The oil next time - lessons from Deepwater Horizon incident

Deepwater Horizon official web site:
http://www.deepwaterhorizonresponse.com/go/site/2931/

http://www.facebook.com/DeepwaterHorizonResponse


For the latest information visit  www.deepwaterhorizonresponse.com
Twitter at http://twitter.com/Oil_Spill_2010 or on
Facebook at Deepwater Horizon Response.

Powerpoint on the role cementing can play in release of undersea gas
http://www.aade.org/houston/study/Fluids/11182009/F%20Tahmourpour%20Deepwater%20Cementing.pdf
=======================

Friday, April 30, 2010
Blowout preventer failed on Gulf rig
New York Times:

As cleanup crews struggled Friday to cope with the massive oil slick from a leaking well in the Gulf of Mexico, dozens of engineers and technicians ensconced in a Houston office building were still trying to solve the mystery of how to shut down the well after a week of brainstorming and failed efforts.

They have continued to focus their attention on a 40-foot stack of heavy equipment 5,000 feet below the surface of the gulf — and several hundred miles from Houston. Known as a blowout preventer, or B.O.P., the steel-framed stack of valves, rams, housings, tanks and hydraulic tubing, painted industrial yellow and sitting atop the well in the murky water, is at the root of the disaster.

When an explosion and fire crippled the deepwater drilling rig on April 20, workers threw a switch to activate the blowout preventer, which is designed to seal the well quickly in the event of a burst of pressure. It did not work, and a failsafe switch on the device also failed to function.

Since then, the group of experts in deep-sea oil operations has been working out of a BP office, grappling with the intractable puzzle of how to activate the device.

“It’s a mystery, a huge Apollo 13-type mystery,” as to why the blowout preventer did not work, said a person familiar with the efforts to activate it, who requested anonymity because he was not authorized to speak on the subject.

Like Apollo-program engineers, who 40 years ago (and also in Houston) cobbled together a long-distance fix to save the crippled spacecraft and its crew, these experts are trying something far beyond routine: shutting down an underwater out-of-control well by remote control. And at a mile below the surface, the work site might as well be halfway to the moon.

The effort involves a half-dozen remotely operated robotic submersibles hovering around the blowout preventer, along with surface support ships. The submersibles, designed for drilling work, are equipped with video cameras and tools like wire cutters and “hot stabs,” metal connectors that can plug into hydraulic systems in an effort to operate them.

So far the efforts have not been successful. “They seem to be having hydraulic issues,” said the person familiar with the effort.

In computing, when a "bug" surfaces in a program,   it is always a good idea to not only fix the bug, but to try to understand which barn door was left open that this bug could have ever made it into production code without being caught.   There is usually a "failure of imagination" or a "failure of the mental model" that is vulnerable to factors that from now forward, at least, should be taken into account.

It is, in that sense, not so much the "code" that has failed, as the process which produced and tested the code which has failed, and which needs to be fixed.  

Almost always, this ultimately points to both management and culture that have contributed to the problem's very existence.

Consider the case of the Blowout Preventer ("BOP") in the Deepwater Horizon oil well.  What does this failure to operate tell us about the management and culture that produced it.

"The work of the hands always reveals the true nature of the heart."

Facts:

• The BOP was triggered ( told to close the well) by the surface crew when there was a burst of pressure,  the type which is undesired and unintended, but which is the whole point of having a BOP in the first place.     The triggering failed to close the well.
• Underwater submersible remotely operated vehicles (ROV's) went down to the BOP and manually activated various emergency fall-back triggers,  which also did not function.
• BOP's have failed before.

Analysis -- or "What were you thinking?!!"

• Apparently, there were multiple ways to trigger the BOP to close, but all of them relied on a single hydraulic system to operate, making a single point of failure.
• The design of the BOP did not utilize the design feature of airbrakes on trains and trucks and busses, namely, that when the pressure fails, the brakes LOCK.   The pressure holds the brakes UNLOCKED.  So, a predictable failure in hydraulics results in a known safe condition.
• The design of the BOP did not utilize the wisdom of airplanes with hydraulic systems or electrical systems to lower the landing gear,   in having a fall-back manual crank system, when all else fails, to lower the landing gear.  

In other words, there are at least three major, obvious design flaws in the BOP's that are currently in use. The design, if submitted to a sophomore engineering class as a project, would probably get at best a grade of "C".

If you add to the equation that the cost of a failure is the ecosystem of the Gulf, and well over a billion dollars out of pocket,  the best grade it would get would be "F" = unacceptable for that purpose.

META-Analysis -- How could this have happened? 

What structure of management, motivations, mental-models, and culture allowed such a "bug" to pass through to production, and aside from fixing the instance that failed,  how do we "close that barn door" so this "kind of thing" won't recur?   Can we learn enough from this?

It's hard to imagine that the design engineers on the project of BOP design did not raise the issues above. This is Halliburton, not some back woods shop with inexperienced people.  That would be simple standard engineering practice.     We have to conclude that the engineers at the bottom of the food chain saw these problems, but their design recommendations were rejected by their management.

Apparently, to middle management,  assuming a 5% failure rate of the equipment,  a failure to keep pumping was something to avoid at all costs, but a failure to stop a a blowout was and "acceptable cost of doing business."

It's not clear that the math is correct, and, in the whole, by the time the lawsuits are done for this blowout, it will almost certainly have cost the company far more in profits that it would have cost to redesign the BOP's to be closer to failsafe.

So, we may have the same old story of short-run profits dominating the decision making over long run profits. It's not clear why investors put up with that, which is a whole branch of investigation in itself.

What can be done in the future?

It would be interesting if proposed safety mechanisms, such as the BOP,   were posted on-line and open for comments by the public, early in the design phase.     All of the above issues would surely have surfaced.

Regulatory agencies may be hard-pressed to issue regulations about the myriad of features of millions of safety issues, but they might be able to simply demand that such designs be posted on-line early in the design state,  so that public wisdom could be incorporated in the design.    We could leave it to the legal system to pursue questions of why, since issues X were raised,  they were never addressed, in cases such as the current one.
===============
Also

Huffington Post on oil industry objections to new safety regulations
http://www.huffingtonpost.com/2010/04/26/big-oil-fought-off-new-sa_n_552575.html


Boston Herald Coverage

Lawsuits name Halliburton, cementing procedure in oil rig disaster

By Associated Press
Friday, April 30, 2010 - Added 1d 12h ago

 

HOUSTON — Although no cause has been determined, oil services contractor Halliburton Inc. says it finished a cementing operation 20 hours before a Gulf of Mexico rig went up in flames.
Halliburton is named as a defendant in most of the more than two dozen lawsuits filed by Gulf Coast people and businesses claiming the oil spill could ruin them financially. In one lawsuit, two Louisiana shrimpers claim cementing contributed to the explosion.
Halliburton said Friday it had four workers stationed on the rig, performing several tasks, including cementing — a process of applying cement and water to a pipe used to prevent the wall of the hole from caving in during drilling.
According to a 2007 study by Minerals Management Service, cementing was a factor 18 of 39 rig blowouts in the gulf between 1992 and 2006.

 =====
Halliburton declined to return a detailed request for comment from Huffington Post.
The company did issue a press release responding to reports about its work on the rig:

As one of several service providers on the rig, Halliburton can confirm the following:

-- Halliburton performed a variety of services on the rig, including cementing, and had four employees stationed on the rig at the time of the accident. Halliburton's employees returned to shore safely, due, in part, to the brave rescue efforts by the U.S. Coast Guard and other organizations.

-- Halliburton had completed the cementing of the final production casing string in accordance with the well design approximately 20 hours prior to the incident. The cement slurry design was consistent with that utilized in other similar applications.
-- In accordance with accepted industry practice approved by our customers, tests demonstrating the integrity of the production casing string were completed.
-- At the time of the incident, well operations had not yet reached the point requiring the placement of the final cement plug which would enable the planned temporary abandonment of the well, consistent with normal oilfield practice.
-- We are assisting with planning and engineering support for a wide range of options designed to secure the well, including a potential relief well.
Halliburton continues to assist in efforts to identify the factors that may have lead up to the disaster, but it is premature and irresponsible to speculate on any specific causal issues.
Halliburton originated oilfield cementing and leads the world in effective, efficient delivery of zonal isolation and engineering for the life of the well, conducting thousands of successful well cementing jobs each year. The company views safety as critical to its success and is committed to continuously improve performance.

 ====
 http://seminal.firedoglake.com/diary/44349

By: Scarecrow Friday April 30, 2010 1:53 pm

What More Can Halliburton Tell Us About the Horizon Oil Blowout and Its Risks?

A publicly available Halliburton PowerPoint presentation from last November might tell us a lot about what could have caused the oil blowout, fire and massive oil gushing at the Horizon rig.
Suppose you’re that division of Halliburton that has the dangerous job of "cementing" the drilling hole and the gaps between the hole and pipe. You’ve done this lots of times in shallow water wells, but you’ve learned through previous experience in deep water there’s a particularly difficult problem having to do with the presence of gas that has seeped to the ocean floor and been captured in essentially "frozen" crystallized formations.
The problem is that when you drill into these formations, and then try to inject cement into the hole/gaps to prevent leakage, the curing process for that creates heat. That heat can, if not controlled, cause the gas to escape the frozen crystals. If a lot of gas is released all at once, as could happen during the cement/curing process, it can cause a blowout where the cementing is occurring, or force gas and/or oil up the pipeline to the drilling rig on the surface. And the heat created by the process may be just enough to ignite the gas, causing the explosion and fire.
Did this happen at the Horizon rig? And if Halliburton already knew about this problem months (years) ago, and knew the risks it might create, why are we just now learning about this?
From Halliburton’s presentation (large pdf), page 10, last November (my bold):

Challenges
• Shallow water flow may occur during or after cement job
• Under water blow out has happened
• Gas flow may occur after a cement job in deepwater environments that contain major hydrate zones.
• Destabilization of hydrates after the cement job is confirmed by downhole cameras.
• The gas flow could slow down in hours to days if the de- stabilization is not severe.
• However, the consequences could be more severe in worse cases.

Page 13 lists the design objectives but then concedes they can’t all be met at once:

Deepwater Well Objectives
• Cement slurry should be placed in the entire annulus with no losses
• Temperature increase during slurry hydration should not destabilize hydrates
• There should be no influx of shallow water or gas into the annulus
• The cement slurry should develop strength in the shortest time after placement
Conditions in deepwater wells are not
conducive to achieving all of these
objectives simultaneously

The presentation goes on to explain various options for dealing with the risks and assess the relative merits and costs. What’s interesting is that Halliburton appears to have been working at the edge of the technology and was not certain what would happen. Most experience was in shallower waters and no one was certain what would happen in deep waters. It conducted tests, but it’s not clear how complete or realistic those tests were or how costs factored into the choice of techniques. From page 23:

Destabilization of hydrates during cementing and production in deepwater environments is a challenge to the safety and economics

I think we’re about to learn a lot more about how cement cures and interacts with gas-locked crystaline formations in deep water drilling.
h/t to Cynthia Kouril who seems to know about how cement cures underwater — tunnels into New York — and found the presentation.

======