The Titanic, Columbia space shuttle and Deepwater Horizon disasters span a period of almost 100 years but have more in common than might at first be apparent. All three were avoidable and foundered on a misguided belief in their indestructibility, says consultant Ian Fitzsimmons in the latest of his think pieces for OE.
The Macondo well blowout and the loss of the semisubmersible Deepwater Horizon represent a huge blow to the morale of the offshore oil and gas industry globally. The tragic loss of life and ensuing environmental damage serve to remind us of the inherent risk associated with drilling for hydrocarbons, either offshore or onshore.
Sadly, this disaster now heads the list of offshore rig blowouts recorded since 1970. The infamous Ixtoc-1 blowout occurred 3 June 1979 and was not capped until 23 March 1980. The public is right to wonder how far we have come since then and why we are still so ill prepared for the obvious risks associated with drilling offshore.
Unfortunately, there is nothing new under the sun. Aside from the plagues of the Middle Ages, the age of man-made disasters probably began on 15 April 1912 with the sinking of RMS Titanic. For the UK, at the time leading the world in shipbuilding technology, it was a national disaster. Harland & Wolff had convinced themselves that Titanic was unsinkable.
It is now generally accepted that more than one contributory defect was necessary to cause such an awful tragedy. In the Titanic's now legendary case, we can find six such causes:
Later in the century came the NASA shuttle disasters - Challenger in 1986 and Columbia in 2003. Without going into too much detail, most engineers at the time were astounded to discover that neoprene rings had been used to seal Challenger's solid booster segments together. They were further astounded to discover that the shuttle crew module could not be detached and ejected from the main fuselage in the event of an emergency.
In the wake of the Columbia disaster seven years later, it was discovered that a small piece of insulating foam from the main fuel tank was able to rip away most of the shuttle's wing. The public wanted to know about Plan B - could the lives of the crew have been saved in spite of the damage? There was no Plan B at the time. Subsequent events demonstrated there were in fact several Plan Bs available. They came too late for Columbia.
These disasters have two things in common: they could have been avoided at the outset, and the designers thought their creations were indestructible.
Today we have the Macondo/Deepwater Horizon disaster on our hands. It is worth taking a look to see if we can find similar faults.
What is clear from the outset is that the drilling engineers were convinced their designs and equipment were indestructible. We know that because, faced with a major disaster, they did not have a recovery plan ready. We have watched in bewilderment as they searched for a temporary remedy.
But could they have been better prepared with a magical kit of parts? Sadly, the answer is no - not with the equipment and systems they were using. They put all their faith in a single pair of shear rams, which failed to close when they should have done. The shears can both cut and seal, and of course there are the back-up blind/pipe rams if needed.
We know that the shears' ROV override facility was unable to activate the shears and stem the blowout. Those who are familiar with BOPs know that they can slice through a drill pipe collar with ease and seal - time after time. It is obvious, therefore, that something much bigger is inside the BOP and it probably has the same internal diameter as the BOP. That can only be a wellhead casing hanger - either the 9-5/8in casing hanger or a 13-3/8in casing hanger. And that is probably what has prevented the BOP shears from closing.
If this proves to be the case, then it is also obvious that the 9-5/8in (or 13-3/8in) casing hanger lock down seal failed - permitting the hanger to be displaced vertically upwards by pressure from below. That would also mean that the casing shoe cement job was inadequate.
It may seem strange for engineers to learn that we still use Portland cement for sealing the well casings against the predrilled formation. Of course it comes with all manner of additives, but it still remains ordinary Portland cement. Surprisingly, there is no universally accepted standard for its manufacture and application. As far as I can ascertain, very little research has been undertaken to either improve or replace it - a situation that has in my opinion existed for too long.
But another larger risk exists in the form of the 21in marine drilling riser - just like the one that was hanging off the lower marine riser package (LMRP) on the Macondo well.
If a semi is going to sink - for any reason - then, apart from the potential and actual loss of life, the greatest risk to a subsea well is the collapse of the marine riser. This is a particular risk in deepwater - in this case some 1500m (5000ft) of riser collapsed to the seafloor. It was fortunate (if that is the right word) that the entire riser did not collapse over the well when its tethers separated from the semi. Had that been the case, access to the LMRP would have been nearly impossible.
The riser in question clearly folded over and buckled at the LMRP junction, which could be seen to comprise a bolted, flanged connection. Under those circumstances, it was necessary to saw through the riser in order to open access to the LMRP. The temporary funnel was then placed over the remains of the flanged connection.
And here is the very nub of the problem - the permanent flanged connection between the LMRP and the LP marine drilling riser. Had the riser been connected to the lower package using either a mechanical clamp or a hydraulic connector, this disaster would have been curtailed at a much earlier stage. The riser connector could have been released by ROV and the blowout curtailed with the introduction of a temporary HP drill stem riser, complete with an 18-3/4in hydro/mechanical connector. The surface termination would typically comprise a surface test tree.
It is unfortunate that some time will always elapse between a blowout and subsequent recovery of the situation. The sinking of the operating semi will obviously exacerbate the delay caused by the time it takes to mobilise a replacement. But no great mobilisation of additional equipment would be required, just drill stem and a hydro/mechanical connector.
The need to learn is often forgotten by the very institutions that are supposed to regulate the oil industry. Other industry sectors such as shipping, submarine, space, aeronautical and structural are similarly exposed. In some respects it is a matter of deliberate neglect and acceptable risk, ie a two-winged aircraft cannot incorporate a spare wing, just in case. But when a piece of foam insulation breaks from the hull of a space shuttle fuel tank and rips open its wing it is surely a matter of criminal neglect.
From Titanic to Ixtoc-1, the Comet, Piper Alpha, Ocean Odyssey, NASA shuttles and now Macondo, we can detect the paradigm of design infallibility. It is a dangerous frame of mind that smugly congratulates itself on having attained perfection beyond improvement.
If we are to learn from the Deepwater Horizon disaster, then the following points may illustrate the research and work that needs to be done to avert any such reoccurrence - so far as is humanly possible.
Cement
This is a general problem for the oil and gas industry both onshore and offshore, and has been for a very long time. The Macondo blowout is unusual in that it did not occur during drilling operations. It occurred while the well was being suspended for future conversion to a production well. That makes it unusual, and explains why suspicion has fallen on the cement job as one likely reason for the genesis of the blowout.
To the best of my knowledge, a fully qualified cement type does not exist for the Macondo well. The word here is 'qualified', ie strength tested under the same conditions of temperature and pressure seen in the well. Of paramount importance is the setting required to achieve the specified strength.
Pure cement paste is not very nice. Those who would dispute this fact should prepare a glass beaker full of cement grout and watch the paste settle, leaving a layer of clear water above it. Civil engineers are aware of this fact - drillers may not be so aware.
Cement pastes also benefit from the inclusion of reinforcing fibres. Some cement is offered with this addition, but more detailed research and qualification is required.
Most importantly, and until the full facts about Macondo emerge, and a suitably qualified cement emerges, the cement job at every casing shoe should be allowed to set for 48 hours before being pressure tested from above (except where a cement plug has been capped with a mechanical plug). Such pressure tests should last for 12 hours. I can already hear the howls of protest. But the facts are there for all to see. The dayrate for a deepwater semi is colossal - sitting and waiting for cement to set represents a horrendous cost. But compare that to the cost of the Macondo clean-up.
Casing hanger lockdown seal assembly
It has to be said at the outset that these items are usually foolproof, provided they are set properly and tested by overpull. But only with static, gradual applications of pressure. To the best of my knowledge no casing hanger lockdown seal has ever been tested under dynamic applications. The dynamic referred to is the 'kick' received from a blowout.
Remembering that F = mass x acceleration it can be readily demonstrated that the dynamic application of force from an accelerating fluid column will be far greater than the static application of an overpull from a semi. From an energy point of view, E = 1/2MV2 applies.
I appreciate the difficulties in qualifying casing hanger lockdown seals under dynamic conditions caused by 'kicks'. Those who would protest should remember what a small piece of insulating foam did to the wing of Columbia.
BOP shears
Everyone expects the BOP shears to be the final defence/barrier against a potential well blowout. We expect the shears to perform as promised, activated by direct hydraulic pressure applied to either side of the ram piston - always provided the two hydraulic ports are free to charge and discharge freely.
The shears can tackle drill collars without problem, but not casing hangers. The problem with most BOP shears (and there should be two such pairs in every BOP stack) is they are located too close together. A typical BOP stack will have its shears rams placed with about 8ft separation depending on the BOP configuration. This is too close. A single internal obstruction could obstruct both sets of shears. Spacing of shears should be increased to 16ft minimum.
More howls of protest? I appreciate the need for compact BOP layouts, a need born of weight and height concerns when handling BOPs in the moonpool. But one thing is absolutely certain: the configuration of BOPs has to be scrutinised as never before. I believe Harry Cameron would agree.
LMRP
The current configuration of the LMRP has an Achilles heel. It is a simple fault - the 21in marine riser is flanged and bolted to the flexjoint assembly.
When such a riser collapses from above - as it did from the Deepwater Horizon (and the Ocean Odyssey) - it buckles at the flange interface. This presented a major obstruction to the Macondo well. Subsequently we witnessed an ROV sawing the riser in order to gain access of sorts to the LMRP/BOP.
The subsequent funnel-down scavenging device has been partially successful under very difficult circumstances.
The LMRP is of course a very heavy item. It is installed over the BOP using the marine drilling riser. Without the benefit of an alternative lifting arrangement, it will have to remain stuck on the BOP. This may be the reason why BP did not attempt to recover the LMRP from the BOP to gain access to the well.
Had the marine drilling riser been connected to the LMRP with a detachable hydro/mechanical connector, with ROV override, then immediate access would have been possible. Furthermore, the lowest riser joint should have at least double the moment of resistance as the LMRP/BOP connector, thereby ensuring that the riser buckled well above the LMRP - not at the LMRP interface.
In addition, the LMRP should be run with preinstalled lifting strops to enable recovery (with ROV hook-up assistance subsea) to the surface. The foregoing details ensure that there will always be two solutions available to disconnect and recover the drilling riser - from the LMRP itself, and from the BOP while still connected to the LMRP.
Plan B
Given the foregoing provisions are in place, and that the drilling riser has been disconnected from the LMRP (or the LMRP disconnected from the BOP), access is available to contain the blowout from the well.
Plan B requires an HP riser comprising readily available onboard drill pipe, and an 18-3/4in hydro/mechanical connector. The inclusion of a failsafe retainer valve (or two) above the connector would be advisable (separate control umbilical from the surface). The use of a SSTT would be even better provided early mobilisation was possible. The topside equipment will comprise a typical STT/flowhead, hard piped to the flare.
Plan B is not perfect. When the operating semi is lost after a kick, together with the drilling riser (as per the Deepwater Horizon), hydrocarbons will escape until another semi can be mobilised. But compared with the current nightmare, it is the blink of an eye.
Where only the drilling riser is lost, the remedial action will be rapidly implemented. Summary
All rig crews and operator personnel are under pressure from the MBAs in respect of costs. Modern deepwater semis are expensive tools and tripping (for any reason) in deepwater is an expensive activity - 'waiting for cement paste to harden is an irritation - testing Portland cement paste is unnecessary'. I can hear them now.
Time for them to listen and reflect. Some of the Macondo answers may be found in this brief piece - perhaps none at all. Perhaps this piece is just a small, irrelevant piece of insulation colliding with a NASA shuttle wing. OE
About the Author
Ian Fitzsimmons, a regular contributor to OE, is an independent consultant with more than 30 years' offshore industry experience. He has worked for major operators around the world and major subsea hardware/drilling equipment contractors, and has extensive due diligence and expert witness experience. He was chief engineer for RJ Brown & Associates in London. The views expressed in this article are the author's own and do not necessarily reflect OE's position.