Fire on the Horizon

by Tom Shroder

  But the first sign of a kick is often seen in the amount of mud that returns. The well bore is filled to the top of the riser with mud. Like a full glass of water held under a faucet, any amount of new mud pumped in should be matched by overflow coming back out. The mud fluid is measured as it goes into the well, pump stroke by pump stroke, and measured again when it comes flooding back out into storage areas called mud pits, which occupy a large portion of the lower deck, just aft of the derrick.

  If more mud comes out than was pumped in, that could only mean that something down in the well is pushing back, forcing the mud up and out. That would be the kick. Kicks are fairly common and occur on almost every well. They are nuisances that can become disasters if they aren’t monitored closely and managed adroitly.

  Jason was intent on doing both. At the first sign of a kick, he could activate a feature of the blowout preventer called an annular preventer, a (very large) steel-reinforced rubber doughnut that squeezed tightly around the drill pipe and sealed off the space around it. This allowed the well to settle, a strategy similar to capping a soda bottle that’s about to fizz over. It also gave the crew time to pump heavier mud into the well. Mud is significantly heavier than water—which weighs about 8.3 pounds per gallon—and can be made even heavier depending on the additives put into it. Ultimately, it can weigh nearly twice as much as seawater. When you multiply by the thousands of gallons it takes to fill an 18,000-foot hole, that’s a very considerable weight, and usually enough to counter the upward force of oil and gas trying to push to the surface. It’s a very straightforward equation: The downward pressure of the mud has to equal or exceed the upward pressure of the hydrocarbons seeking to escape.

  Proper use of these tools controlled the kicks. But all these maneuvers were complicated and took precious time.

  Around the middle of February, when it became clear the sixteen-inch pipe section was seriously behind schedule, yet another setback for this Macondo project, the BP company men got itchy. “Let’s bump it up,” one of them said. Jason interpreted that as an instruction to push the drill harder and faster, which could get them through this troublesome section more quickly and hold down the escalating cost. But going faster meant exerting more pressure against the geological formation. And sometimes more is just too much. The terrain traversed by a well is as varied as terrain aboveground. It can range from dense, impermeable rock to pressure-compressed sand that can easily crumble when pushed too hard—which is exactly what happened.

  A few days after the company man exhorted the drill team to bump it up, the bottom very literally fell out. The first sign of trouble came once again in the mud in/mud out calculus. Only this time, instead of too much mud returning to the pits, there was too little. Somewhere the walls of the well had given way and the mud was escaping into the surrounding geology. This was not good. The collapsed wall was a structural weakness in the well. But it also meant that barrels of mud were washing away. Despite its name, mud wasn’t cheap. In fact, it cost far more than refined gasoline, between $200 and $500 per 42-gallon barrel. Formation collapse was called a “lost circulation event” on the rig, because the loss of circulating mud was how it was diagnosed. Thousands of barrels’ worth of mud could escape when a well wall failed, so the mud loss alone could very quickly became a million-dollar problem.

  Lost circulation could be controlled by pumping even more mud into the hole, this time containing thick and/or sticky additives—including items as humble as ground-up peanut and walnut shells. This “lost circulation material” is plastered against the walls by pressure, forming into a kind of patching material over the gaps.

  But pumping and plugging took time. Between the cost of the lost mud, the cost of the replacement material, and the time it took to diagnose and patch the leak, just this first section of the well was on its way to being two weeks late and at least $14 million over budget.

  Macondo was beginning to pick up the sobriquet that drillers commonly bestow on the particularly incident-prone holes they drill—“well from hell.” They don’t usually mean too much by it—just another shorthand for the generic gripe of men doing a hard job against stubborn difficulties. But some in the Horizon crew began to take the term seriously.

  In late February, an ROV was cruising around the wellhead when an operator noticed something on his video monitor. There was a definite spurt coming from a joint in the hydraulic lines leading into one of the two BOP control pods. These pods, like boxes perched atop the BOP, were the modules that linked back up to control panels on the rig, and through which the BOP could be directed, whether it was opening or closing a fluid line or activating one of its hydraulically powered rams to seal the well in an emergency.

  The hydraulic leak was reported to the senior BP company man, Ronald Sepulvado. Of the four company men assigned to the Deepwater Horizon, two at a time, Sepulvado was probably the most experienced, having been with ARCO oil and gas company for twenty years before it was purchased by BP. He’d worked for BP for twelve years, the last seven and a half aboard the Deepwater Horizon. He knew the rig, he knew the crew, and they trusted him to do the right thing, especially when their safety was concerned.

  Sepulvado discussed the hydraulic leak problem in a morning conference call with his BP supervisor, John Guide, a fifty-two-year-old engineer at BP’s campus on the western outskirts of Houston. Guide had been the Horizon’s well team leader for the twenty-four wells leading up to Macondo and he knew the business. Any issue involving the BOP definitely got Guide’s attention, and everyone else’s. Federal regulations regarding them were strict and explicit. They stated that any rig encountering “a BOP control station or pod that does not function properly” must “suspend further drilling operations until that station or pod is operable.”

  Fixing the leak almost certainly would have required not only stopping drilling, but pulling the BOP up on deck—another delay of weeks, possibly months. After some discussion, Guide concluded that the leak concerned the least critical element of the BOP, the test ram—which was used to close the system off so pressure tests could conveniently be performed on various parts of the well. As for the continuing loss of hydraulic fluid, the leaky valve need only be turned to the neutral, or “block” position, and it would stop. Subsequent tests seemed to indicate that the rest of the BOP still functioned.

  Guide decided that the leaky valve did not meet the standard—not functioning properly—as stated in the federal regulation. Therefore, he concluded, he didn’t need to report the leak to federal regulators, and the Horizon didn’t need to suspend drilling. The subsea crew set the valve on the leaky joint to “neutral,” or “block.” This meant that it would be depressurized, and without pressure, the leak would stop spewing fluid. If they needed to use the test ram, it would have to pressure up, which took some time. But the loss of fluid during a limited use would be negligible.

  On a huge rig with so many complicated moving parts, these kinds of decisions were constantly being faced. A piece of essential equipment would start wheezing, in one way or another, but it could still be used. To get at the root of the wheeze would be time-consuming and expensive and often could grind operations to a halt. So did you just work around the issue until you could pause for repair? Or shut everything down?

  In simplified, everyday terms, it was a little like driving a car that is burning oil. You can put it in the shop and pay to rebuild the engine, or wait until you have more time and money, and in the meantime just keep driving, dump in a quart of oil every time you fill the gas tank, and cross your fingers.

  Mike Williams was an ex-marine who had become the Horizon’s chief electronics technician around the time they drilled the deepest well, six months earlier. He’d come to the Horizon six months before that, in the spring of 2009. Almost from the moment he’d arrived, he’d been seeing things that alarmed him.

  One of his duties as an electronics tech was maintaining the fire and gas detection and alarm system, an extensive network of
sensors throughout the rig tied into the rig’s mainframe computer. When he arrived, Mike found it in horrible disarray, with many of the sensors not functioning or locked out. As he set about trying to put things to rights, he stumbled on a page deep in the computer for the rig’s general alarm. He saw that the alarm had been switched to the inhibited mode, which meant it wouldn’t automatically sound if the sensors detected a potentially life-threatening situation. When he reported it, thinking he’d uncovered a serious mistake, he was told that everyone, from the OIM down, wanted it that way, so the crew wasn’t awakened at 3 a.m. for a false alarm. They wanted the watch officers on the bridge, who could see fire/ gas sensor alerts on their computers, to decide if it merited sounding the rig-wide alarm.

  Williams understood the thinking—sometimes a cloud of cement dust could trigger the sensors harmlessly, waking up the sleeping crew members, leaving them drowsy for the next day’s long tour—but he didn’t agree with the conclusion. Seconds matter in emergencies.

  For the last few months, Williams had been struggling with an aging computer system in the drill shack. The system was the driller’s window on all the conditions in the well and on the rig, and his control over everything from the mud pumps to the top drive. Out of nowhere, the computer would just lock up—the screen went blue, the “blue screen of death,” as it’s called. It happened all hours of the day or night. It was more than an inconvenience. When the screen froze, the driller was blind. Williams was told that on an earlier well, the screen went to blue and for a few minutes they had no way to monitor what was happening in the well. By the time they’d fired up the backup computer, they discovered they’d taken a kick.

  The system was antiquated, so no matter how heroic their efforts to tinker with it, the threat of a crash would remain. They’d ordered an entirely new system—new computers, new servers, new everything—except software. They couldn’t get their old software to run correctly on the new operating system. So they were letting their sister rig, the Nautilus, work out the bugs for them before they installed the new equipment.

  The Nautilus was built just before the Horizon, a nearly identical twin except that it did not have dynamic positioning capability. But the drilling mechanisms were almost carbon copies, so what worked on the Nautilus computer system should work on the Horizon’s. Meanwhile, they were limping along with what they had.

  Sometime in March, Williams had been called yet again from his office near the engine room to the driller’s cabin to nurse the computer system. A contractor walked into the back. Cradled in his hands, as if he were carrying a dead bird, was a double handful of stripped rubber. Williams instantly identified it as rubber from the annular preventer—after all, it was pretty much the only rubber down in the well.

  Williams glanced nervously at the rubber and said, “What the hell is that?”

  “Oh, no big deal. That’s normal,” he says he was told. “It’s not a problem. This happens all the time.”

  One of the advantages of using the annular preventer was that you could still do some drilling operations while it was closed by gently sliding the drill pipe through the clenched rubber. When used that way, some stripping of rubber did occur, and the driller was careful not to have the annular closed too tightly, or pull the pipe too hard.

  But these seemed like awfully big chunks to Williams. Though he would be the first to admit he was no drilling expert, the incident stayed with him.

  Then he remembered something: Late one night, not long before he’d seen the chunks of rubber, he’d received a call summoning him to the drill shack. When he arrived, he was told that they had been doing some pressure testing and the annular was closed, and closed tight. Williams saw 10,000 pounds per square inch on the screen. He was asked to investigate whether there had been an input to the control stick that had hoisted the block while the annular was closed.

  When Williams asked why they needed to know, he was told, “Well, the block moved about fifteen or twenty feet. We need to know why. We need to know if it was inadvertent stick movement or if it went up by itself.”

  They eventually discovered it had indeed been an inadvertent stick movement, and Williams now wondered if that mistake had resulted in the extensive hunks of stripped rubber.

  Williams didn’t know how rubber loss would affect the function of the annular, but he did know there was nothing they could do about it until Macondo was completed and they’d pulled the BOP stack back up on deck.

  Within days, Williams was called to the cabin again and told to hurry down. This time it was the BOP control panel. It had gone dead.

  Because the driller is likely to be the first to notice the signs of a well about to kick, he needs to be able to activate the BOP instantly, which is why there is a panel in the drill shack, as well as on the bridge and in the subsea supervisor’s office. But the drill shack is also directly over the moon pool, and the first place likely to be engulfed in a cloud of gas if a kick gets out of control. So both the drill shack itself and the BOP panel are set up to operate in positive pressure—which means air flow is always out, and never in. That way, even if gas surrounded the shack, it can’t enter inside it. And just in case the drill shack was breached and the gas did enter, it wouldn’t enter inside the BOP panel, which has its own positive pressure within its glass case. This could be an important consideration because even a small electronic spark can ignite a massive fireball in the presence of natural gas.

  What had happened now was someone had held the door to the drill shack open too long, causing it to lose its pressure purge. It was not uncommon for that to happen with all the traffic in there. In just a few seconds, pressure would build back and the purge would be reinstated.

  But in this case, the purge system on the BOP panel was faulty, so while the door was open and the pressure seal was lost, the BOP panel detected the lost purge and automatically shut itself down.

  By the time Williams arrived, he found the panel was back up, switched by an assistant driller to bypass mode. That meant that the panel could operate even without purge, running the risk—likely a tiny risk, but a risk nonetheless—that in an emergency situation, it would touch off a fireball.

  Williams said that he had worked on that system during the last rig move and discovered how to make the automatic system work, keyed to the purge or lack of purge in the drill shack.

  “Do you want me to start it back in automatic?” Williams asked.

  “No,” Williams says he was told. “The damn thing’s been in bypass for five years. Why did you even mess with it?”

  It sounded callous, but there were almost always two sides to every safety equation. Mike Williams wasn’t wrong to worry. While the chance of the BOP panel igniting a fireball was remote, it was a real possibility. But a potentially more troubling possibility was that if the BOP panel shut down during a gas event, the driller would be left helpless, with no way to close off the well himself. It was a catch-22 that could only be resolved with the correct parts, parts that Williams knew had been on order for some time but had yet to arrive on the rig.

  Jason Anderson would always tell anyone who’d listen how much he loved his work. But on this well, he was feeling the pressure. Doing things right, the way he’d taken such pride in learning, sometimes meant taking more time. The wear on the rig that went unattended and the mechanical breakdowns, combined with the exhortations from the BP men to hurry, were all starting to make him uncomfortable.

  When this hitch ended and he went back home, he confided in his dad, Billy, a former high school football coach who’d gotten into the offshore business himself and steered Jason to his first rig job. Jason told his dad about the pressure to just get things done even if it meant cutting corners. In the past, he’d always been able to talk the company men out of something when he really felt it was important. This time, he told his dad, the pressure was more intense than ever, and he was worried he was losing the argument.

  It was an odd coincidence, but even as his w
orries peaked, surveyors for a risk management company showed up on the Horizon, contracted by Transocean to conduct a confidential survey. The survey suggested that Jason’s concern was shared by others. An analysis concluded that a significant number of workers worried that the quest to keep drilling always trumped the need for maintenance, forcing them to work with equipment that was becoming unsafe to use.

  One man’s comment to the surveyors summed up the general frustration. “At nine years old, Deepwater Horizon has never been in drydock,” he said. “We can only work around so much.”

  Both Transocean and BP put a lot of money, time, and effort into promoting the “core value” that any worker at any time could stop work he deemed unsafe. But half the workers surveyed said they feared that if they spoke up, especially about things being controlled by managers in Houston, they’d face serious reprisal.

  With that fear hanging in the back of your mind, it could be hard to speak up. It wasn’t even just speaking up. What if you made your case, and the boss said, “I hear you, but we’re going ahead and doing it my way,” or the more common “I told the beach, it’s in their hands now.” How far were you going to go? The decisions were never black-and-white. Drilling a well was intensely complex and inherently risky. If you wanted to be 100 percent safe, you probably should never board a rig in the first place, nor start digging a hole in the ocean. And since risk was never entirely eliminated, you were never debating safety and danger in absolute terms. Millions of dollars were spent in accordance with percentages: How much was it worth to reduce the risk of a bad outcome from 1 percent to a half a percent?