Congress Oil Spill Probe Finds Problems Aplenty : The Two-Way The congressional investigators of the Deepwater Horizon disaster are turning up intriguing information that point to a litany of technical and human problems with the well whose failure has led to a spreading environmental crisis caused by the no...
NPR logo Congress Oil Spill Probe Finds Problems Aplenty

Congress Oil Spill Probe Finds Problems Aplenty

The congressional investigators probing the Deepwater Horizon disaster are turning up intriguing information that point to a litany of technical and human problems with the well whose failure has led to a spreading environmental crisis caused by the non-stop gushing of crude oil into the Gulf of Mexico.

Major-accident investigators often say that there's usually a number of failures that create a big calamity. The picture painted emerging from the congressional investigation seems like another case of that.

House Energy and Commerce Committee Chairman Henry Waxman said Wednesday that congressional investigators learned that the well failed a critical pressure test hours before the explosion. The test indicated that gas from the oil reservoir was leaking into the drill pipe in a way it shouldn't have.

Here's a large chunk of Waxman's statement to give those who want them a lot of the details. Other readers can just skip it.

WAXMAN: This is an important test. During a negative pressure test, the
fluid pressure inside the well is reduced, and the well is observed to see whether any gas leaked into the well through the cement or casing. According to James Dupree, the BP senior vice president for the Gulf of Mexico, the well did not pass this test.

Mr. Dupree told committee staff on Monday that since test results were not satisfactory and inconclusive, significant pressure discrepancies were recorded. As a result, another negative pressure test was conducted. This is described in the fourth bullet.

During this test, 1400 PSI was observed on the drill pipe while zero PSI was observed on the kill and the choke lines. According to Mr. Dupree, this is also an unsatisfactory test result. The kill and choke lines run from the drill rig 5,000 feet to the blow-out preventer at the sea floor. The drill pipe runs from the drill rig through the blow-out preventer deep into the well.

In the test, the pressures measured at any point from the drill rig to the blow-out preventer should be the same in all three lines. But what the test showed was that the pressures in the drill pipe were significantly higher. Mr. Dupree explained that the results could signal an influx of gas was causing pressure to mount inside the well bore.

Meanwhile, the chairman of the Energy and Commerce subcommittee holding the hearing, Rep. Bart Stupak (D-Mich.), said the investigation has uncovered a number of problems with the blowout preventer that should have cut the flow of gas and oil up the pipe which in turn led to the explosion.

I'll sum up much of his statement for readers who don't want all the details. Those who do can read the lengthy passage of his statement after this.

Stupak focused on all the problems with the blowout preventer whose job it was to shut off the pipe in the event something went wrong. Suffice it to say, there appears to have been many. The problems ranged from a dead battery, to equipment that was improperly wired, to other equipment that was too underpowered to seal off the pipe.

Many words will likely come to the minds of those who hear the details of all the things that went wrong. "Competence" probably won't be one of them.

Here's a lengthy section from Stupak's opening statement:

STUPAK: Our investigation is at its early stages, but already we have uncovered at least four significant problems with the blowout preventer used on the Deepwater Horizon drill rig.

First, the blowout preventer had a significant leak in the key hydraulic system. This leak was found in the hydraulic system that provides emergency power to the shear arm -- to the shear rams, which are the devices that are supposed to cut the drill pipe and seal the well.

I'd like to put on the screen a document that the committee received from BP. This document states, "Leaks have been discovered in the BOP hydraulic system."

The blowout preventer was manufactured by Cameron. We asked a senior official at Cameron what he knew about these leaks. He told us when the remote operating vehicles tried to operate the shear rams, they noticed a loss of pressure. They investigated this by injecting dye into the hydraulic fuel, which showed a large leak coming from a loose fitting, which was backed off several turns. The Cameron official told us that he did not believe the leak was caused by a blowout, because every other fitting on the system was tight.

We also asked about the significance of the leak. The Cameron official said it was one of several possible failure modes. If the leak deprived the shear rams of sufficient power, they might not succeed in cutting through the drill pipe and sealing the well.

Second, we learned that the blowout preventer had been modified in unexpected ways. One of these modifications was potentially significant. The blowout preventer has an underwater control panel.

BP spent the day trying to use this control panel to activate a variable-bore ram on the blowout preventer that is designed to seal tight around any pipe in the well; in other words, pinch off the flow of oil.

When they investigated why their attempts failed to activate the bore ram, they learned that the device had been modified. A useless test ram, not the variable-bore ram, had been connected to the socket that was supposed to activate the variable-bore ram. An entire day's worth of precious time had been spent engaging rams that closed the wrong way because it was wired wrong.

BP told us the modifications on the BOP were extensive. After the accident, they asked Transocean for drawings of the blowout preventer, because the modifications -- the drawings that they received did not match the structure on the sea floor. BP said they wasted many hours trying to figure this out.

Third, we learned that the blowout preventer is not powerful enough to cut through the joints in a drill pipe. We found a Transocean document that I'd like to put on the screen, and it says, "Most blind shear rams are designed to shear effectively only on the
body of the drill pipe. Procedures for use of BSRs must therefore ensure that there is no tool joint opposite the ram prior to shearing."

This seemed astounding to us, because the threaded joints betweenthe sections of drill pipe make up about 10 percent of the length of pipe. If the shear rams cannot cut through the joints, that would mean the so-called fail-safe device would succeed in cutting the drillpipe only 90 percent of the time.

We asked the Cameron official about the cutting capacity of the blowout preventer on the Deepwater Horizon. He confirmed that it is not powerful enough to cut through the joints in the drill pipe. He told us that this was another possible explanation for the failure of
the blowout preventer to seal the well.

And fourth, we learned that the emergency controls on the blowout preventer may have failed. A blowout preventer has two emergency controls. One is called the emergency disconnect system, or EDS. BP told us that the EDS was activated on the drill rig before the rig was
evacuated. But the Cameron official said they doubted the signals ever reached the blowout preventer on the seabed. Cameron officials believe the explosion on the rig destroyed the communications link to the blowout preventer before the emergency sequence could be

In other words, the emergency controls may have failed because the explosion that caused the emergency also disabled communications to the blowout preventer. Still, the blowout preventer has a dead man's switch, which is supposed to activate the blowout preventer when all else fails.

But according to Cameron, there were multiple scenarios that could have caused the dead man's switch not to active. One is human oversight. The dead man's switch may not have been enabled prior to installing the BOP on the ocean floor. One is a lack of maintenance.
The dead man's switch won't work if the batteries are dead. The dead man's switch is connected to two separate control pods on the blowout preventer. Both rely on battery power to operate. When one of the control pods was removed and inspected after the spill began, the
battery was found to be dead. The battery in the other pod has still not yet been inspected.

There also appears to be a design problem. The dead man's switch activates only when three separate lines that connect the rig to the blowout preventer are all severed -- the communication, power and hydraulic lines. Cameron believes the power and communication lines were severed in the explosion, but it is possible the hydraulic lines remained intact, which would have stopped the dead man's switch from activating.

These are not the only failure scenarios that could impair the function of the blowout preventer. The Cameron official we met with described many other potential problems that could have prevented the blowout preventer from functioning properly. Steel casing or a casing hanger could have been ejected from the well and blocked the operations of the rams.

The drill pipe could have been severed successfully but then dropped from the rig, breaking the seal. Or operators on the rig could have tried to activate the shear rams by pushing the shear-ram control button. This would have initiated an attempt to close the rams, but it would not have been successful. The shear rams do not have enough power to cut drill pipes unless they are activated through an emergency switch or the dead man's switch.

In fact, we uncovered an astonishing document that Transocean prepared in 2001 when it bought the blowout preventer from Cameron. I'd like to display the executive summary of this document. It says there are 260 separate failure modes that could require pulling of the BOP. According to this report, the predominant failures included ram locking mechanisms. How can a device that has 260 failure modes be considered fail-safe?