The explosion and fire that destroyed the drilling rig Deepwater Horizon on the night of April 20 was a run-of-the-mill industrial accident. In saying this, I don’t mean to make light of the disaster, in which 11 workers perished. Nevertheless, it’s important to recognize that events like this one have happened before. They happen all the time. Just two weeks earlier, an explosion in a West Virginia coal mine killed 29 workers. A refinery fire in Anacortes, Washington, killed seven on April 2. In February six workers died in a natural gas explosion at a power plant under construction in Connecticut. In January, leaking phosgene gas killed an operator at a West Virginia chemical plant. Looking back a few years further, a 2005 fire at a BP refinery in Texas City, Texas, killed 15 workers and injured 170 more. There was another fatality at the same refinery in 2008. Texas City was also the site of a fertilizer explosion in 1947 that destroyed much of the port and left almost 600 dead. Then there’s the Bhopal catastrophe, where toxic fumes from an insecticide plant suffocated thousands of residents of nearby neighborhoods.
Still another accident that belongs in this sad catalogue is the destruction of the Piper Alpha platform in the North Sea oil fields. Piper Alpha was not a drilling rig but a production platform; it pumped oil and natural gas from completed wells to a terminal in the Orkney Islands. On the night of July 6, 1988, a huge explosion shattered the main part of the platform, and a subsequent fire consumed the rest; 167 crew members died. The apparent cause was a miscommunication: The night shift tried to start up a pump, not knowing that the day shift had removed a crucial valve for maintenance, leading to a massive leak of flammable gas.
It’s a bitter truth: Industrial accidents are business as usual. Death on the job is a cost that we (as a society) are evidently willing to accept and pay. When a mine collapses or a sugar refinery explodes, we read the story in the newspaper and we watch the film at 11, and then we grit our teeth and move on. The Deepwater Horizon sinking is just another in this long series of mishaps.
And yet it’s also totally different. This accident has consequences that reach beyond the workers and their families. A hole in the bottom of the ocean has been spewing hydrocarbons for six weeks. The rate of loss could well be a million gallons a day. Efforts to control the well are still under way, but if they fail the spill might go on for another three months. All that makes for a nightmare that doesn’t drop out of the news cycle after the first 24 hours.
In this respect, Deepwater Horizon may turn out to be not another Piper Alpha but another Three Mile Island. The 1979 accident at that nuclear power station had lasting consequences: We haven’t built another nuclear plant in the U.S. in the 30 years since. (There are other reasons for the long lassitude of the nuclear industry, but TMI was a major factor.) Likewise, in the aftermath of Deepwater Horizon, it seems a fair guess that we won’t be drilling another deep offshore well anywhere near the U.S. coastline for years to come, and maybe decades. Maybe never.
A moratorium on offshore drilling, enforced by economic as well as legal and political pressure, looks like a perfectly sensible response to the current situation. But we deserve more. By all means, let’s do whatever necessary to avoid repeating this particular mistake, but at the same time let’s address the broader issue of why things all over the industrial landscape keep blowing up and falling down.
Will we ever learn what happened on the Deepwater Horizon? There are certainly a lot of investigators trying to find out. Three Congressional committees have heard testimony already. A board of inquiry formed by the Coast Guard and the Minerals Management Service is holding its own series of hearings. So is a state panel in Louisiana. On May 11 President Obama asked the National Academy of Engineering to look into the cause of the accident, then on May 22 he appointed a special commission to carry out yet another investigation. Meanwhile the Justice Department is studying possible civil or criminal penalties.
For all that effort, we sure haven’t learned much yet. The well is leaking, but BP isn’t. It’s amazing how they’ve managed to keep the public and the press at a distance; the one art they seem to have mastered is secrecy. Even friendly trade publications (e.g., Oil and Gas Journal, Offshore) have so far failed to penetrate the security cordon. In the end, though, the story will come out. We’re going to learn why that blowout preventer didn’t prevent a blowout. But I’m not so confident we’ll learn how to prevent the next blowout.
The only blowout preventer I’ve ever seen up close and personal was on a drilling rig near Oklahoma City in 2004. At the time, I thought it was quite a brawny-looking piece of gear, with all those rings of torqued bolts clamping the flanges together, and the big red hydraulic rams like pincers clasping the pipe. Apparently, this unit is puny compared with the BOP stack installed on the Deepwater Horizon well (“five stories tall” in news accounts). Still, the principle of operation is the same: If the well “kicks”—meaning that gas and oil begin to push their way toward the surface—the rams close off the well and keep everything sealed tight. Some rams are meant to choke off the annular space around the drill pipe; some are “blind rams” used when no drill pipe is present in the bore; the last resort is a pipe ram or shear ram meant to crush or cut off the drill pipe.
It sounds foolproof, but evidently not. Controls can stick, valves can leak, parts can break. I’ve read speculation that the shear ram on the BOP beneath the Deepwater Horizon might have failed because it happened to strike a thicker-walled section of drill pipe where two lengths of tubing are threaded together; I really hope that’s not a serious concern, because it would mean that every BOP on the planet has a failure probability of 3 percent. (Drill pipe comes in 30-foot lengths, and the thickened sections are about a foot long.)
A 1997 article in Offshore lists a fascinating variety of other failure modes for deep-water wells. The article is by Larry H. Flak of Boots and Coots—a company often called in to deal with crises like this one. Flak is writing for an audience of oil-patch insiders, and I don’t follow all of his jargon. For example, there’s this wonderfully opaque passage:
Broached blowouts could happen with casing failure. Recently, an ultra-deepwater operator swabbed in a kick resulting in over 9,000 psi on the subsea BOPs. Fortunately, the casing was sound and set just on top of the sand. This allowed safe kick bullheading.
Even for those of us who have never bullheaded or swabbed in a kick, the message comes through: A lot can go wrong. A well is not just a hole in the ground; it’s a fairly complicated structure with multiple concentric layers of casing and drill pipe, which create several interconnected annular spaces; fluids under pressure can find many pathways to the surface. Flak points out that even the massive steel blades of a hydraulic ram can be torn to pieces by high-velocity streams of abrasive fluids, such as drilling mud. He concludes: “Blowout control options in ultra-deepwater are very limited. Blowout prevention is of paramount importance.”
When the story of the Deepwater Horizon accident is finally told, we’re going to hear at least two interpretations. In one telling, BP and its contractors were incompetent or negligent or criminally greedy; they screwed up. But the basic technology of offshore drilling is sound, and if only the companies had followed established industry practices and common sense, none of this mess would have happened. In the other version, BP and its contractors were incompetent or negligent or criminally greedy; they screwed up. But even if they had followed approved industry practices, a disaster like this was waiting to happen, because the technology of offshore drilling is fatally flawed. I really wish I knew which of these stories to believe. I worry that we lack the institutional means to decide between them.
• • •
I’m a great admirer of the National Transportation Safety Board. When an airliner crashes or a couple of commuter trains collide, the NTSB mounts a focused, scientific effort to understand the cause of the accident. Investigating accidents is all they do, and this turns out to be a key to their success; they are insulated from the responsibilities and temptations of regulating the industry, adjudicating legal culpability, assessing penalties or even enforcing their own safety recommendations. Separating the investigative and regulatory functions has worked brilliantly, and the board’s findings command wide respect. But the NTSB won’t be investigating the Deepwater Horizon blowout, because the event doesn’t fall within their statutory purview; it’s not a transportation accident. There’s also a Chemical Safety and Hazard Investigation Board (CSB), which has had a similar role in the chemicals industry since 1998. You might think that petroleum would count as a chemical substance, but as far as I can tell the CSB will also be sitting this one out. Their mission statement says: “The CSB conducts root cause investigations of chemical accidents at fixed industrial facilities.” The Deepwater Horizon wasn’t “fixed.”
So here’s my call for action: We need a single agency, modeled on the NTSB and the CSB, with authority to investigate all accidents involving industry or infrastructure—everything from well and refinery fires to water-main breaks, power blackouts, mine cave-ins, bridge and dam failures, boiler explosions and sewage spills. I believe we’re under a moral imperative to learn all we can from every such accident, in the hope of preventing a recurrence. A permanent, independent agency with investigative authority, in-house expertise and technical resources looks to me like the best way to reach this goal.
After the 2005 refinery fire in Texas City, BP hired James Baker III (the former Secretray of State) to convene a special of inquiry into the company’s safety practices and culture. The Baker panel report observed that BP had an admirable record on personal safety but cited deficiencies in process safety. Personal safety says: Wear your hardhat, your eye protection and your steel-toed boots when you go out in the plant to open a valve. Process safety says: Make sure you open the right valve, not the one that’s going to create a fireball that engulfs the whole plant. The report remarks: “BP mistakenly interpreted improving personal injury rates as an indication of acceptable process safety performance.” On April 20, BP executives flew out to the Deepwater Horizon to celebrate a personal safety milestone on the rig: no loss-of-work accidents in seven years. The executives were still on board when somebody turned the wrong valve.
Note: I have posted a PDF of the oil and gas chapter from my book Infrastructure: A Field Guide to the Industrial Landscape on the book’s web site.
Update 2010-06-21: A superb report on the failure modes of blowout preventers was published this morning in The New York Times. The article is by David Barstow, Laura Dodd, James Glanz, Stephanie Saul and Ian Urbina. Nothing they say is reassuring.
With due respect, I think you are missing the point.
Yes, accidents like this happen all the time. And had this one happened on shore or in shallow water, it would have been fixed by now.
What I — and all of the science/engineering types I know — find so stunning is that we lack the ability to stop the leak. How is it that we have the technology to dig a hole 40 miles off shore, 1 mile under water, and 5 miles deep, but lack the technology to fill it in again?
And given that we lack that technology, what the *^#@ were we thinking digging that hole in the first place?
Seriously, how much hubris and greed does it take to tear a hole in the earth that you know you cannot mend? That is the problem, not the accident itself. That arrogance, combined with our insatiable demand for cheap oil, is what annihilates ecosystems.
Until the human race develops the technology to respond to disasters at these depths, we simply have no business being down there. None whatsoever.
Controls can stick, valves can leak, parts can break.
“Fail-safe systems fail by failing to fail safe.” –John Gall, Systemantics
Unfortunately, there is a third competing story (and who knows, it may even turn out to be true): that BP did everything right, and that the accident was really an accident, unforeseeable and unpreventable. Surely this is the tune that BP itself will sing when it opens up.
I think your point about separating investigation of the accidents causes, from deciding what to do about it is a very valid.
Great article !
@John Cowan
I don’t think that BP and/or TRANSOCEAN did everything right. They tried a LOT of different options to stop the leak which failed.
http://en.wikipedia.org/wiki/Deepwater_Horizon_oil_spill#Attempts_to_stop_the_oil_leak
This shows clearly that BP/TRANSOCEAN don’t have any clue what technology could really stop the leak.
Now given the fact that they drilled DEEPEST oil well in history - Why the hell they made an assumption that standard leak-stopping procedures would work in such depths ?
From this I can only make conclusion that they DIDN’T tested/calculated/examined deep water leak-stopping procedures before. And this is so arrogantic, stupid, destructable and greedy way of doing business which I could ever imagine.
—–
Sometimes business makes VERY risky projects for the very big planned income. But as this incident shows - such way of doing business should be terminated in any way.
—-
BTW. Current global economy crisis can be analyzed as another very risky management of loans in BANK’s. (Too easy conditions for getting loans). And here we are !
—-
There are no limits to human greed and stupidity.
Nemo, I had thought a few days ago, why not just drop an enormous rock on the pipe? It shouldn’t be hard to get a 1000 ton granite block and just drag it on top of the pipe, right?
And then on the radio I heard that at the sea floor, 5000 feet down, the pipe travels another 15,000 feet into the ground, and someone (an expert?) explained that it is essentially just a straw, and that collapsing the straw is fairly easy, with explosives. (They said Russia has more than once used nuclear weapons to collapse out-of-control pipes. A critic said we don’t want to set a precedent of using nuclear weapons for engineering purposes because it would legitimize other nations seeking weapons, while someone else counter-argued that if someone wanted to use them for construction we could always provide the devices.)
Then they explained that the reason BP hasn’t talked about those approaches (specifically the explosives one), is that they want to preserve the well! And that if they were to destroy this particular well, they’d have to redrill, but expected public opposition would be too great to redrill, so they want to recover this particular well.
If that is true, then they should have destroyed it as soon as possible, because without all that oil pumping into the gulf the public opposition wouldn’t exist to redrill, and as one method after another fails to regain control, destroying it will seem like an increasingly attractive option. Though the idea that we ought to be capable of fixing the thing is still a pretty persuasive argument.
Brian, I really like your proposal for a investigative agency akin to the NTSB. It is so strange that a portion of our society has comprehended the power of science, and scientific methods have taken us so far, and yet as a group we still haven’t learned that science is usually the most efficient way to improve the world. Separating the investigation from the regulation is an excellent point.
Also, a lot of interesting info here, thanks Brian!
I’d like to put the comparison with TMI in context.
The TMI accident caused the destruction of an expensive piece of hardware, but it did not injure or kill workers at the reactor. TMI did release measurable quantities of radiation into the environment, but it did not have any obvious impact on local citizens, agriculture or industry. The worst consequence of TMI was that people in the area experienced considerable psychological stress during and after the accident.
People often think that “TMI killed the Light Water Reactor in the US”, yet, the book “Light Water: How the Nuclear Dream Dissolved” came out a year before the accident, see
http://www.energyfromthorium.com/LightWater.html
Roughly, an excessive number of LWRs were ordered in the early 1970s, LWR construction was plauged by cost overruns, and LWR operations were problematic in the early days (some reactors had less than 55% uptime.)
Looking back over the last 30 years of experience, the LWR looks quite different. Uptimes above 90% are common, and occupational exposure to radiation (never any worse than what airline pilots get) has dropped dramatically. Fuel performance improves steadily year after year; we now know that an LWR built to modern standards could last 85 years or more, so the expensive initial capital cost can be paid off over a very long lifetime.
It’s not clear if improved designs and modern project management could solve the cost escalation problems of large LWRs; however, these problems can almost certainly be solved by the factory constructed small reactors that are being developed by Babcox & Wilcox and by Nuscale. Initially these will be installed in clusters of 3 to 12 reactors that would compete head-on with today’s LWRs. In a decade or so, these may be relicensed for extended operation between refueling (20 years or more), smaller exclusion areas and less regulation, opening up more market opportunities.
@Nemo:
“Until the human race develops the technology to respond to disasters at these depths, we simply have no business being down there.” — Good point, and well said.
@Cody:
“…why not just drop an enormous rock on the pipe?” — One reason is that the shock would likely shatter the well casing somewhere not too far below the sea floor. Then the high-pressure oil would spurt out into the surrounding sediments and find its way to the surface, emerging from all around the well. Very soon you’d have an oil-gushing crater, which would swallow up the blowout preventer, much like what happens after a water main breaks and washes away a city street. This possible outcome hasn’t been mentioned much in public, but it may have influenced BP’s hesitancy about trying the “top kill” procedure, and maybe even their reluctance to close off the vents on the current collector cap. I note that when they fitted the cap to the riser pipe, they kept one camera trained on the sea floor near the BOP, watching for signs of seepage. Somewhere down below, the casing or the cement that secures the casing may already be damaged, making this worst-case scenario all too possible.
@Paul Houle:
I know this isn’t exactly your point, but perhaps one could argue that it was the TMI accident that led the nuclear power industry to clean up its act, but it was too late by then. The public had turned against it. Likewise, the Deepwater Horizon may lead the petroleum industry to invent or adopt technologies that will allow safe deep ocean drilling. But again it may be too late; if we the public have lost trust, we’re not going to believe anything they tell us.
Also, thanks for the pointer to “Light Water,” which I’ve never seen, and which looks interesting.