May 12, 2010
Hearing highlights problems with Deepwater Horizon blow out preventer
Today it was the turn of the House Committee on Energy and Commerce to hold hearings on the Deepwater Horizon disaster.
Rep. Bart Stupak, Chairman of the Committee's Subcommittee on Oversight and Investigations, used a large part of his opening
statement to explore issues related to the rig's blow out preventer.
Though blowout preventers are intended to be fail-safe, "that didn't happen," said Chaiman Stupak. "The blowout preventer used by the Deepwater Horizon rig failed to stop the flow of gas and oil, the rig exploded, and an enormous oil spill is now threatening the Gulf Coast."
Following are extracts from Chairman Stupak's statement:
We know that the blowout preventer, the BOP, did not properly engage. The BOP has multiple rams that are supposed to slam shut to pinch off any flow around the drill pipe and stop the flow of oil from the well. There are also shear rams in the BOP that are supposed to cut and seal the pipe to prevent oil and gas from flowing. The question we will ask is why did these rams fail?
Our investigation is at its early stages, but already we have uncovered at least four significant problems with the blowout preventer used on the Deepwater Horizon drill rig.
First, the blowout preventer apparently had a significant leak in a key hydraulic system. This leak was found in the hydraulic system that provides emergency power to the shear rams, which are the devices that are supposed to cut the drill pipe and seal the well.
[A] document that the Committee received from BP ... states: "leaks have been discovered in the BOP hydraulics system."
The blowout preventer was manufactured by Cameron. We asked a senior official at Cameron what he knew about these leaks. He told us when the remote operating vehicles (ROVs) tried to operate the shear rams, they noticed a loss of pressure. They investigated this by injecting dye into the hydraulic fluid, which showed a large leak coming from a loose fitting, which was backed off several turns.
The Cameron official told us that he did not believe the leak was caused by the blowout because every other fitting in the system was tight.
We also asked about the significance of the leak. The Cameron official said it was one of several possible failure modes. If the leak deprived the shear rams of sufficient power, they might not succeed in cutting through the drill pipe and sealing the well.
Second, we learned that the blowout preventer had been modified in unexpected ways. One of these modifications was potentially significant. The blowout preventer has an underwater control panel. BP spent a day trying to use this control panel to activate a variable bore ram on the blowout preventer that is designed to seal tight around any pipe in the well. When they investigated why their attempts failed to activate the bore ram, they learned that the device had been modified. A useless test ram - not the variable bore ram - had been connected to the socket that was supposed to activate the variable bore ram. An entire day's worth of precious time had been spent engaging rams that closed the wrong way.
BP told us the modifications on the BOP were extensive. After the accident, they asked Transocean for drawings of the blowout preventer. Because of the modifications, the drawings they received didn't match the structure on the ocean floor. BP said they wasted many hours figuring this out.
Third, we learned that the blowout preventer is not powerful enough to cut through joints in the drill pipe. We found a Transocean document [that] says: most blind shear rams are "designed to shear effectively only on the body of the drillpipe. Procedures for the use of BSR's must therefore ensure that there is no tool joint opposite the ram prior to shearing."
This seemed astounding to us because the threaded joints between the sections of drillpipe make up about 10% of the length of the pipe. If the shear rams cannot cut through the joints, that would mean that this so-called failsafe device would succeed in cutting the drillpipe only 90% of the time.
We asked the Cameron official about the cutting capacity of the blowout preventer on the Deepwater Horizon. He confirmed that it is not powerful enough to cut through the joints in the drillpipe. And he told us this was another possible explanation for the failure of the blowout preventer to seal the well.
And fourth, we learned that the emergency controls on the blowout preventer may have failed. The blowout preventer has two emergency controls. One is called the emergency disconnect system or EDS. BP officials told us that that the EDS was activated on the drill rig before the rig was evacuated. But the Cameron official said they doubted the signals ever reached the blowout preventer on the seabed. Cameron officials believed the explosion on the rig destroyed the communications link to the blowout preventer before the emergency sequence could be completed.
In other words, the emergency controls may have failed because the explosion that caused the emergency also disabled communications to the blowout preventer.
Still, the blowout preventer also has a "deadman switch" which is supposed to activate the blowout preventer when all else fails.
But according to Cameron, there were multiple scenarios that could have caused the deadman switch not to activate. One is human oversight: the deadman switch may not have been enabled on the control panel prior to the BOP being installed on the ocean floor. One is lack of maintenance: the deadman switch won't work if the batteries are dead. The deadman switch is connected to two separate control pods on the blowout preventer. Both rely on battery power to operate. When one of the control pods was removed and inspected after the spill began, the battery was found to be dead. The battery in the other pod has not been inspected yet.
And one appears to be a design problem. The deadman switch activates only when three separate lines that connect the rig to the blowout preventer are all severed: the communication, power, and hydraulic lines. Cameron believes the power and communication lines were severed in the explosion, but it is possible the hydraulic lines remained intact, which would have stopped the deadman switch from activating.
These are not the only failure scenarios that could impair the function of the blowout preventer. The Cameron official we met with described many other potential problems that could have prevented the blowout preventer from functioning properly. Steel casing or casing hanger could have been ejected from the well and blocked the operation of the rams. The drill pipe could have been severed successfully, but then dropped from the rig, breaking the seal. Or operators on the rig could have tried to activate the shear rams by pushing the shear ram control button. This would have initiated an attempt to close the rams, but it would not have been successful. The shear rams do not have enough power to cut drill pipe unless they are activated through the emergency switch or the deadman switch.
In fact, we uncovered an astonishing document that Transocean prepared in 2001, when it bought the blowout preventer from Cameron. [The executive summary from this document] says there are 260 separate "failure modes" that "could require pulling of the BOP." According to this report, "the predominant failures" included "ram locking mechanisms."
How can a device that has 260 failure modes be considered failsafe?
The problems with the blowout preventer extend to the procedures for testing the device. The CEO of Transocean, Steven Newman, says in his testimony: "we have no reason to believe that they were not operational - they were jointly tested by BP and Transocean personnel as specified on April 10 and 17 and found to be functional."
But this assertion appears to be contradicted by a document prepared by BP on April 27, one week after the explosion. According to this document, "BOP stack emergency systems are not typically tested once the BOP stack is on the seabed." What this means that while some functions on the BOP may have been tested in the weeks before the explosion, the emergency systems, including the deadman system and the leaking emergency hydraulic system, were unlikely to have been tested.