The Deepwater Horizon's blowout preventer was a victim of the Macondo disaster, not the perpetrator. So says consultant Ian Fitzsimmons in his latest think piece for OE which takes issue with some of the findings of DNV's forensic study of the recovered BOP and looks at ways in which BOP/LRMP stackup configuration and controls could be improved in future.
The events surrounding the Macondo disaster have been made available to the public through BP's Accident Investigation report prepared by BP (OE November 2010) and the US National Commission report to President Obama (OE March 2011). Both reports were unable to determine the reasons for the apparent failure of the BOP to seal the well. It was obvious that it would be necessary to retrieve the BOP and LMRP for internal inspection in order to resolve this issue. Prior to the Macondo disaster, the subsea BOP was regarded as the ultimate bulwark against loss of well control. Its apparent failure at Macondo was a revelation to the offshore drilling industry.
Faced with this major issue, BOEM commissioned DNV to perform an onshore forensic examination of the Deepwater Horizon BOP stack-up, after it had been recovered. DNV were also directed to establish the cause of the apparent failure of the BOP to respond to the blowout. That report (in two volumes) was issued on 20 March 2011 and has received a mixed response from the offshore industry. It has to be stated from the outset that it was always going to be a difficult task for DNV – or indeed any other independent verification body – to execute.
The offshore industry and the general public were looking for an obvious, single point failure, which could be easily explained and put right. DNV thought that it had delivered that expectation – others were not convinced. It is one thing to postulate a theory, but until the predictions of a theory have been tested and proven, it remains just a theory. And that is the problem with the DNV report. It has drawn a deterministic conclusion without any demonstrable proof.
In fact, it is still a work in progress by its own admission, as Section 8.2: Recommendations for Further Testing clearly demonstrates.
The BOP from the ill-fated Deepwater Horizon was recovered from the Macondo subsea wellhead on 5 September 2010. It emerged slowly from the sea almost as if ashamed to face the world. Heaped with opprobrium, this gentle giant and its LMRP were separated and transported to the NASA Michoud West Dock Test Site, Louisiana, where they arrived and were offloaded on 3 October 2010.
No detailed record has been published that accounts for the daily status of the BOP/LMRP during the four weeks described above. Anecdotal evidence described at the 4 April 2011 meeting of the BOMRE committee confirms that the BOP rams were functioned during this period. It is also public knowledge that subsea ROV activities had altered the status of many key BOP functions after the blowout and prior to 5 May 2011 when all BOP/ROV intervention activities ceased.
It can be stated with certainty, therefore, that when the BOP arrived at the test site on 3 October, its status/condition did not reflect that which pertained at the time of the first explosion that occurred on Deepwater Horizon at 21:49 on 20 April 2010. In fairness to DNV, it has to be said that nobody expected the internal photographic evidence to reveal such severe erosion of drill pipe and rams, and the total absence of elastomeric seals, which are obligatory for the safe operation of the BOP. It appears that much critical evidence had been washed away by the erupting, aggressive well fluids, including metallic drilling debris and reservoir sandstone/ minerals.
This horrendous, aggressive erosion lasted from the start of the blowout on 20 April 2010 until the well stopped flowing through the BOP after the well had been plugged on 19 September 2010. Five months of aggressive grit blasting had made an already difficult forensic examination even more so. The evidence of compacted mineral debris found in the rams, cavities and drill pipe further confirms the ferocity of the blowout, which has been likened by one witness as ‘a 500 ton freight train hitting the rig floor', and by another as ‘a jet engine's worth of gas coming out of the rotary' – and it was taking the evidence of the cause of the disaster with it. But one inevitable and unavoidable fact remains – neither the BOP nor the annular preventers in the LMRP sealed the well, regardless of the best efforts made to control the blowout between 20 April and 5 May 2010.
Even Sherlock Holmes would have had difficulty cracking this case. For DNV, awarded the investigation that nobody else wanted, it may well have reawakened memories of the Alexander Kjelland disaster which claimed 123 lives in the Norwegian sector of the North Sea back in March 1980.
MMS The US Minerals Management Service (MMS) became a casualty of the Macondo disaster. It was roundly criticised by the National Commission and completely reorganised, with BOEMRE established to take responsibility for offshore activities.
Some good people worked for MMS. Long before Macondo, they were unhappy about subsea BOP shear ram capabilities and operational failings. In 2004, MMS commissioned West Engineering Services, an engineering house with a well deserved, worldwide reputation for excellence, to investigate its concerns. West specialises in offshore drilling and rig activities for both engineering and operational support activities offshore.
West's report is best summarised by quoting directly from the document, starting with the Executive Summary: ‘West was commissioned by the US Minerals Management Service to perform the Shear Rams Capabilities Study. The main goal of the study was to answer the question – Can a rig's blowout preventer (BOP) equipment shear the pipe to be used in a given drilling program at the most demanding condition to be expected, and at what pressure? Shear rams may be a drilling operations' last line of defense for safety and environmental protection.'
‘Code of Federal Regulations, Title 30 Mineral Resources Chapter II . . . asks in 250.416 (e): What must I include in the diverter and BOP descriptions? And the answer is stated as: Information that shows the blind-shear rams installed in the BOP stack (both surface and subsea stacks) are capable of shearing the drill pipe in the hole under maximum anticipated surface pressures. Therefore, an operator is responsible to assure the BOP rams will reliably shear the drill pipe in the particular operational conditions.'
There can be little doubt that six years before the Macondo disaster, MMS were worried about blind shear rams. But it should be noted there is no mention of shearing tool joints. Rather than go into the full details of the report (www.westengineering.com), I will again quote from page 3-1, par 3.2, Understanding the Shear Function:
‘The well control function of last resort is to shear pipe and secure the well with the sealing shear ram. As a result, failure to shear when executing this final option would be expected to result in a major and/or environmental event. Improved strength in drill pipe, combined with larger and heavier and heavier sizes resulting from deeper drilling, adversely affects the ability of a given ram BOP to successfully shear and seal the pipe in use. West is currently aware of several failures to shear when conducting shear tests using the drill pipe that was to be used in the well.
‘As stated in a mini shear study recently done for the MMS, only three recent newbuild rigs out of 14 were found able to shear pipe at their maximum rated water depths. Only half of the operators accepting a newbuild rig chose to require a shear ram test during commissioning or acceptance. This grim snapshot illustrates the lack of preparedness in the industry to shear and seal a well with the last line of defense against a blowout.'
In the final paragraph of 3.2 we find the following:
‘Unfortunately, not all operators and drilling contractors are aware of the limitations of the equipment they are using. This study examines existing shear data and inconsistencies in an attempt to better understand the likelihood that the rams will function as expected when activated.'
The foregoing report is dated September 2004 and readers will draw their own conclusions. West and the MMS had given operators and drilling contractors alike fair warning about the risks and operational security of BOP shear rams.
Tuesday 20 April 2010 At 20:00 and following a failed, but presumed successful, negative pressure test, the Deepwater Horizon drill crew began displacing heavy mud from the well bore by circulating it with lighter seawater. The tragedy was under way, because hydrocarbons had already entered the wellbore by this time, as a review of the evidence of the failed negative pressure test clearly demonstrates.
At 21:00, drill pipe pressure (at the drill floor) started rising when it should have been falling. Nobody tried to explain why the pressure was increasing while the pump rate was not. The kick was under way, but nobody noticed. Had they done so, they could have shut-in the well and averted a major disaster.
At 21:41, mud overflowed onto the drill floor. Witness accounts suggest that soon after, a crew member activated the upper annular preventer. It was slow to close, but it did not seal.
At 21:46, rapidly rising drill pipe pressure readings suggest that someone activated the upper VBR. But it did not seal.
At 21:49, the first explosion occurred, followed immediately by a second explosion.
At 21:56, the Master of the Deepwater Horizon announced the activation of the EDS. It was a futile gesture. By this time, the two BOP MUX control cables and the hydraulic umbilical had already been severed by the explosion. This complete loss of communication with the Deepwater Horizon should have activated the BOP/AMF ‘deadman'. It did not. Both control pods were defective and could not respond.
Deepwater Horizon went to her grave in 5000ft of water at 10:22 on Thursday 22 April 2010, taking 11 men with her.
ROV intervention to try to shut-in the BOP began at 18:00 on 21 April and lasted until 5 May. It is possible that, after the autoshear hydro mechanical rod had been sheared by ROV on 22 April, the BSRs became partially closed. But in spite of repeated, ongoing attempts to close the BSRs, the well continued to flow.
BOP configuration
The complete stack up of the Deepwater Horizon blowout preventer is about 60ft high and weighs about 400t. It is illustrated in the DNV report and reproduced left.
The upper section of the stack up is described as the Lower Marine Riser Package (LMRP) and contains the BOP connector, two annular preventers, flex joint, and two electrohydraulic control pods.
The annular preventer comprises a high pressure body that contains a large elastomeric doughnut. This doughnut can be forced/squeezed by internal hydraulic rams to seal around the internal drill pipe and thereby seal the LMRP annulus. It is normally regarded as the first piece of equipment to be activated in any well control event.
The lower section of the stack-up comprises the BOP. It contains the upper Blind Shear Ram (BSR) and a Casing shear Ram (CSR). The BSR can shear and seal drill pipe, but cannot shear and seal tool joints under normal conditions. The CSR can shear tool joints and large casings, but cannot pressure seal the BOP bore.
Beneath the CSR are three Variable Bore Rams (VBRs) with internal adjustable elastomeric seals. These rams can close around variable diameter drill pipe and tool joints and seal the BOP annulus.
It should be noted that, apart from the CSR, all the rams and preventers depend on elastomeric seals for their sealing integrity. All the rams and annular preventers are operated by hydraulic power supplied from the surface rig and distributed by the control pods.
The BOP was supplied by Cameron and is about ten years old. If it has an Achilles heel, it is the inability of the BSRs to shear and seal tool joints. However, this issue can be overcome operationally by the driller locating the tool joints distant from the BSR when the BSR needs activation. This operational determination of the tool joint location when passing through the BOP bore is normal practice, and works well under controlled situations.
Such was not the case for the Macondo disaster.
BOP stripping
The annular preventer comprises a large, one-piece rubber doughnut, which can be forced/squeezed by hydraulically activated metallic rams onto the drill pipe, and tool joints. It can cope with large variations in pipe OD. This enables drill pipe and tool joints to be ‘stripped' (pulled) through the doughnut, while still providing well control. Two such annular preventers were located on the LMRP. The Variable Bore Rams in the BOP have a similar capability, except a pair of (split) rams is required to seal around the drillpipe/tool joint external perimeter to close the BOP annulus. It has to be said at the outset, that stripping drill pipe and tool joint through an annular preventer is not good practice when executing well control issues. It may be expedient, but it is not desirable. The OD of a typical tool joint for 5.5inOD drill pipe is about 7.5in. The transition comprises a sloping shoulder.
Pulling the tool joint through an annular preventer obviously damages/impairs the internal elastomeric doughnut. To offset this abrasion and degradation, it is common practice to bleed off pressure in the annular preventer so as to ease the passage of the tool joint through the doughnut. It is a subjective and therefore risky operation. It is neither controlled nor deterministic and it should be avoided.
A look at the Macondo BP Accident Report (page 22) confirms that stripping had already been used during an earlier well control event. The record for 5 and 6 March states: ‘Stripped drill pipe through upper annular preventer from 17,146ft to 14,937ft, while addressing wellbore losses'. Some 45-55 tool joints had been stripped through the upper annular doughnut during a well control procedure.
But much more was to follow.
After the first explosion, all rig power was lost, and all Sperry Sun real-time data transmission ceased. Without any power, the DP system was disabled, and Deepwater Horizon began to move off station. But although Deepwater Horizon was drifting, she was still tethered to the LP drilling riser, which was suspended by constant tension winches located on the rig.
In addition, and to compensate for relative heave motion between the fixed LP riser and the topside drilling facilities, a slip joint is provided which connects the LP riser to the drill floor underside diverter pipe work. The slip joint behaves like a telescope and similarly has a finite travel range before coming up against predetermined mechanical/structural stops.
In parallel, the drillpipe being used to circulate mud from the LP riser was suspended from the motion compensated top drive assembly in order to maintain a constant depth for the tip of the drillpipe.
The top of the drillpipe above the drill floor was connected to an internal blowout preventer (IBOP). The various reports do not contain details of the IBOP configuration, but I guess a dual valve isolation block and connecting flowspool were used. The flowspool would be suspended from above by the topdrive assembly, and laterally connected by flexible hose to the HP WI/mud pumps, as shown in the figure above reproduced from the BP Accident Report.
A witness report carried in the BP report, observed that after the explosion ‘the top drive fell about 26ft onto the drill floor'. We can assume that about 8000ft of drill pipe went with it. The exact status of the upper VBR and both annular preventers at that time is not clear from the reports, but it is most likely that the upper annular had been partially closed, and drillpipe was stripping down through it – uncontrolled. A passing tool joint in freefall would have caused considerable damage to the rubber doughnut.
As the rig drifted off station, the drillpipe suspended by the collapsed topdrive on the rig floor was stripped upwards through the annular preventer again.
The constant tension winches supporting the LP riser from the main deck began to pay out and the slip joint began to expand. The slip joint came to the end of its travel and the LP drilling riser became a mooring line for the Deepwater Horizon.
When the condition of the upper annular preventer was discovered by DNV during their forensic examination, no doughnut was present – just the tortured remains of the steel fingers that were used to squeeze the doughnut in happier times. But no sign of a tool joint.
BOP control system
The schematic above, reproduced from BP's Deepwater Horizon investigation, shows the BOP control system and the BOP stack illustrates the umbilical, SCM and accumulator arrangements.
The autoshear rod can be seen beneath the yellow control pod. It is a hydro-mechanical arrangement whereby retraction of the LMRP releases HP hydraulic fluid to the BSRs. In the aftermath of the disaster it was eventually sheared by ROV intervention, thereby simulating release of the LMRP. It is thought this activity partially closed the BSRs. But by that time, the elastomeric seals had been blasted away and the BSRs, VBRs and annular preventers were no longer sealing.
The arrangement of the two surface MUX cables and the hydraulic umbilical can be seen in the graphic below, reproduced from the BP Accident Investigation report. One cable is provided for each control pod (SCM), and each SCM duplicates control of all BOP/LMRP functions. A single umbilical supplies hydraulic power to each SCM for distribution to the BOP/LMRP functions.
The foregoing arrangements therefore comprise a fully redundant control system.
It is immediately obvious that the first explosion would have severed both MUX cables and the hydraulic umbilical, thereby rendering the subsea control system inoperable.
This meant that activation of the BOP subsea emergency control system would become totally dependent on power supplied by the battery packs in each control pod, and the subsea accumulators. Fully functioning control pods would also be required. Unfortunately the emergency systems did not activate because the SCMs were faulty and inoperable, as was subsequently discovered and determined.
The figure reproduced above (from the BP Accident Investigation report) is a simplified schematic of the AMF (Automatic Mode Failure) control system. The blue pod was inoperable because both battery packs had failed, rendering solenoid valve 103B unable to discharge to the BSRs.
The yellow pod was also inoperable because the 27V battery pack suffered low voltage and solenoid valve 103Y had failed. As such, it was also unable to discharge to the BSRs.
BOP operation
The normal operation of the BOP faced with a well kick is by manual intervention from the well control panel on the rig. In the first instance, the annulus between the drill pipe and the BOP is sealed by closing the annular preventer above the BSR, and the VBR immediately beneath it.
In a parallel activity, the IBOP located on top of the drill pipe head is closed. The IBOP typically comprises isolation valves in a flowhead/topside test tree type configuration. The flowspool/ STT is connected to the HP mud pumps by a flexible pipe.
Once the kick has been arrested, the way is then clear to stabilise the well by circulating down the drill pipe with mud/ brine and returning it to the surface through the HP kill/choke lines on the BOP.
In addition to manual control of the BOP, further progression to emergency modes of well control are available and are illustrated by the figure reproduced above right from the BP Accident Investigation report.
(a) BSR closure The first step to emergency mode of BOP operation (if necessary) requires activation of the BSRs to shear the drill pipe and seal the well bore. The reader will note that the foregoing manual activation of the annular preventer and the VBR has centralised the drill pipe through the BSRs.
In the event that a tool joint is located between the BSR blades and they will not close/shear, the blades are retracted and the tool joint is stripped upwards through the upper annular. The BSRs are then reactivated and the drill pipe sheared. The BOP bore has been sealed.
As an alternative, and if super shear rams have been included within the BOP configuration, the BSR blades are retracted and the CSRs activated to shear the tool joint. The tool joint is then stripped through the upper annular preventer and the BSRs reactivated – if so required. The BOP bore has been sealed. The foregoing is normal procedure after the early detection of a well kick. The seals in the BSRs, VBRs and the annular preventer will not be exposed to well fluids – they will see only brine and/ or drilling mud. The kick can be prevented.
The foregoing is not intended to arrest a blowout already in progress, as indeed was the case when the Macondo volcano erupted uncontrollably at the drill floor. The well fluid blowout undoubtedly contained reservoir sandstone and cement particles, exposing thevelastomeric seals to aggressive and unstoppable erosion.
And that is exactly what happened.
(b) Emergency disconnect system (EDS) The EDS function is initiated manually from the control panel on the rig. It is initiated in the event of DP failure, whereby the rig cannot keep station. The EDS is intended to disconnect the LMRP from the BOP and in so doing activate the BSRs via the autoshear hydromechanical interface connection.
The EDS cannot work without at least one MUX cable and the hydraulic umbilical from the rig being intact.
(c) Automatic mode function (AMF) This system automatically activates the BSRs when all communication and hydraulic power through the rig umbilicals has been lost (as was the case with the Deepwater Horizon. Activation requires a fully operational control pod, fully charged batteries, and fully charged accumulators.
(d) ROV intervention The foregoing systems can be overridden by ROV intervention. In the case of Macondo, ROV intervention successfully activated the EDS by cutting through the autoshear rod that interfaces the BOP and the LMRP, thereby simulating the EDS described above.
But repeated ROV intervention between 21 April and 5 May failed to stem the flow of the well, although the BSRs may have been partially activated during this period.
The wreck site
Judging by photographic evidence, we can say that even after the first explosion, the fire ball inferno was emerging from the deck(s) of the Deepwater Horizon – not from the sea surface. From this we can assume that the LP riser was still attached to the Deepwater Horizon constant tension winches.
The wreck of the Deepwater Horizon lies about 400m north and 150m west from the Macondo wellhead on a heading of 322°. The hull lies on the seafloor upside down, the underside of her pontoons facing upwards. She is submerged in deep mud that has buried her deck, derrick and drilling facilities. The figure below, reproduced from the US Coast Guard report, illustrates her unhappy and immodest grave.
Although Deepwater Horizon was stationed by DP thrusters, their loss soon after the explosion left her free to drift. However, she did in fact have an ‘anchor' – the LP drilling riser. It was suspended from Deepwater Horizon with constant winches.
The wreck of the Deepwater Horizon lies about 400m north and 150m west from the Macondo wellhead on a heading of 322º. The hull lies on the seafloor upside down, the underside of her pontoons facing upwards. She is submerged in deep mud that has buried her deck, derrick and drilling facilities. The figure below, reproduced from the US Coast Guard report, illustrates her unhappy and immodest grave.
Although Deepwater Horizon was stationed by DP thrusters their loss soon after the explosion left her free to drift. However, she did in fact have an 'anchor'-the LP drilling riser. It was suspended from Deepwater Horizon with constant tension winches to generate tensile stress at the base of the riser where it joined the flex-joint LMRP. Being constant tension winches, they would be able to cope with vessel heave and drift within normal operational limits.
The LP riser is connected to the underside of the drill floor with an LP telescoping slip joint that compensates for differential movement between the top of the LP riser and the underside drill floor/diverter system.
The slip joint does not have unlimited travel – probably not more than 15m in total (±7.5m from neutral). When it comes to the end of that travel with mechanical/structural stops around the sliding rim interface, the LP drilling riser becomes a ‘mooring line'.
An eyewitness account states that he saw the topdrive ‘block' fall to the drill floor – about 30ft – before he escaped from the Deepwater Horizon. We have to assume that the entire length of internal drill pipe was then suspended from the drill floor rotary. As a result, the internal drill pipe moved vertically downwards with respect to the subsea BOP, stripping through the upper annular preventer, which we are told was ‘closed' at the time.
A witness observed and reported that, as the Deepwater Horizon turned turtle before beginning the descent to her grave, the riser parted from her. We can assume that the internal drill pipe must then have fallen downwards with respect to the subsea BOP again.
From the foregoing, we have to assume that this final event initiated the collapse and buckling of the LP riser above the LMRP flex-joint. The drill pipe so released may well have fallen back into the well before being arrested, either by the buckling of the LP riser, or by the intervention of a tool joint becoming stuck in a BOP component, such as a VBR.
DNV report
Few would have wished to participate in the forensic examination of the Deepwater Horizon/Macondo BOP. Fewer still would have wished to draw any deterministic reason for the apparent failure of the BOP, particularly since there is no guarantee that the received condition of the BOP/LMRP at the Michoud facility bears any relation to its condition at the time of the blowout.
Careful reading of the DNV report will reveal that the BOP became a victim of the Macondo disaster, not the perpetrator.
If my car cannot start because I have allowed the battery to go flat, I am at fault – not the car. If I cannot drive my car because it has a flat tyre – that is also not the fault of the car. And if my engine refuses to start because it does not have any fuel, I am at fault because I have failed to refill – that again is not the fault of the car. An obvious point, but I will risk offering one further amplification: BOPs are designed and qualified to prevent blowouts, not a volcanic eruption that has already been in full swing for 15 minutes.
Photographic evidence from the DNV report vividly demonstrates the terrible damage inflicted on the BOP rams and elastomeric seals by erupting well fluids, sandstone rocks, drilling debris, and cement fragments.
The report also concluded that when the BOP ram stems were tested by direct activation from a hydraulic source, they all closed and opened correctly in a timely fashion.
Faults, both electronic and hydraulic, were found throughout the BOP control system when it was examined and tested. When the faulty pieces of equipment were replaced, the EDS and AMF systems were tested satisfactorily, as was the autoshear system.
‘The Upper and Middle VBRs had to be retracted and removed in order to secure a safe hold on the drill pipe segment. There was a significant amount of cementitious material in the wellbore between the Upper and Middle VBRs that had to be chiselled out and removed by hand before the Middle VBRs could be retracted.' I know of no BOP qualified to shear drill pipe filled with cement debris so compacted that it has to be manually chiselled out of the wellbore and drill pipe!
Strangely, having identified this as part of its forensic remit, DNV chose not to consider it when forming its postulation of the failure mechanism.
What is ‘considered' to have happened
The forensic examination and testing by DNV was comprehensive – especially when considering the uncertainties it faced at the time. Unfortunately it failed badly when it came to postulating the reason for the failure of the BSRs. A further setback was delivered at a public hearing when Cameron demonstrated that the failure mode postulated by DNV could not have existed in practice.
DNV postulated that at least 3000ft of drill pipe had been uplifted by the force of the blowout and a tool joint became lodged in the upper annular preventer. Subjected to extreme dynamic forces (presumably compressive), and restrained laterally by the VBR, the drill pipe buckled and in so doing went off-centre before lodging against the bore of the LMRP/BOP.
DNV claimed that, because the BSR blades did not intersect the entire extent of the BOP wellbore, the drill pipe could not have sheared in this extreme location. As such, the drillpipe was pinched by the ram blocks so that the blade could not close to complete the shearing process.
DNV heralded the inability of the BSRs to intersect the entire BOP bore as though it were some new discovery. Far from it. This is an acknowledged consequence of having elastomeric, perimeter seals around the ram blocks and it is managed operationally by first closing the annular preventer above the BSR, and then the upper VBR immediately below it. The drill pipe is now centralised and ready to be sheared – as was the case with the Macondo BOP.
Further flaws appeared in the DNV postulation, for example:
Although DNV/BOEMRE did test the closure times and activation pressures for the BOP rams, they did not actually replace the damaged blades and attempt to shear drill pipe. That was a major omission in this forensic exercise. They might then have filled the drill pipe with compacted, lean concrete and repeated the shearing exercise. But they did not. Did determining the truth perhaps take second place to meeting a tight deadline on this occasion?
Postulation is just that. It is a suggestion made in the absence of hard facts. To support the postulation, BOEMRE and DNV should have run tests to see if they could recreate the event they had described, before announcing it to the world.
Indeed, examination of the DNV report reveals that is just what they recommended for future work.
What ‘actually' happened
As has been discussed in earlier OE articles over the past year, the Macondo disaster was manmade and it is the human element that has to be improved. But this piece is about the BOP, a gentle giant summoned to do the impossible but shackled at every turn it seems.
Here, in my view, is what actually happened to it:
Shutting the stable door
This tragedy will undoubtedly emphasise the need for better training of drilling crew personnel (including annual, compulsory simulator training), and rigorous maintenance of BOP systems. But just as important is a review of the BOP that became a victim of the Macondo disaster, not the perpetrator. From the outset, I have to make the following points:
But it does occur to me that the industry needs to adopt a safer BOP stack-up configuration. Things that went disastrously wrong here could still have been controlled with a revised BOP configuration along the following lines.
If there is an Achilles heel in current BOP stack-ups, it is the inability of the BSRs to shear tool joints. Tool joint locations are usually measured and determined from the drill floor so as to avoid any conflict with the BSRs. In a controlled situation this works well; in an uncontrollable situation, it does not.
The inclusion of a second set of BSRs within the BOP would resolve this issue.
The use of twin MUX cables and twin control pods appears to reflect the prerequisite for a secure system since, on the face of it, this would seem to remove the possibility of a major single point failure. Unfortunately it does contain the possibility of a single point failure represented by the integrity of the drilling riser. When that is lost, so is the operation of the control system and the ESD system.
We have also seen that gathering both cables and the hydraulic umbilical to a single location around the drilling riser exposes them all to the same risk of fire and explosion and loss of the drilling riser.
If both MUX cables and the hydraulic umbilical are lost, as was the case, we are then dependent on the self- standing AFM system to function – which did not happen because both control modules were inoperable due to either poor maintenance or in-service failures.
A separate direct hydraulic umbilical is required to control the BOP/LMRP safety critical functions (BSRs, autoshear, LMRP disconnection etc), and it should be run from a separate, stand-off support vessel. Failing that, the direct hydraulic umbilical could be run as far away from the drilling riser as possible, and at an extreme, safe location on the rig.
If there is room for improvement in respect of the BOP stackup used on the Deepwater Horizon, it is the use of two annular preventers located on the LMRP. I appreciate this arrangement optimises the height of the individual BOP/LMRP components, but it does separate the BSRs from the first annular preventer by inclusion of the BOP connector.
In order to allay any doubt about off-centre drill pipe through the BSRs, the lower annular preventer should be located on the BOP immediately above the BSRs. This is well established, operational drilling practice and should be maintained as such.
The connection of the drilling riser to the LMRP is flanged. Macondo has demonstrated that in respect of a collapsed drilling riser, and to facilitate any emergency well capping equipment, the flanged connection should be replaced by a more efficient, quick disconnection system.
The flanged connection should be replaced by an hydraulic connector, also under the secondary control of the direct hydraulic umbilical standby.
It may sound fanciful, but I wonder it is possible to instrument a BOP to give warning to the driller that a potential blow out is on its way? This would be particularly valuable when dealing with deepwater risers.
Subsea xmas trees are routinely equipped with non-intrusive sand detectors and multiphase flowmeters. It may be possible to extrapolate this technology to enable the driller to ‘hear' the blowout at an early stage, rather then being dependent on measuring mud returns (which did not happen during the Macondo blowout).
A joint industry study should be established to investigate of possibility of providing enhanced BOP instrumentation to give early warning of an erupting blowout.
Finally, if something could be done to improve the performance and durability of the raw elastomeric seals used in BOPs it would be a major improvement. DNV also commented on this consideration and it is definitely worthy of serious consideration.
Would metal tipped/faced elastomeric seals – similar to those used for XT/wellhead applications – be a possible solution?
The kind of measures listed here would represent a very small investment when compared with the reported $20 billion cost of the Macondo disaster. More importantly they would have improved the survival chances of the Deepwater Horizon and the 11 crew members who perished, and might even help cut the risk of a Macondo-like tragedy ever happening again. OE
© Ian Fitzsimmons, June 2011
Ian Fitzsimmons, a regular contributor to OE, is an independent consultant with more than 30 years' offshore industry experience. He has worked for major operators around the world and major subsea hardware/drilling equipment contractors, and has extensive due diligence and expert witness experience. He was chief engineer for RJ Brown & Associates in London. The views expressed in this article are the author's own and do not necessarily reflect OE's position.
Author's note: At the time of writing, I am advised that the final Macondo report from BOEMRE is due on 27 July. I hope it has something constructive to say. And something far more constructive, one must hope, than the vacuous, hapless remarks offered by the UK's Health & Safety Executive in its letter (‘Mailbag', OE April) responding to my previous Macondo piece.
Subscribe
