By THE NEW YORK TIMES
Published: June 20, 2010
This article is by David Barstow, Laura Dodd, James Glanz, Stephanie Saul
and Ian Urbina.
It was the last line of defense, the final barrier between the rushing volcanic
fury of oil and gas and one of the worst environmental disasters in United
States history.
Its very name — the blind shear ram — suggested its blunt purpose. When all else
failed, if the crew of the Deepwater Horizon oil rig lost control of a well, if
a dreaded blowout came, the blind shear ram’s two tough blades were poised to
slice through the drill pipe, seal the well and save the day. Everything else
could go wrong, just so long as “the pinchers” went right. All it took was one
mighty stroke.
On the night of April 20, minutes after an enormous blowout ripped through the
Deepwater Horizon, the rig’s desperate crew pinned all hope on this last line of
defense.
But the line did not hold.
For days, technicians and engineers worked furiously to figure out why,
according to interviews and hundreds of pages of previously unreleased notes
scrawled by industry crisis managers in the disaster’s immediate aftermath.
Engineers sent robotic submersibles 5,000 feet deep to prod the blind shear ram,
nestled in the bosom of a five-story blowout preventer standing guard over the
Macondo well.
They were driven on, documents and interviews reveal, by indications that the
shear ram’s blades had come within a few maddening inches of achieving their
purpose. Again and again, they tried to make the blades close completely,
knowing it was their best chance to end the nightmare of oil and gas billowing
into the Gulf of Mexico.
“If that would’ve worked,” a senior oil industry executive said of the blind
shear ram, “that rig wouldn’t have burned up and sunk.”
Much remains unknown about the failure of this ultimate fail-safe device. It
continues to be a focus of inquiries, and some crucial questions will not be
answerable until the blowout preventer is recovered from the sea.
But from documents and interviews, it is possible to piece together some of the
decisions and events that came into play when the Deepwater Horizon most needed
the blind shear ram.
Engineers contended with hydraulic fluid leaks that may have deprived the ram of
crucial cutting force. They struggled to comprehend what was going on in the
steel sarcophagus that encased the shear ram, as if trying to perform surgery
blindfolded.
They wondered if the blades had by chance closed uselessly on one of the nearly
indestructible joints that connect drilling pipe — a significant bit of
misfortune, given a decision years before to outfit the Deepwater Horizon’s
blowout preventer with just one blind shear ram when other rigs were already
beginning to use two of them to guard against just this possibility.
But the questions raised by the failure of the blind shear ram extend well
beyond the Deepwater Horizon.
An examination by The New York Times highlights the chasm between the oil
industry’s assertions about the reliability of its blowout preventers and a more
complex reality. It reveals that the federal agency charged with regulating
offshore drilling, the Minerals Management Service, repeatedly declined to act
on advice from its own experts on how it could minimize the risk of a blind
shear ram failure.
It also shows that the Obama administration failed to grapple with either the
well-known weaknesses of blowout preventers or the sufficiency of the nation’s
drilling regulations even as it made plans this spring to expand offshore oil
exploration.
“What happened to all the stakeholders — Congress, environmental groups,
industry, the government — all stakeholders involved were lulled into a sense of
what has turned out to be false security,” David J. Hayes, the deputy interior
secretary, said in an interview.
Even in one significant instance where the Minerals Management Service did act,
it appears to have neglected to enforce a rule that required oil companies to
submit proof that their blind shear rams would in fact work.
As it turns out, records and interviews show, blind shear rams can be
surprisingly vulnerable. There are many ways for them to fail, some unavoidable,
some exacerbated by the stunning water depths at which oil companies have begun
to explore.
But they also can be rendered powerless by the failure of a single part, a point
underscored in a confidential report that scrutinized the reliability of the
Deepwater Horizon’s blowout preventer. The report, from 2000, concluded that the
greatest vulnerability by far on the entire blowout preventer was one of the
small shuttle valves leading to the blind shear ram. If this valve jammed or
leaked, the report warned, the ram’s blades would not budge.
This sort of “single-point failure” figures prominently in an emerging theory of
what went wrong with the Deepwater Horizon’s blind shear ram, according to
interviews and documents. Some evidence suggests that when the crew activated
the blind shear ram, its blades tried to cut the drill pipe, but then failed to
finish the job because one or more of its shuttle valves leaked hydraulic fluid.
These kinds of weaknesses were understood inside the oil industry, documents and
interviews show. And given the critical importance of the blind shear ram,
offshore drillers began adding a layer of redundancy by equipping their blowout
preventers with two blind shear rams.
By 2001, when Transocean, now the world’s largest offshore drilling contractor,
acquired the Deepwater Horizon, it had already begun equipping its new rigs with
blowout preventers that could easily accommodate two blind shear rams.
Today, Transocean says 11 of its 14 rigs in the gulf have two blind shear rams.
The company said the three rigs that do not were built before the Deepwater
Horizon.
Likewise, every rig currently under contract with BP, which had been renting the
Deepwater Horizon, comes with blowout preventers equipped with two blind shear
rams, according to BP. While no guarantee against disaster, drilling experts
said, two blind shear rams give an extra measure of reliability, especially if
one shear ram hits on a joint connecting two drill pipes.
“It’s kind of like a parachute — it’s nice to have a backup,” said Dan Albers, a
drilling engineer who is part of an independent investigation of the disaster.
But neither Transocean nor BP took steps to outfit the Deepwater Horizon’s
blowout preventer with two blind shear rams. In a statement, BP pointed to the
need for the rig to carry its blowout preventer from well to well.
BP said space limitations on the Deepwater Horizon would have prohibited the
company from adding a second blind shear ram to the existing configuration on
the blowout preventer. But other experts told The Times that a second blind
shear ram could have been swapped in for some other component.
In a statement, Transocean said BP would have been responsible for deciding
whether the blowout preventer was equipped with one or two blind shear rams; BP
said both companies would have been involved.
Whatever the reasoning, the result was that the Deepwater Horizon was left with
just one blind shear ram to contain a blowout. And yet, The Times examination
found, government regulations do not require any regular checks of several
important elements of blind shear rams.
What’s more, when those elements were put to the test after the blowout, some
appeared to malfunction. In addition, interviews and documents show that after
the crew abandoned the rig, the initial frantic efforts to find another way to
activate the blind shear ram were hampered by the lack of submersibles with
sufficient power.
Teams of engineers knew they were up against the clock. With each passing hour,
more oil and well debris were rattling up through the blowout preventer under
tremendous force, almost certainly chewing away at the blades of the blind shear
ram — the very blades they still hoped and prayed would come to their rescue.
Vulnerable Devices
Last year, Transocean commissioned a “strictly confidential” study of the
reliability of blowout preventers used by deepwater rigs.
Using the world’s most authoritative database of oil rig accidents, a Norwegian
company, Det Norske Veritas, focused on some 15,000 wells drilled off North
America and in the North Sea from 1980 to 2006.
It found 11 cases where crews on deepwater rigs had lost control of their wells
and then activated blowout preventers to prevent a spill. In only six of those
cases were the wells brought under control, leading the researchers to conclude
that in actual practice, blowout preventers used by deepwater rigs had a
“failure” rate of 45 percent.
For all their confident pronouncements about blowout preventers (the “ultimate
failsafe device,” some called it), oil industry executives had long known they
could be vulnerable and temperamental.
Rising five or more floors and weighing hundreds of thousands of pounds, these
devices were daunting in their scale and complexity. There were hundreds of ways
they could malfunction or be improperly maintained, tested and operated. Not
only did they have to withstand extreme environments, they were relied upon to
tame the ferocious forces often unleashed when drilling rigs penetrate
reservoirs of highly compressed oil and gas.
They were also costly to maintain. An industry study last year estimated the
price of stopping operations to pull up a blowout preventer for repairs at $700
per minute.
Those costs could be enough to draw the attention of Wall Street. Last August,
during a conference call with investment analysts, Steven L. Newman, the chief
executive of Transocean, was asked why his deepwater fleet had been paid for
fewer days of drilling compared with earlier in the year.
Mr. Newman said the fleet had experienced a “handful of B.O.P. problems.”
But he assured the analysts that the problems were not systemic. “They were
anomalies,” he said. “I would just leave it at that.”
A draft of another industry-financed study this year contended that companies
cut corners on federally mandated tests of blowout preventers. A copy obtained
by The Times described a mentality of “I don’t want to find problems; I want to
do the minimum necessary to obtain a good test.”
It also included this observation: “Often there is a great deal of pressure to
run the B.O.P. stack before it is deemed fit for purpose by the experts who
maintain and test the equipment.”
When the report was finalized, those criticisms were omitted, although it is not
clear why.
Last Finger in the Dike
Blowout preventers are designed to handle a range of well control problems. They
come with several types of rams, giving rig workers flexibility if a situation
escalates. But one component in particular has to work properly: the blind shear
ram, the last finger in the dike during an uncontrolled blowout.
The danger is not merely theoretical.
More than three decades ago, the failure of a shear ram was partly to blame for
one of the largest oil spills on record, a blowout at the Ixtoc 1 well off the
Yucatan Peninsula in Mexico. Descriptions of the accident at the time detailed
problems both with the shear ram’s ability to cut through thick pipe and with a
burst line carrying hydraulic fluids to the blowout preventer.
In 1990, a blind shear ram could not snuff out a major blowout on a rig off
Texas. It cut the pipe, but investigators found that the sealing mechanism was
damaged. And in 1997, a blind shear ram was unable to slice through a thick
joint connecting two sections of drill pipe during a blowout of a deep oil and
gas well off the Louisiana coast. Even now, despite advances in technology, it
is virtually impossible for a blind shear ram to slice through these joints. In
an emergency, there is no time for a driller to make sure the ram’s blades are
clear of these joints, which can make up almost 10 percent of the drill pipe’s
length.
The problems highlighted by these cases were common knowledge in the drilling
industry.
But in two studies, in 2002 and 2004, one of the industry’s premier authorities
on blowout preventers, West Engineering Services of Brookshire, Tex., found a
more basic problem: even when everything worked right, some blind shear rams
still failed to cut pipe.
West’s experts concluded that calculations used by makers of blowout preventers
overestimated the cutting ability of blind shear rams, so-called because they
close off wells like a window blind. Modern drill pipe is nearly twice as strong
as older pipes of the same size. In addition, the intense pressure and frigid
temperatures of deep water make it tougher to shear a pipe. These and other
“additive pressures,” the researchers found, can demand hundreds of thousands of
additional pounds of cutting force.
Yet when the team examined the performance of blind shear rams in blowout
preventers on 14 new rigs, it found that seven had never been checked to see if
their shear rams would work in deep water. Of the remaining seven, only three
“were found able to shear pipe at their maximum rated water depths.”
“This grim snapshot,” the researchers concluded, “illustrates the lack of
preparedness in the industry to shear and seal a well with the last line of
defense against a blowout.”
Yet as the industry moves into deeper waters, it is pressing to reduce
government-mandated testing of blowout preventers. BP and other oil companies
helped finance a study early this year arguing that blowout preventer pressure
tests conducted every 14 days should be stretched out to every 35 days. The
industry estimated the change could save $193 million a year in lost
productivity.
The study found that blowout preventers almost always passed the required
government tests — there were only 62 failures out of nearly 90,000 tests
conducted over several years — but it also raised questions about the
effectiveness of these tests.
“It is not possible,” the study pointed out, “to completely simulate” the actual
conditions of deepwater wells.
Flawed Oversight
BP is the largest oil producer in the Gulf of Mexico. It pumped 182 million
barrels of crude oil from the gulf last year, and it is leading the charge to go
deeper. Last fall, while working on another BP well, the Deepwater Horizon
drilled a record 35,055 feet.
As with BP, the rig’s owner, Transocean, was aware of the vulnerabilities and
limitations of blowout preventers.
But they were not the only ones.
The Minerals Management Service knew the problems, too. In fact, the agency
helped pay for many of the studies that warned of their shortcomings, including
those in 2002 and 2004 that raised doubts about the ability of blind shear rams
to cut pipe under real-world conditions.
In some cases, the agency did not act on the recommendations of its consultants.
But in 2003, it adopted a regulation requiring companies to submit test data
proving that their blind shear rams could work on the specific drill pipe used
on a well and under the pressures they would encounter. Companies had to submit
this information to get drill permits.
At least, that was the way it was supposed to work.
Last year, when BP applied for its permit to drill the Macondo well, its
application was reviewed by Frank Patton, an engineer in the New Orleans office
of the Minerals Management Service. With nearly three decades of experience
working for the agency and the oil industry, Mr. Patton was fully aware of the
blowout preventer’s importance.
“It is probably the most, in my estimation, the most important factor in
maintaining safety of the well and safety of everything involved, the rig and
personnel,” he testified last month during the Coast Guard’s inquiry into the
disaster.
Yet Mr. Patton said he approved BP’s permit without requiring proof that its
blowout preventer could shear pipe and seal a well 5,000 feet down. “When I was
in training for this, I was never, as far as I can recall, ever told to look for
this statement,” he explained.
Mr. Patton said he had approved hundreds of other well permits in the gulf
without requiring this proof, and BP likewise contends that companies have never
been asked to furnish this proof on drilling applications.
In subsequent testimony, Michael Saucier, the agency’s regional supervisor for
field operations in the gulf, insisted that the regulation was enforced. But
asked if anyone ensures that a blowout preventer functions properly, Mr. Saucier
replied, “I don’t know if somebody does or not.”
Capt. Hung M. Nguyen, the co-chairman of the Coast Guard inquiry, seemed
incredulous at the agency’s deference to the industry on the most critical of
safety devices.
“So my understanding,” Captain Nguyen said, “is that it is designed to industry
standard, manufactured by industry, installed by industry, with no government
witnessing oversight of the construction or the installation. Is that correct?”
“That would be correct,” Mr. Saucier said.
Adding Protection
As a consequence of this arrangement, the agency had little likelihood of
knowing what engineering consultants had determined in 2000, when they were
asked to assess the specific vulnerabilities of the Deepwater Horizon’s blowout
preventer. The consultants, hired by the blowout preventer’s manufacturer,
Cameron, zeroed in on what they considered the most serious weakness: the
potential failure of the blind shear ram to close.
The consultants said the Deepwater Horizon’s blind shear ram was vulnerable to
“single-point failure.” In other words, the breakdown of just one part could
result in a catastrophic failure. The consultants focused on one of several
T-shaped shuttle valves, which control the flow of pressurized hydraulic fluid
that pushes the shear ram’s blades together.
This particular valve has no backup, so if it gets stuck or leaks hydraulic
fluid, disaster beckons. In fact, the consultants concluded that this one
shuttle valve represented 56 percent of the blowout preventer’s “failure
likelihood.”
“Care should be taken to ensure the highest reliability possible from this
valve,” they wrote.
In a written statement, BP said the consultants’ report was used “to ensure that
critical components and maintenance activities are clearly understood so that
system reliability remains high.” The company said a portion of the assessment
not seen by The Times found that the blowout preventer’s overall risk of failure
was tiny. It declined to release that part of the report.
In the 61 days since the blowout, BP and Transocean have clashed over who was
responsible for what on the Deepwater Horizon. In written responses to
questions, BP and Transocean differed yet again on why the Deepwater Horizon’s
blowout preventer was not originally outfitted — or later converted — to have
two blind shear rams.
Transocean said that BP, as the rig’s operator, would have determined the
blowout preventer’s configuration. “Operators select B.O.P. stack configurations
based on their anticipated operating environments, including water depths,
seismic data, anticipated well conditions and the like.”
BP, however, said it was a collaborative decision driven by “contractor
preference and operator requirements.” The company emphasized that blowout
preventer reliability did not simply boil down to the number of blind shear
rams. “These choices are risk assessed to provide the overall stack and system
reliability to perform in a wide variety of situations.”
In 2001, just as BP and Transocean were pressing the Deepwater Horizon into
service, the Minerals Management Service was being warned against allowing
deepwater rigs to operate with only one blind shear ram. The agency had
commissioned a study that documented more than 100 failures during testing of
blowout preventers.
“All subsea B.O.P. stacks used for deepwater drilling should be equipped with
two blind shear rams,” said the report, written by the SINTEF Group, a
Scandinavian research organization that advises the oil industry and maintains
detailed records on blowouts around the world.
The agency made no such requirement. Indeed, it waited until 2003 to require
even one blind shear ram. By then, the industry had already started moving to
two blind shear rams — although industry and government records show that
roughly two-thirds of the rigs in the gulf today still have only one.
The benefit of two shear rams was examined last year in a report to Transocean.
It estimated that while a blowout preventer with a single blind shear ram was 99
percent reliable, having two shear rams increased that reliability to 99.32
percent. Still, the study said, blowout preventers remain vulnerable to the same
“single-point failures.”
In 2003, BP and Transocean experienced firsthand the benefits of redundant blind
shear rams. On May 21 at 4 a.m., the Transocean rig Discoverer Enterprise,
working on a deepwater BP well, was violently jolted. The steel riser that
connected the rig to the well had cracked apart in two places. A BP executive
would later write that if there had been a blowout, more oil would have spilled
in a week “than occurred during the whole of the Exxon’s Valdez oil spill.”
One of the blowout preventer’s blind shear rams was triggered shortly after the
jolt and worked as expected. But when a robotic submersible was sent down, it
found the blowout preventer damaged. Workers then activated the second blind
shear ram, giving an extra layer of safety.
On the other hand, BP and Transocean officials could have drawn reassurance from
another close call that year, this one involving the Deepwater Horizon itself.
On June 30, 2003, while drilling a 25,000-foot-deep well in the gulf, high winds
and strong currents pushed the rig away from the well hole. The crew was forced
to perform an emergency disconnect from the blowout preventer, which triggered
the blind shear ram.
It worked perfectly. Whether it would have worked as perfectly in an actual
blowout, or with a different type of drill pipe, was another matter. The
following year, BP opted to remove a layer of redundancy from the blowout
preventer. It asked Transocean to replace one of the blowout preventer’s
secondary rams with a “test ram” — a device that would save BP money by reducing
the time it took to conduct certain well tests. In a joint letter, BP and
Transocean executives confirmed that BP was aware that the change “will reduce
the built-in redundancy” and raise Transocean’s “risk profile.”
The Deepwater Horizon was scheduled for a series of extensive maintenance checks
later this year. The last time it was checked so thoroughly, records indicate,
was in 2005, when significant problems with the blowout preventer were
uncovered. The control panels on the rig that operate the blowout preventer
acted strangely, giving unusual pressure readings and flashing unexplained alarm
signals. A critical piece of equipment, the “hot line” that connects the rig to
the blowout preventer, was “leaking badly,” Transocean maintenance documents
said.
As part of its assessment of the blowout preventer, Transocean hired West
Engineering, which had a checklist of more than 250 components and systems to
examine. It did not perform 72 of them, mostly for a simple reason: at the time,
the Deepwater Horizon was operating in the Gulf of Mexico, and the blowout
preventer was on the seafloor and therefore inaccessible.
According to a West Engineering document, one of those 72 items was verifying
that the blowout preventer could shear drill pipe and seal off wells in
deepwater. This checkup appears to be the last time an independent expert was
asked to perform a comprehensive examination of the Deepwater Horizon’s blowout
preventer.
The rig’s blowout preventer did get lots of attention from Transocean’s
maintenance workers. In January, as the Deepwater Horizon sailed toward the
Macondo well site, technicians spent 145 hours repairing and checking the
blowout preventer, records show. And the maintenance continued, almost daily, as
the drilling began.
A Rich, Difficult Well
The Macondo project yielded a rich prize: one of the largest finds in the Gulf
of Mexico. But the crew repeatedly struggled to maintain control of the well
against powerful “kicks” of surging gas. They contended with stuck drilling
pipes and broken tools. The job fell weeks behind schedule, costing BP millions
of dollars in rig rental fees. In e-mail messages, BP engineers vented their
frustrations, calling it a “crazy well” and a “nightmare well.”
Yet in April, as BP prepared to seal the well for later production, the company
took what numerous industry experts and fellow oil executives say were highly
questionable shortcuts. These included using a well design that presented few
barriers to high-pressure gas rising up; skipping a crucial $128,000 test of the
quality of the cementing; and failing to install capping devices at the top of
the well that could also have kept gas from lifting a critical seal.
Representative Henry A. Waxman, chairman of the House Energy and Commerce
Committee, asserted last week that the common thread behind all of these
decisions was that they saved BP time and money but raised the risk of
catastrophe. “BP has cut corner after corner to save $1 million here, a few
hours or days there, and now the whole Gulf Coast is paying the price,” Mr.
Waxman said.
However, as Tony Hayward, BP’s chief executive, repeatedly told Mr. Waxman’s
committee last Thursday, many of these decisions were approved by the Minerals
Management Service.
But if federal regulators did not see any problems, some crew members on the
Deepwater Horizon appeared to believe that BP’s decisions were, increasing the
odds of a catastrophic blowout that only the rig’s blind shear ram could stop.
In testimony in the Coast Guard inquiry, Douglas Brown, the rig’s chief
mechanic, recalled an argument hours before the explosion between a BP official
and Jimmy Harrell, a senior Transocean manager.
Mr. Brown recalled Mr. Harrell walking away, grumbling, “Well, I guess that’s
what we have those pinchers for.”
Moment of Crisis
Minutes after the blast at 10:20 p.m. on April 20, Chris Pleasant headed for the
bridge. As a subsea engineer who operated the blowout preventer, his first
thought was to activate “the pinchers” with the ship’s emergency disconnect
system. The system is supposed to trigger the blind shear ram and then free the
rig by disconnecting the riser.
Mr. Pleasant immediately noticed that something was amiss. An alarm on the
control panel indicated that “the pressure had dropped” in the blowout
preventer’s hydraulics, he testified at the Coast Guard hearing. Without
hydraulic pressure, the blowout preventer, and especially its blind shear ram,
would be useless.
“I’m E.D.S.-ing,” he told the rig’s captain, referring to the emergency system.
The captain told him to hold off and calm down, he recalled. But Mr. Pleasant
said he disconnected the system anyway. At first, he said, all seemed well. A
control light switched from green to red, indicating that the blind shear ram
had been activated.
But then he checked the panel’s flow meters, which measure whether hydraulic
fluid is actually flowing under pressure to the blowout preventer. The meters
showed no flow, he said. At that moment, he realized the ship and crew were in
terrible danger.
“I knew it was time to leave.”
Yet even as emergency rescue operations began under the crippled Deepwater
Horizon, the scramble was on to activate the blind shear ram in some other way.
The chaos and confusion of those efforts emerge from testimony and documents,
including the handwritten crisis team notes.
It was a race against time. The destructive force of oil, drilling mud and well
debris blowing through the guts of the blowout preventer was sure to rapidly
erode the shear ram’s blades and chew away its seals, leaving it useless.
Some people thought they had days at most. One study considered it “highly
unlikely” the blades and seals could withstand a blowout for even five minutes.
It would be 27 hours after Mr. Pleasant abandoned ship before engineers could
make their next effort to trigger the blind shear ram, according to BP
documents.
Within the first few days, engineers had already begun to wonder whether a leak
of hydraulic fluid had crippled the ram. “May have had leak & have lost
pressure,” one entry reads. Using a robotic submersible equipped with a
hydraulic pump, they injected seawater into the blind shear ram, hoping to drive
its pistons and blades closed. But the pump did not have nearly the needed
strength; it could not pump water fast enough to budge the blades.
Industry studies had highlighted the problem of submersibles without sufficient
strength years earlier. Now, as BP and Transocean officials searched the globe
for more powerful ones, engineers plotted out a plan essentially to trick the
blind shear ram into closing.
When the rig’s control panels fail, two separate backup systems, the deadman and
the autoshear, are supposed to close the blind shear ram automatically. The
deadman is designed to close the shear ram if the electronic and hydraulic lines
connecting the rig to the blowout preventer are severed.
An underwater robot cut several lines at 2:45 a.m. on April 22.
Nothing happened.
The situation was rapidly deteriorating. “2 explosions around 3:30-4:00 this
morning & rig listing at about 35 degrees,” a crisis manager wrote. “High risk
of sinking.”
The autoshear is designed to trigger the blind shear ram if a rig drifts out of
position and yanks its riser loose from the blowout preventer.
At 7:30 a.m., a submersible cut a firing pin on the blowout preventer,
simulating the rig’s pulling free. This time, the blowout preventer shuddered,
as if struggling to come back to life. “L.M.R.P. rocked & settled,” one note
says, referring to the top half of the blowout preventer. But after a few
moments, as oil continued to flow, it became clear that this, too, had failed.
Soon after, the Deepwater Horizon sank.
Stunning Discovery
The deadman, the autoshear and the underwater robots constitute the critical
backup systems that have given regulators and oil industry officials great
confidence that no matter what, they could always find a way to activate their
last line of defense.
This was more an act of faith than a fully tested proposition.
The Minerals Management Service had never required any of these backup systems
to be tested despite a report it commissioned in 2003 that said these systems
“should probably receive the same attention to verify functionality” as the rest
of the blowout preventer. The agency had also declined to take the modest step
of requiring rigs to have these backup systems in place at all, though it had
sent out a safety alert encouraging their use.
At a BP complex in Houston after the Deepwater Horizon’s sinking, in a room
called the hive with video screens displaying feeds from as many as a dozen
underwater robots, engineers considered their options. BP officials theorized —
perhaps based on the lower estimates of leakage in those first days — that the
blind shear ram might have crimped, but not quite severed, the pipe.
The idea provided a comforting mental picture. Just a few more inches with the
blind shear ram, the reasoning went, and perhaps it would snap shut and stanch
the spewing oil.
So six days after the explosion, they began the fifth effort to close the blind
shear ram. This time they sent down tanks of pressurized hydraulic fluid that a
submersible could inject directly into the ram.
Shockingly, the blind shear ram’s hydraulic system leaked, meaning pressure
could not be maintained on its shearing blades.
This leak shocked engineers because the blowout preventer’s hydraulic system was
obsessively checked for leaks. “We see tests fail because the hydraulics leaked
two drops,” said Benton Baugh, a leading authority on blowout preventers.
Indeed, the blind shear ram had been tested for leaks only hours before the
blowout, and according to Transocean, no hydraulic leaks had been detected in
the weeks before the blowout.
The underwater robots tried to find and fix the leak, but by now, leaks were
springing up on nearly every component of the blowout preventer.
“Retighten leak,” reads a note from 4 a.m. on April 26. At 4:45: “Retest & leak
still present.” Fifteen minutes later: “Retighten loose connection.”
Some of those leaks appeared to be coming from shuttle valves leading to the
blind shear ram — possibly the “single-point failure” that had been identified
as the blowout preventer’s biggest vulnerability back in 2001. Or the leaks
could have come from shuttle valves that let hydraulic fluid from the robots
reach the blind shear ram.
The leaks pointed to a gaping hole in the government’s mandated leak tests.
Those tests do not require rig operators to look for leaks in the connection
points used by submersibles to activate a blowout preventer in an emergency.
Finally, seven long days after the explosion, operators of the underwater robots
managed to repair the leak on the blind shear ram and apply 5,000 pounds per
square inch of hydraulic pressure on its blades. This was nearly double the
pressure it typically takes to shear pipe.
A BP report tersely described the results: “No indication of movement.”
But engineers could not be absolutely sure. Without any way to see into the
blowout preventer, engineers had essentially been operating blind, using the
rate of oil flow, for example, to deduce the conditions inside.
Help came from Scott Watson, an expert in gamma ray imaging at Los Alamos
National Laboratory. Gamma rays, a form of electromagnetic radiation similar to
X-rays but higher in energy, might at least penetrate a few inches into the
blowout preventer’s thick steel walls. Then engineers might be able to see a
device called a wedge lock, which slides into place behind the shear ram to hold
it closed.
In mid-May, Mr. Watson ventured to the well site, where robotic submersibles
were sent down to the seafloor with cobalt 60, a radioactive isotope that
generates gamma rays. The team from Los Alamos was able to get a clear view of
only one half of the blind shear ram. But the images showed one wedge lock fully
engaged, meaning at least one half of the shear ram had deployed.
“I don’t think anybody who saw the pictures thought it was ambiguous,” Mr.
Watson said.
It was a crushing moment.
Engineers realized that all their efforts to revive the blowout preventer had
probably never budged the critical component at the machine’s core, the blind
shear ram. They had assumed that at some point early on, the blades had tried to
close. They had hoped to close them all the way. But now, the gamma ray images
showed that at least one blade was fully deployed, and they had run out of
options for forcing the other one closed. Continuing to push on the ram’s
pistons with more hydraulic fluid would achieve nothing.
The last line of defense was a useless carcass of steel.
False Sense of Security
Barely three weeks before the Deepwater Horizon disaster, President Obama
announced that he planned to open vast new tracts of ocean for oil exploration,
including environmentally sensitive areas that for decades had been declared off
limits by presidents from both parties.
Environmental groups were bitterly disappointed, but Mr. Obama said he had
arrived at his decision after more than a year of study by his administration,
including a careful weighing of environmental risks. Yet the administration’s
examination did not question the oil industry’s confident assertions about its
drilling technology. The well-known weaknesses of blowout preventers and blind
shear rams simply did not make it onto the administration’s radar, interviews
and documents show.
Mr. Hayes, the deputy interior secretary, said senior officials were reassured,
perhaps wrongly, by “the NASA kind of fervor” over the oil industry’s seemingly
“terrific technology.” They took comfort in what appeared to be a comprehensive
regime of regulations. Most of all, he said, they were impressed by the rarity
of significant oil spills even as more of the nation’s domestic oil supply was
being drawn from ultradeep wells.
“The track record was good,” he said. “The results were significant.”
Not even environmental groups bitterly opposed to expanding offshore drilling
were raising concerns about the industry’s technology for preventing deepwater
spills, he added. “We were not being drawn by anybody to a potential issue with
deepwater drilling or blowout preventers.”
As for the Minerals Management Service’s own studies on the vulnerabilities and
failings of blowout preventers, Mr. Hayes faulted the agency for not bringing
them to the administration’s attention. Long before Mr. Obama’s announcement,
Mr. Hayes said, Interior Secretary Ken Salazar had asked the agency for a report
describing the potential risks and benefits of expanding offshore drilling.
The report, 219 pages long, made no mention of blind shear rams. It barely
mentioned blowout preventers. It did, however, assure Mr. Salazar that safety
and engineering requirements were “extensive” and that blowouts were “very
rare.”
“We did not have red flags about a problem with the enforcement culture at M.M.S.,”
Mr. Hayes said. “We certainly have that now.”
After the Deepwater Horizon blowout, Mr. Obama declared a moratorium on offshore
drilling and ordered Mr. Salazar to look for ways to improve safety. Within
weeks, Mr. Salazar came back with a long list of changes, most of them clearly
responsive to weaknesses that industry and government studies had identified
years before.
Mr. Salazar recommended, for example, that all blowout preventers be equipped
with two blind shear rams — a step suggested to the Minerals Management Service
in 2001. He recommended new rules to make sure rigs were equipped with the right
kind of underwater robots and had emergency backup systems to activate blowout
preventers — a step suggested to the Minerals Management Service in 2003.
He also urged a break from the agency’s tradition of taking the drilling
industry’s word. From now on, he said, government inspectors should witness
actual testing on blowout preventers. Rig operators, he said, should have to pay
an independent expert to verify that their blowout preventers were properly
designed and had not been compromised by modifications.
But Mr. Salazar stopped short of what Mr. Hayward, the BP chief executive, said
was called for in the aftermath of the Deepwater Horizon disaster. “We need a
fundamental redesign of the blowout preventer,” Mr. Hayward testified last
Thursday.
Still, J. Ford Brett, a drilling expert who contributed to Mr. Salazar’s list of
suggestions, cautioned that blowout preventers, whatever their design, “will not
save you in every situation.”
Mr. Salazar has yet to offer ideas for what to do if another blowout preventer
fails thousands of feet beneath the sea. In the absence of a Plan B, he ordered
his department to come up with new “deepwater well control procedures” in the
next four months.
Already, though, pressure is building on the administration to let offshore
drilling operations resume. Last month, Mr. Obama lifted the moratorium on
drilling in shallow waters. But along the Gulf Coast, where drilling operations
are responsible for an estimated 150,000 jobs, politicians are clamoring for an
end to the deepwater moratorium, too.
In Senate testimony on June 9, Mr. Salazar made clear that Mr. Obama had no
intention of pulling back permanently from deepwater drilling off the United
States coast.
“It was the president’s directive that we press the pause button,” Mr. Salazar
said. “It’s important for all of you on this committee to know that word — it’s
the pause button. It’s not the stop button.”