The Blowout occurred on the Deep Water Horizon is one of the most famous disasters of recent times. Defined as an “uncontrolled release of fluid from a well”, Blowout is widely perceived as one of the main accident hazard offshore (perhaps because major blowouts tend to persist for long enough to be widely reported).

For me one of the most interesting reports produced is that of CSB from which I got a lot of information in order to understand what really happened (for more details see their website).

I think I should also highlight the beautiful section on website of the NewYork Times, with very clear illustrations and interviews with survivors).

1 - Introduction

1.1 - The Equipment

The Deep-water Horizon (DWH) was a semi-submersible, dynamically positioned, mobile offshore drilling unit (MODU) that could operate in waters up to 8,000 feet deep (91,440 mt) and drill down to a maximum depth of 30,000 feet (2,400 mt). The rig was built in South Korea by Hyundai Heavy Industries. The rig was owned by Transocean, and was under lease to BP from March 2008 to September 2013.

The DWH was a dynamically positioned rig that used global satellite technology and thrusters to maintain position over the well rather than cables and anchors to hold it in place.

At the time of the accident, the rig was drilling an exploratory well at a water depth of approximately 5,000 feet (1,524 mt) in the Macondo Prospect. The well is located in Mississippi Canyon Block 252 in the Gulf of Mexico.

BP planned to drill two exploration wells—Macondo being the first—and follow with a production facility if the oil and gas-bearing region revealed commercial potential.

BP designed Macondo for use as a producing well if successful, but the well was, in fact, exploratory because of the uncertainty about both the type and quantity of the oil and gas (hydrocarbons) present at the site and the effort necessary to actually extract the oil and gas. If the well proved commercially viable, data concerning the well’s geology and hydrocarbon properties would be collected and used to create a production plan; alternatively, if the well was not viable, the data would be gathered to determine why the commercial predictions failed.

Ultimately, as BP hoped, the Macondo well was appropriate for conversion to a producing well.

1.2 - Planning the Well

The goal of drilling a deepwater well is to create a pathway between oil and gas reservoirs trapped beneath the seafloor and the surface. To reach the reservoirs, a hole (the wellbore) is drilled through various layers (formations) of rocks and/or unconsolidated sediments such as sand, shale, gravel or silt. The formations, such as the target reservoir, are porous and permeable, and they contain water, oil, and/or gas which are under pressure.

An unplanned flow of these fluids into the wellbore is called a “kick”, which, if not managed, can progress to a “blowout,” the uncontrolled release of oil and gas (hydrocarbons) from the well. This is most dangerous for people and property when the hydrocarbons release onto the drilling facility, where ignition sources are present.

Thus, the flammable and potential explosive nature of oil and gas contained in the reservoir(s) of a potential well is one of the most significant major hazards that must be managed throughout the lifecycle of a drilling and production operation, beginning with the planning stages of the well. Part of the planning process is a well-specific hazard analysis of the operation to determine the appropriate safeguards for mitigating the hazard and control of the risks.

2 - The Accident

2.1 - Events before the incident

At the time of the accident, the Deepwater Horizon (DWH) crew had finished drilling and was completing temporary abandonment of the well so that a production facility could return later to extract oil and gas from the well.

At the time of the blowout, 126 people employed by 13 different companies were onboard the DWH.

BP’s temporary abandonment plan called for removal of most of drilling fluid column in the well before installation of a surface cement plug. Earlier, a critical cement barrier intended to keep the hydrocarbons below the seafloor had not been effectively installed at the bottom of the well, and the cement integrity was not conducted in a way that provided a clear “pass” or “fail” result to the workers. Both BP and Transocean personnel on the DWH rig misinterpreted the test results concerning the cement integrity, leading them to erroneously believe that the hydrocarbon bearing zone at the bottom of the well had been sealed when in fact it was not.

2.2 - Incident

When the drilling fluid column was removed, pressure gradually reduced above the hydrocarbon reservoir at the bottom of the well. Eventually, this action allowed hydrocarbons to flow past the failed cement barrier and up toward the DWH. Meanwhile, because of a failure to recognize the increase in fluids from the well, the crew continued to remove more of the drilling fluid column, causing both the hydrocarbon influx rate into the well and movement of hydrocarbons toward the rig to increase. The hydrocarbons continued to flow from the reservoir for almost an hour without human intervention or the activation of automated controls.

2.3 - And the gas detections??

“A worker on a crane sees gas spreading across the rig. A mixture, including mud and gas, initially gushes out of the well and cascades off the drilling floor. It then shoots up inside the derrick.”

The force of the hydrocarbons accelerating up the mile-long drilling riser resulted in well fluids gushing onto the drilling rig floor—a blowout.

Gas sensors go off but the bridge does not activate emergency systems that might have prevented gas from spreading or igniting. The crew members on the bridge also do not immediately sound a general alarm to start evacuation. While they inform the engine control room of a well control situation, they tell them nothing about the erupting mud or gas alarms

At this point, the crew took action to activate the blowout preventer (BOP). This safety critical element, located at the sea floor, temporarily sealed the well but could not stop the hydrocarbons that had already traveled above the BOP from releasing onto the rig.

Once oil and gas had risen above the BOP, the only action the crew could take was to divert it to a safer location than onto the rig floor. However, the flow from the diverter had been preset to route well fluids to the mud-gas separator rather than over the side of the Deepwater Horizon. The mud-gas separator was rapidly overwhelmed, as it was not designed to safely handle a flow of the magnitude of the Macondo blowout. As a result, drilling mud and hydrocarbons rained down onto the rig floor.

A chief mechanic and three others in the engine control room are aware of gas on the rig but do not activate an emergency shutdown. They later say that the protocol is to wait for instructions from the bridge.

The hydrocarbons found an ignition source, and explosions and fire ensued.

“Engines 3 and 6 are believed to be at the center of two major explosions.

The four men are caught between the blasts, but all survive.”

Both manual and automated emergency systems within the blowout preventer were activated in an attempt to shear the drillpipe and seal the well. However, pressures in the well had caused the drillpipe to buckle, which inhibited the BOP from sealing the well.

The explosion and fire resulted in 11 crew members suffering fatal injuries and 17 others being critically injured.

The Deepwater Horizon rig sank on April 22, 2010, about 36 hours after the initial explosions. Approximately 5 million barrels of oil spilled into the Gulf of Mexico.

Ultimately, in the hours leading up to the incident, no effective barriers were in place to prevent or mitigate a blowout. The physical barriers intended to prevent such a disaster were not properly designed for the well conditions, constructed, tested, or maintained, or they had been removed. The management systems intended to ensure the required functionality, availability, and reliability of these barriers were inadequate.

An examination of the treatment of safety critical equipment and tasks at Macondo, such as the BOP and cement barrier testing, reveals opportunities for further improvements in effective barrier safety management. Furthermore, a comparison of the US regulatory requirements for these safety critical elements to other international offshore regimes illustrates gaps in the US model and offers support for further post-Macondo changes to the US offshore safety regulations.

From shortly before the explosions until May 20, 2010, when all ROV intervention ceased, several efforts were made to seal the well. The well was permanently plugged with cement and “killed” on September 19, 2010.