noting, “Coast Guard regulations governing drilling on the Outer Continental Shelf have not been updated since 1996.”
Stupak points out that this is the third hearing he has held as chairman of Oversight and Investigations involving British Petroleum. Here are extended excerpts of his sobering opening statement:
Three years ago – almost to the day – this subcommittee held a hearing into British Petroleum’s disasters at Texas City and on the North Slope of Alaska. The 2005 Texas City refinery explosion resulted in the deaths of 15 workers and injured more than 170 people. As a result of that accident and BP’s failure to correct potential hazards faced by employees at Texas City, OSHA has twice slapped BP with record setting fines totaling more than $100 million. Several reports criticized management at the Texas City facility including BP’s own 2007 Report of the Management Accountability Project which stated “a culture that evolved over the years seemed to ignore risk, tolerated non-compliance and accepted incompetence.”
In March of 2006 BP discovered their pipeline on Alaska’s North Slope had spilled more than 200,000 gallons of oil on the tundra, making it the largest spill in North Slope history. Our hearings discovered that significant cost cutting measures resulted in decreased maintenance and inspections of the pipeline and BP’s management culture deterred individuals from raising safety concerns.
Since our last hearing BP has experienced continued problems on the North Slope
* September 29, 2008 an 8 inch high pressure gas line at the Y-Pad location “separated” sending 3 pieces of pipe to the tundra. One segment of the pipe landed 900 feet from the pipeline. Roughly 30 minutes later a second and unrelated incident occurred on the S Pad where there was a gas release.
* January 15, 2009 a isc cleaning pig became lodged and lost in a 34 inch Oil Transit Line during de-oiling allowing gas to pass around the pig and travel through Skid 50, to Pump Station 1 causing a significant venting of gas to the atmosphere and the complete shutdown of the Trans Alaska Pipeline for a period of time.
* October 10, 2009 at the Central Compressor Plant low pressure flare staging valves were stuck closed causing gas to travel to the backup low pressure flare valves, which activated causing the gas to vent to the atmosphere which could have caused an explosion.
* November 29, 2009 an 18 inch three-phase common line near the Lisburne Production Center carrying a mixture of crude oil, produced water and natural gas ruptured spraying its contents over an estimated 8,400 square feet area.
… The world is wondering what went wrong to allow explosive gas to shoot out of the drill pipe on the Deepwater Horizon causing the explosion. We heard Chairman Waxman discuss theories of what may have gone wrong in the well (down hole as they call it) and what went wrong on the rig. I would like to take a few minutes to discuss issues related to the blowout preventer (BOP) which was the “fail safe system” to cut off the flow of oil and gas to the rig.
In his testimony today, Lamar McKay, the President of BP America, says that blowout preventers are “intended to … be fail-safe.” But that didn’t happen. The blowout preventer used by the Deepwater Horizon rig failed to stop the flow of gas and oil, the rig exploded, and an enormous oil spill is now threatening the Gulf Coast.
We know that the blowout preventer, the BOP, did not properly engage. The BOP has multiple rams that are supposed to slam shut to pinch off any flow around the drill pipe and stop the flow of oil from the well. There are also shear rams in the BOP that are supposed to cut and seal the pipe to prevent oil and gas from flowing. The question we will ask is why did these rams fail?
Our investigation is at its early stages, but already we have uncovered at least four significant problems with the blowout preventer used on the Deepwater Horizon drill rig.
First, the blowout preventer apparently had a significant leak in a key hydraulic system. This leak was found in the hydraulic system that provides emergency power to the shear rams, which are the devices that are supposed to cut the drill pipe and seal the well.
I would like to put on the screen a document that the Committee received from BP. This document states: “leaks have been discovered in the BOP hydraulics system.”
The blowout preventer was manufactured by Cameron. We asked a senior official at Cameron what he knew about these leaks. He told us when the remote operating vehicles (ROVs) tried to operate the shear rams, they noticed a loss of pressure. They investigated this by injecting dye into the hydraulic fluid, which showed a large leak coming from a loose fitting, which was backed off several turns.
The Cameron official told us that he did not believe the leak was caused by the blowout because every other fitting in the system was tight.
We also asked about the significance of the leak. The Cameron official said it was one of several possible failure modes. If the leak deprived the shear rams of sufficient power, they might not succeed in cutting through the drill pipe and sealing the well.
Second, we learned that the blowout preventer had been modified in unexpected ways. One of these modifications was potentially significant. The blowout preventer has an underwater control panel. BP spent a day trying to use this control panel to activate a variable bore ram on the blowout preventer that is designed to seal tight around any pipe in the well. When they investigated why their attempts failed to activate the bore ram, they learned that the device had been modified. A useless test ram – not the variable bore ram – had been connected to the socket that was supposed to activate the variable bore ram. An entire day’s worth of precious time had been spent engaging rams that closed the wrong way.
BP told us the modifications on the BOP were extensive. After the accident, they asked Transocean for drawings of the blowout preventer. Because of the modifications, the drawings they received didn’t match the structure on the ocean floor. BP said they wasted many hours figuring this out.
Third, we learned that the blowout preventer is not powerful enough to cut through joints in the drill pipe. We found a Transocean document that I would like to put on the screen. It says: most blind shear rams are “designed to shear effectively only on the body of the drillpipe. Procedures for the use of BSR’s must therefore ensure that there is no tool joint opposite the ram prior to shearing.”
This seemed astounding to us because the threaded joints between the sections of drillpipe make up about 10% of the length of the pipe. If the shear rams cannot cut through the joints, that would mean that this so-called failsafe device would succeed in cutting the drillpipe only 90% of the time.
We asked the Cameron official about the cutting capacity of the blowout preventer on the Deepwater Horizon. He confirmed that it is not powerful enough to cut through the joints in the drillpipe. And he told us this was another possible explanation for the failure of the blowout preventer to seal the well.
And fourth, we learned that the emergency controls on the blowout preventer may have failed. The blowout preventer has two emergency controls. One is called the emergency disconnect system or EDS. BP officials told us that that the EDS was activated on the drill rig before the rig was evacuated. But the Cameron official said they doubted the signals ever reached the blowout preventer on the seabed. Cameron officials believed the explosion on the rig destroyed the communications link to the blowout preventer before the emergency sequence could be completed.
In other words, the emergency controls may have failed because the explosion that caused the emergency also disabled communications to the blowout preventer.
Still, the blowout preventer also has a “deadman switch” which is supposed to activate the blowout preventer when all else fails. But according to Cameron, there were multiple scenarios that could have caused the deadman switch not to activate. One is human oversight: the deadman switch may not have been enabled on the control panel prior to the BOP being installed on the ocean floor. One is lack of maintenance: the deadman switch won’t work if the batteries are dead. The deadman switch is connected to two separate control pods on the blowout preventer. Both rely on battery power to operate. When one of the control pods was removed and inspected after the spill began, the battery was found to be dead. The battery in the other pod has not been inspected yet.
And one appears to be a design problem. The deadman switch activates only when three separate lines that connect the rig to the blowout preventer are all severed: the communication, power, and hydraulic lines. Cameron believes the power and communication lines were severed in the explosion, but it is possible the hydraulic lines remained intact, which would have stopped the deadman switch from activating.
If this last scenario is true, the acoustic shut-off switch BP failed to install to save $500,000 would probably have worked to stop the blowout (see “Shocking allegations against BP“):
These are not the only failure scenarios that could impair the function of the blowout preventer. The Cameron official we met with described many other potential problems that could have prevented the blowout preventer from functioning properly. Steel casing or casing hanger could have been ejected from the well and blocked the operation of the rams. The drill pipe could have been severed successfully, but then dropped from the rig, breaking the seal. Or operators on the rig could have tried to activate the shear rams by pushing the shear ram control button. This would have initiated an attempt to close the rams, but it would not have been successful. The shear rams do not have enough power to cut drill pipe unless they are activated through the emergency switch or the deadman switch.
In fact, we uncovered an astonishing document that Transocean prepared in 2001, when it bought the blowout preventer from Cameron. I would like to display the executive summary from this document. It says there are 260 separate “failure modes” that “could require pulling of the BOP.” According to this report, “the predominant failures” included “ram locking mechanisms.”
How can a device that has 260 failure modes be considered failsafe?
The problems with the blowout preventer extend to the procedures for testing the device. The CEO of Transocean, Steven Newman, says in his testimony: “we have no reason to believe that they were not operational – they were jointly tested by BP and Transocean personnel as specified on April 10 and 17 and found to be functional.”
But this assertion appears to be contradicted by a document prepared by BP on April 27, one week after the explosion. According to this document, “BOP stack emergency systems are not typically tested once the BOP stack is on the seabed.” What this means that while some functions on the BOP may have been tested in the weeks before the explosion, the emergency systems, including the deadman system and the leaking emergency hydraulic system, were unlikely to have been tested.
After the Alaska pipeline and Texas refinery disasters, BP promised to make safety its number one priority. This hearing will raise serious questions about whether BP and its partners fulfilled this commitment. The safety of its entire operations rested on the performance of a leaking and apparently defective blowout preventer.
And so again we see the tragic combination of Recklessness, Arrogance, and Hubris.
Stupak stunner: Oil well’s blowout preventer had leaks, dead battery, design flaws, “How can a device that has 260 failure modes be considered fail-safe?”
Coast Guard Captain slams industry "self-certification" of BOP: "Manufactured by industry, installed by industry, with no government witnessing oversight of the installation or the construction." And the rig flew the Marshall Island flag to further escape U.S. oversight
A senior House Democrat said that the blowout preventer that failed to stop an oil leak in the Gulf of Mexico had a dead battery in its control pod, leaks in its hydraulic system, a “useless” test version of one of the devices that was supposed to close the flow of oil and a cutting tool that wasn’t strong enough to shear through joints that made up 10 percent of the drill pipe.
That’s the lede of the WashPost coverage on the devastating opening statement by Rep. Bart Stupak (D-MI) in a hearing of the House Energy and Commerce Committee.
It simply becomes more and more astounding that BP ever called this blowout disaster ‘inconceivable,’ ‘unprecedented,’ and unforeseeable. It was quite literally an accident waiting to happen. A 30-second video of the undersea volcano finally released by BP is above.
You can read comments by the Coast Guard on how the rig minimizes regulatory oversight in the WP piece and also at Nola.com, which reports:
The Coast Guard inspections follow up on the monitoring done by the classification society for the flag state. Gifford said the Deepwater Horizon used the Marshall Islands’ flag as a “flag of convenience” so it could comply with that country’s standards, and not the U.S. regulations.
The Nola.com story relates more shocking testimony from the Coast Guard and MMS:
Summarizing testimony by Mike Saucier, a regional supervisor for field operations for the federal Minerals Management Service, which oversees offshore drilling, Capt. Hung Nguyen said:
“So, MMS approves the design of the well, but they don’t check what type of pipe is used. And we have a study some time ago about whether a shear ram would cut a certain pipe (to shut off a well in an emergency), but we don’t know what was installed here. I don’t understand that.”
The testimony from Saucier established that the government agency he works for doesn’t do any certification of blowout preventers, the massive devices that are supposed to be the final cut off of an out-of-control well. Saucier said most of the action MMS has taken to control blowout preventers has been through “notices to lessees,” letters that go to drill operators but are not enforceable.
“We have self-certification of critical equipment and safety notices that are not enforceable…” Nguyen said, digesting the testimony before tailing off, pursing his lips and moving on to his next question.
The panel of three Coast Guard officials and three MMS representatives also appeared disappointed to learn from Saucier that tighter rules for monitoring deepwater drilling safety systems were proposed nine years ago, but got lost in the shuffle and never were adopted.
Saucier said new rules were written in 2001 to require secondary control systems for blowout preventers, the stacks of valves and pistons on the seafloor that are supposed to shut a well in an emergency, but MMS higher-ups in Washington never approved the regulations.
“As far as I know, they’re still up in headquarters,” he said.
If the rules had been adopted, they may not have prevented the catastrophe at Deepwater Horizon.
Hmm. I wonder what former Halliburton CEO was in charge of U.S. oil policy in 2001.
Also worth noting, “Coast Guard regulations governing drilling on the Outer Continental Shelf have not been updated since 1996.”
Stupak points out that this is the third hearing he has held as chairman of Oversight and Investigations involving British Petroleum. Here are extended excerpts of his sobering opening statement:
Three years ago – almost to the day – this subcommittee held a hearing into British Petroleum’s disasters at Texas City and on the North Slope of Alaska. The 2005 Texas City refinery explosion resulted in the deaths of 15 workers and injured more than 170 people. As a result of that accident and BP’s failure to correct potential hazards faced by employees at Texas City, OSHA has twice slapped BP with record setting fines totaling more than $100 million. Several reports criticized management at the Texas City facility including BP’s own 2007 Report of the Management Accountability Project which stated “a culture that evolved over the years seemed to ignore risk, tolerated non-compliance and accepted incompetence.”
In March of 2006 BP discovered their pipeline on Alaska’s North Slope had spilled more than 200,000 gallons of oil on the tundra, making it the largest spill in North Slope history. Our hearings discovered that significant cost cutting measures resulted in decreased maintenance and inspections of the pipeline and BP’s management culture deterred individuals from raising safety concerns.
Since our last hearing BP has experienced continued problems on the North Slope
* September 29, 2008 an 8 inch high pressure gas line at the Y-Pad location “separated” sending 3 pieces of pipe to the tundra. One segment of the pipe landed 900 feet from the pipeline. Roughly 30 minutes later a second and unrelated incident occurred on the S Pad where there was a gas release.
* January 15, 2009 a isc cleaning pig became lodged and lost in a 34 inch Oil Transit Line during de-oiling allowing gas to pass around the pig and travel through Skid 50, to Pump Station 1 causing a significant venting of gas to the atmosphere and the complete shutdown of the Trans Alaska Pipeline for a period of time.
* October 10, 2009 at the Central Compressor Plant low pressure flare staging valves were stuck closed causing gas to travel to the backup low pressure flare valves, which activated causing the gas to vent to the atmosphere which could have caused an explosion.
* November 29, 2009 an 18 inch three-phase common line near the Lisburne Production Center carrying a mixture of crude oil, produced water and natural gas ruptured spraying its contents over an estimated 8,400 square feet area.
… The world is wondering what went wrong to allow explosive gas to shoot out of the drill pipe on the Deepwater Horizon causing the explosion. We heard Chairman Waxman discuss theories of what may have gone wrong in the well (down hole as they call it) and what went wrong on the rig. I would like to take a few minutes to discuss issues related to the blowout preventer (BOP) which was the “fail safe system” to cut off the flow of oil and gas to the rig.
In his testimony today, Lamar McKay, the President of BP America, says that blowout preventers are “intended to … be fail-safe.” But that didn’t happen. The blowout preventer used by the Deepwater Horizon rig failed to stop the flow of gas and oil, the rig exploded, and an enormous oil spill is now threatening the Gulf Coast.
We know that the blowout preventer, the BOP, did not properly engage. The BOP has multiple rams that are supposed to slam shut to pinch off any flow around the drill pipe and stop the flow of oil from the well. There are also shear rams in the BOP that are supposed to cut and seal the pipe to prevent oil and gas from flowing. The question we will ask is why did these rams fail?
Our investigation is at its early stages, but already we have uncovered at least four significant problems with the blowout preventer used on the Deepwater Horizon drill rig.
First, the blowout preventer apparently had a significant leak in a key hydraulic system. This leak was found in the hydraulic system that provides emergency power to the shear rams, which are the devices that are supposed to cut the drill pipe and seal the well.
I would like to put on the screen a document that the Committee received from BP. This document states: “leaks have been discovered in the BOP hydraulics system.”
The blowout preventer was manufactured by Cameron. We asked a senior official at Cameron what he knew about these leaks. He told us when the remote operating vehicles (ROVs) tried to operate the shear rams, they noticed a loss of pressure. They investigated this by injecting dye into the hydraulic fluid, which showed a large leak coming from a loose fitting, which was backed off several turns.
The Cameron official told us that he did not believe the leak was caused by the blowout because every other fitting in the system was tight.
We also asked about the significance of the leak. The Cameron official said it was one of several possible failure modes. If the leak deprived the shear rams of sufficient power, they might not succeed in cutting through the drill pipe and sealing the well.
Second, we learned that the blowout preventer had been modified in unexpected ways. One of these modifications was potentially significant. The blowout preventer has an underwater control panel. BP spent a day trying to use this control panel to activate a variable bore ram on the blowout preventer that is designed to seal tight around any pipe in the well. When they investigated why their attempts failed to activate the bore ram, they learned that the device had been modified. A useless test ram – not the variable bore ram – had been connected to the socket that was supposed to activate the variable bore ram. An entire day’s worth of precious time had been spent engaging rams that closed the wrong way.
BP told us the modifications on the BOP were extensive. After the accident, they asked Transocean for drawings of the blowout preventer. Because of the modifications, the drawings they received didn’t match the structure on the ocean floor. BP said they wasted many hours figuring this out.
Third, we learned that the blowout preventer is not powerful enough to cut through joints in the drill pipe. We found a Transocean document that I would like to put on the screen. It says: most blind shear rams are “designed to shear effectively only on the body of the drillpipe. Procedures for the use of BSR’s must therefore ensure that there is no tool joint opposite the ram prior to shearing.”
This seemed astounding to us because the threaded joints between the sections of drillpipe make up about 10% of the length of the pipe. If the shear rams cannot cut through the joints, that would mean that this so-called failsafe device would succeed in cutting the drillpipe only 90% of the time.
We asked the Cameron official about the cutting capacity of the blowout preventer on the Deepwater Horizon. He confirmed that it is not powerful enough to cut through the joints in the drillpipe. And he told us this was another possible explanation for the failure of the blowout preventer to seal the well.
And fourth, we learned that the emergency controls on the blowout preventer may have failed. The blowout preventer has two emergency controls. One is called the emergency disconnect system or EDS. BP officials told us that that the EDS was activated on the drill rig before the rig was evacuated. But the Cameron official said they doubted the signals ever reached the blowout preventer on the seabed. Cameron officials believed the explosion on the rig destroyed the communications link to the blowout preventer before the emergency sequence could be completed.
In other words, the emergency controls may have failed because the explosion that caused the emergency also disabled communications to the blowout preventer.
Still, the blowout preventer also has a “deadman switch” which is supposed to activate the blowout preventer when all else fails. But according to Cameron, there were multiple scenarios that could have caused the deadman switch not to activate. One is human oversight: the deadman switch may not have been enabled on the control panel prior to the BOP being installed on the ocean floor. One is lack of maintenance: the deadman switch won’t work if the batteries are dead. The deadman switch is connected to two separate control pods on the blowout preventer. Both rely on battery power to operate. When one of the control pods was removed and inspected after the spill began, the battery was found to be dead. The battery in the other pod has not been inspected yet.
And one appears to be a design problem. The deadman switch activates only when three separate lines that connect the rig to the blowout preventer are all severed: the communication, power, and hydraulic lines. Cameron believes the power and communication lines were severed in the explosion, but it is possible the hydraulic lines remained intact, which would have stopped the deadman switch from activating.
If this last scenario is true, the acoustic shut-off switch BP failed to install to save $500,000 would probably have worked to stop the blowout (see “Shocking allegations against BP“):
These are not the only failure scenarios that could impair the function of the blowout preventer. The Cameron official we met with described many other potential problems that could have prevented the blowout preventer from functioning properly. Steel casing or casing hanger could have been ejected from the well and blocked the operation of the rams. The drill pipe could have been severed successfully, but then dropped from the rig, breaking the seal. Or operators on the rig could have tried to activate the shear rams by pushing the shear ram control button. This would have initiated an attempt to close the rams, but it would not have been successful. The shear rams do not have enough power to cut drill pipe unless they are activated through the emergency switch or the deadman switch.
In fact, we uncovered an astonishing document that Transocean prepared in 2001, when it bought the blowout preventer from Cameron. I would like to display the executive summary from this document. It says there are 260 separate “failure modes” that “could require pulling of the BOP.” According to this report, “the predominant failures” included “ram locking mechanisms.”
How can a device that has 260 failure modes be considered failsafe?
The problems with the blowout preventer extend to the procedures for testing the device. The CEO of Transocean, Steven Newman, says in his testimony: “we have no reason to believe that they were not operational – they were jointly tested by BP and Transocean personnel as specified on April 10 and 17 and found to be functional.”
But this assertion appears to be contradicted by a document prepared by BP on April 27, one week after the explosion. According to this document, “BOP stack emergency systems are not typically tested once the BOP stack is on the seabed.” What this means that while some functions on the BOP may have been tested in the weeks before the explosion, the emergency systems, including the deadman system and the leaking emergency hydraulic system, were unlikely to have been tested.
After the Alaska pipeline and Texas refinery disasters, BP promised to make safety its number one priority. This hearing will raise serious questions about whether BP and its partners fulfilled this commitment. The safety of its entire operations rested on the performance of a leaking and apparently defective blowout preventer.
And so again we see the tragic combination of Recklessness, Arrogance, and Hubris.
“How can a device that has 260 failure modes be considered failsafe?”
ReplyDeleteIndeed, the system shutdown design of this so-called "Blowout Preventer" device is simply incredible. Were the designers of this subassembly impaired? A high school auto-shop class could have done a better job here.
Sick as it sounds, upcoming investigation efforts will likely result in no corrective action with respect to this glaring issue; and will simply focus on finger-pointing with respect to the installation, maintenance, and operation of the device as it was designed.
So take heart, Cameron company; you'll be safe from having to "do the right thing" and change your design. BP and Transocean et al, don't worry; they'll never require you to correctively retrofit these electromechanical abominations which you have scattered about the seafloors of the world.
And everyone else, be at ease; the media and your governments will tell you "everything is under control."
20 minutes into the future...