The explosion and fire that destroyed the drilling rig Deepwater Horizon on the night of April 20 was a run-of-the-mill industrial accident. In saying this, I don’t mean to make light of the disaster, in which 11 workers perished. Nevertheless, it’s important to recognize that events like this one have happened before. They happen all the time. Just two weeks earlier, an explosion in a West Virginia coal mine killed 29 workers. A refinery fire in Anacortes, Washington, killed seven on April 2. In February six workers died in a natural gas explosion at a power plant under construction in Connecticut. In January, leaking phosgene gas killed an operator at a West Virginia chemical plant. Looking back a few years further, a 2005 fire at a BP refinery in Texas City, Texas, killed 15 workers and injured 170 more. There was another fatality at the same refinery in 2008. Texas City was also the site of a fertilizer explosion in 1947 that destroyed much of the port and left almost 600 dead. Then there’s the Bhopal catastrophe, where toxic fumes from an insecticide plant suffocated thousands of residents of nearby neighborhoods.
Still another accident that belongs in this sad catalogue is the destruction of the Piper Alpha platform in the North Sea oil fields. Piper Alpha was not a drilling rig but a production platform; it pumped oil and natural gas from completed wells to a terminal in the Orkney Islands. On the night of July 6, 1988, a huge explosion shattered the main part of the platform, and a subsequent fire consumed the rest; 167 crew members died. The apparent cause was a miscommunication: The night shift tried to start up a pump, not knowing that the day shift had removed a crucial valve for maintenance, leading to a massive leak of flammable gas.
It’s a bitter truth: Industrial accidents are business as usual. Death on the job is a cost that we (as a society) are evidently willing to accept and pay. When a mine collapses or a sugar refinery explodes, we read the story in the newspaper and we watch the film at 11, and then we grit our teeth and move on. The Deepwater Horizon sinking is just another in this long series of mishaps.
And yet it’s also totally different. This accident has consequences that reach beyond the workers and their families. A hole in the bottom of the ocean has been spewing hydrocarbons for six weeks. The rate of loss could well be a million gallons a day. Efforts to control the well are still under way, but if they fail the spill might go on for another three months. All that makes for a nightmare that doesn’t drop out of the news cycle after the first 24 hours.
In this respect, Deepwater Horizon may turn out to be not another Piper Alpha but another Three Mile Island. The 1979 accident at that nuclear power station had lasting consequences: We haven’t built another nuclear plant in the U.S. in the 30 years since. (There are other reasons for the long lassitude of the nuclear industry, but TMI was a major factor.) Likewise, in the aftermath of Deepwater Horizon, it seems a fair guess that we won’t be drilling another deep offshore well anywhere near the U.S. coastline for years to come, and maybe decades. Maybe never.
A moratorium on offshore drilling, enforced by economic as well as legal and political pressure, looks like a perfectly sensible response to the current situation. But we deserve more. By all means, let’s do whatever necessary to avoid repeating this particular mistake, but at the same time let’s address the broader issue of why things all over the industrial landscape keep blowing up and falling down.
Will we ever learn what happened on the Deepwater Horizon? There are certainly a lot of investigators trying to find out. Three Congressional committees have heard testimony already. A board of inquiry formed by the Coast Guard and the Minerals Management Service is holding its own series of hearings. So is a state panel in Louisiana. On May 11 President Obama asked the National Academy of Engineering to look into the cause of the accident, then on May 22 he appointed a special commission to carry out yet another investigation. Meanwhile the Justice Department is studying possible civil or criminal penalties.
For all that effort, we sure haven’t learned much yet. The well is leaking, but BP isn’t. It’s amazing how they’ve managed to keep the public and the press at a distance; the one art they seem to have mastered is secrecy. Even friendly trade publications (e.g., Oil and Gas Journal, Offshore) have so far failed to penetrate the security cordon. In the end, though, the story will come out. We’re going to learn why that blowout preventer didn’t prevent a blowout. But I’m not so confident we’ll learn how to prevent the next blowout.
The only blowout preventer I’ve ever seen up close and personal was on a drilling rig near Oklahoma City in 2004. At the time, I thought it was quite a brawny-looking piece of gear, with all those rings of torqued bolts clamping the flanges together, and the big red hydraulic rams like pincers clasping the pipe. Apparently, this unit is puny compared with the BOP stack installed on the Deepwater Horizon well (“five stories tall” in news accounts). Still, the principle of operation is the same: If the well “kicks”—meaning that gas and oil begin to push their way toward the surface—the rams close off the well and keep everything sealed tight. Some rams are meant to choke off the annular space around the drill pipe; some are “blind rams” used when no drill pipe is present in the bore; the last resort is a pipe ram or shear ram meant to crush or cut off the drill pipe.
It sounds foolproof, but evidently not. Controls can stick, valves can leak, parts can break. I’ve read speculation that the shear ram on the BOP beneath the Deepwater Horizon might have failed because it happened to strike a thicker-walled section of drill pipe where two lengths of tubing are threaded together; I really hope that’s not a serious concern, because it would mean that every BOP on the planet has a failure probability of 3 percent. (Drill pipe comes in 30-foot lengths, and the thickened sections are about a foot long.)
A 1997 article in Offshore lists a fascinating variety of other failure modes for deep-water wells. The article is by Larry H. Flak of Boots and Coots—a company often called in to deal with crises like this one. Flak is writing for an audience of oil-patch insiders, and I don’t follow all of his jargon. For example, there’s this wonderfully opaque passage:
Broached blowouts could happen with casing failure. Recently, an ultra-deepwater operator swabbed in a kick resulting in over 9,000 psi on the subsea BOPs. Fortunately, the casing was sound and set just on top of the sand. This allowed safe kick bullheading.
Even for those of us who have never bullheaded or swabbed in a kick, the message comes through: A lot can go wrong. A well is not just a hole in the ground; it’s a fairly complicated structure with multiple concentric layers of casing and drill pipe, which create several interconnected annular spaces; fluids under pressure can find many pathways to the surface. Flak points out that even the massive steel blades of a hydraulic ram can be torn to pieces by high-velocity streams of abrasive fluids, such as drilling mud. He concludes: “Blowout control options in ultra-deepwater are very limited. Blowout prevention is of paramount importance.”
When the story of the Deepwater Horizon accident is finally told, we’re going to hear at least two interpretations. In one telling, BP and its contractors were incompetent or negligent or criminally greedy; they screwed up. But the basic technology of offshore drilling is sound, and if only the companies had followed established industry practices and common sense, none of this mess would have happened. In the other version, BP and its contractors were incompetent or negligent or criminally greedy; they screwed up. But even if they had followed approved industry practices, a disaster like this was waiting to happen, because the technology of offshore drilling is fatally flawed. I really wish I knew which of these stories to believe. I worry that we lack the institutional means to decide between them.
• • •
I’m a great admirer of the National Transportation Safety Board. When an airliner crashes or a couple of commuter trains collide, the NTSB mounts a focused, scientific effort to understand the cause of the accident. Investigating accidents is all they do, and this turns out to be a key to their success; they are insulated from the responsibilities and temptations of regulating the industry, adjudicating legal culpability, assessing penalties or even enforcing their own safety recommendations. Separating the investigative and regulatory functions has worked brilliantly, and the board’s findings command wide respect. But the NTSB won’t be investigating the Deepwater Horizon blowout, because the event doesn’t fall within their statutory purview; it’s not a transportation accident. There’s also a Chemical Safety and Hazard Investigation Board (CSB), which has had a similar role in the chemicals industry since 1998. You might think that petroleum would count as a chemical substance, but as far as I can tell the CSB will also be sitting this one out. Their mission statement says: “The CSB conducts root cause investigations of chemical accidents at fixed industrial facilities.” The Deepwater Horizon wasn’t “fixed.”
So here’s my call for action: We need a single agency, modeled on the NTSB and the CSB, with authority to investigate all accidents involving industry or infrastructure—everything from well and refinery fires to water-main breaks, power blackouts, mine cave-ins, bridge and dam failures, boiler explosions and sewage spills. I believe we’re under a moral imperative to learn all we can from every such accident, in the hope of preventing a recurrence. A permanent, independent agency with investigative authority, in-house expertise and technical resources looks to me like the best way to reach this goal.
After the 2005 refinery fire in Texas City, BP hired James Baker III (the former Secretray of State) to convene a special of inquiry into the company’s safety practices and culture. The Baker panel report observed that BP had an admirable record on personal safety but cited deficiencies in process safety. Personal safety says: Wear your hardhat, your eye protection and your steel-toed boots when you go out in the plant to open a valve. Process safety says: Make sure you open the right valve, not the one that’s going to create a fireball that engulfs the whole plant. The report remarks: “BP mistakenly interpreted improving personal injury rates as an indication of acceptable process safety performance.” On April 20, BP executives flew out to the Deepwater Horizon to celebrate a personal safety milestone on the rig: no loss-of-work accidents in seven years. The executives were still on board when somebody turned the wrong valve.
Note: I have posted a PDF of the oil and gas chapter from my book Infrastructure: A Field Guide to the Industrial Landscape on the book’s web site.
Update 2010-06-21: A superb report on the failure modes of blowout preventers was published this morning in The New York Times. The article is by David Barstow, Laura Dodd, James Glanz, Stephanie Saul and Ian Urbina. Nothing they say is reassuring.