BP’s Report: No Smoking Gun, But a Lot of Smoke

The long oily summer of the BP oil spill is over, and now the investigation season has begun. BP itself has completed and issued a summary of its own internal investigation, posted for public access on its website. I have had time to read only the executive summary, but even that brief six-page document has technical details I don’t completely understand. However, the basic picture is clear: what happened last April 20 to cause the explosion, fire, deaths, and consequent oil spill that blackened miles of coastline and disrupted entire industries was not a simple one-failure event. Instead, it was a cascade of failures, both mechanical and human, that all went the wrong way to produce the tragedy.

At the time of the accident, the well drilling itself had been completed, and BP together with the actual operator of the rig, Transocean, were under pressure to cap off the well temporarily until a production structure could be put in place. Every modern oil well consists of a hole drilled in the rock, into which a long pipe called the casing is inserted. To keep the highly pressurized oil and gas where it belongs, most of the space (the “annulus” or ring-shaped area) between the outside of the casing and the raw hole is filled with a special cement, so the only place the “hydrocarbons” (BP’s term for oil and gas) can go is into the casing at a controlled location near the bottom of the well. At the very bottom of the casing between it and the bottom of the hole itself is something called a “shoe track.” I’m not sure what it is, but it looks in their drawing like a long can with holes at the bottom. The intention was to seal off this shoe track with the same cement that was being used to fill the space between the casing and the drill-hole wall.

Well, something went wrong: too much nitrogen in the cement, or something. But when the rig operators went to check the integrity of the cement seal by removing the heavy drill mud and replacing it with seawater to check for leaks, the pressure in the well rose beyond allowable limits.

The first place the accident could have been prevented had arrived. If the operators had put back the drill mud and figured out what was wrong instead of proceeding as if things were normal, they would have at least had a chance to avoid problems. But being in a hurry, they accepted the data as showing the cement seal was okay, even though it wasn’t, and eventually left lighter seawater in the well. This allowed high-pressure natural gas to enter the well.

Once the operators realized they had a problem, they sent signals down the well to operate the infamous blowout preventer (BOP), and connected the top of the well to a mud-gas separator on the rig itself. (As most readers probably know by now, the blowout preventer is a big piece of machinery on the ocean floor with two or three redundant systems designed to shut off the well in just such an eventuality as having high-pressure gas flow through it out of control.) Neither of these actions had the intended effect. For a couple of reasons (a bad solenoid valve and a low battery) the BOP failed to operate, and the gas flow coming from the well soon overwhelmed the mud-gas separator’s ability to deal with it. There was a separate overboard diverter line they could have used which might have kept the gas away from places it could ignite a little longer, but it wasn’t used.

Eyewitnesses who were in nearby vessels noted a high-pitched noise of escaping gas just before the explosion. By the time the gas got to areas that were not “electrically classified” (meaning certified as free of ignition sources), it was just a matter of time before an engine sucked in enough natural gas to set it afire. And the tragedy had begun.

The executive summary was written in dry, technical language in which people appear only in the passive voice (e. g. “The first well actions were to close. . .”). But as the immediate party responsible for day-to-day rig operations, Transocean is at fault for a number of things: poor training and management, careless maintenance of critical equipment such as blowout preventers, and allowing schedule pressures to take precedence over safety. But in the eyes of most laws, it is the owner of a rig, not just the operator, whose ultimate responsibility it is to see that the thing doesn’t befoul a good bit of the Gulf of Mexico, as the Deepwater Horizon failure did.

To their credit, BP did establish a fund to pay legitimate claims of damage resulting from the spill, and has paid out a lot of money already. But obviously, it would have been better to operate the rig like the 99+% of other deep-water rigs that successfully drill for and produce oil without major spills or fatal accidents. Besides fouling miles of shoreline, the carelessness exemplified by this tragedy of errors has blackened the reputation of the entire offshore drilling industry, and provoked a harsh government response in the form of the controversial moratorium on drilling operations. Some of the most vocal opponents of this ban were people along the coast that stand to be most affected by any accidents. But the reason for that is simple: offshore oil drilling is a big part of the gulf states’ economy. History may show that this decision was yet another bad judgment call in a cascade of bad judgment calls that began on April 20 on the rig.

At any rate, we will be finding out even more as the Presidential commission and other investigative bodies complete their findings. But already, the technical outlines of the accident are pretty clear. And pretty depressing.

Sources: I referred only to BP’s executive summary of their internal report, available at http://www.bp.com/liveassets/bp_internet/globalbp/globalbp_uk_english/incident_response/STAGING/local_assets/downloads_pdfs/Deepwater_Horizon_Accident_Investigation_Report_Executive_summary.pdf

Deepwater Drilling: More Research Needed?

The ongoing Gulf of Mexico oil spill has led many to question the competence of both industry and government in conducting and regulating deepwater oil drilling. The perspective of Tad Patzek, chairman of the University of Texas Petroleum and Geosystems Engineering Department, is worth listening to, if for no other reason that he stands at some remove from both corporations and government institutions. On June 8, he gave prepared testimony before Congress in which he shared his thoughts about the root causes of the Deepwater Horizon oil spill and what should be done to prevent such tragedies in the future.

Prof. Patzek's main point was that complex systems behave in a qualitatively different way from the simpler systems of which they are a part. He used the analogies of a watch and a frog. Given the right tools, you can take a watch apart and reassemble it, and it will work just as well as it ever did. Try the same thing with a frog, and you don't get a live frog back—you get high-school biology lab. Even such an apparently simple thing as a single-celled organism such as an amoeba is a fantastically complex interconnected system of thousands of micro-machines, chemical plants, disposal systems, data storage in the form of DNA, and so on. And just writing down the chemicals involved doesn't begin to explain the complex behavior of a living organism.

According to Prof. Patzek, the highly complex system of an offshore oil rig in deep water has moved beyond the boundary between simple, easily-understood systems (such as the plumbing in your bathroom sink) and complex systems that come up with surprising behavior that the simpler systems don't show. Unfortunately, the design and management structure of deepwater drilling, along with the technologies used, have not kept pace with the increasing complexity needed to drill in deeper waters, which is where a good deal of U. S. oil production has moved since most onshore reserves have already been exploited. Prof. Patzek says that neither the oil industry nor government funding agencies have spent much money in the last few decades on long-term research into these problems of complexity. Federal support for such research has essentially disappeared, while industry research is narrowly restricted to fields that can show an immediate short-term return: namely, exploration techniques and methods of drilling that improve rates of oil and gas recovery. While these are important and necessary, they do not fill out the big picture of what has to happen if the whole system of deepwater exploration is to function smoothly.

There are well-known analysis techniques that deal with the hazards and failure modes of complex systems. These approaches were developed in part by the space industry, where repairs are generally not possible and astronauts' lives are sometimes at stake. They are paper-and-pencil (or rather nowadays, computer-and-spreadsheet) techniques which force the analyst to imagine what will happen if this or that element in the system fails. While we don't know enough about the Deepwater Horizon failure yet to say (and Prof. Patzek calls for a thorough investigation as part of his testimony), it is possible that if these analysis methods had been applied to the system in question, they might have shown there was a problem, and how to avoid it.

But even if they had, the culture of the industry would have to change so that the results of an office worker's analysis would trump the gut feelings of the guys who are getting their fingernails dirty out on the platform in the Gulf. One of the problems that seems to have contributed to the accident is the distributed nature of command and operations. Rather than one integrated operation owned and run by one entity, large offshore oil-drilling operations are a collaboration between an oil company (BP in this case), a rig operator (TransOcean), and numerous smaller contractors, each of which runs his own little domain. While this mode of operation can work well in non-life-critical systems such as motion-picture production, the Deepwater Horizon accident may be the test case that shows this kind of management structure is inadequate either to prevent such an accident, or to deal with it quickly and efficiently once it occurs.

Not surprisingly for a professor of engineering, Prof. Patzek winds up his testimony by proposing a number of specific research projects, including one to develop a large-scale "skimmer" (system for recovering oil from the ocean surface) by converting a conventional oil tanker. None of these plans will probably be implemented in the near term, but the hope is that Congress will recognize that a vital part of our economy has been left to deteriorate in some ways, and research is needed to fix the problems. Direct Federal involvement is not necessarily the only answer, although some increase in the form of better regulation is probably needed, as Prof. Patzek admits. But a longer-term view of R&D investment on the part of oil companies would help a great deal.

One success story in this regard that might serve as an example of what to do can be drawn from the history of the U. S. semiconductor industry in the 1980s. To oversimplify, Japanese firms were eating their lunch in terms of technical advances, so the major U. S. firms got together, funded a large research effort with shared contributions and shared discoveries, and basically grabbed the football back. This required Federal cooperation in terms of allowing what would otherwise be a violation of anti-trust laws, but it was handled well and it worked out with benefits for both the industry and the general public.

Whether the very different culture of the oil business will lend itself to this kind of inter-company co-operation remains to be seen. One problem is that the U. S. no longer has the lead in terms of oil-company size. Our largest (and according to many sources, best-run) company is ExxonMobil, and it is ranked 17th in the world in terms of oil reserves. But these are still well-off outfits capable of putting some percentage of their profits into a common research foundation that could address some of the safety and accident problems that have been so vividly brought to our attention lately. To my mind, it is the least they can do, and the smartest too.

Sources: The July 4, 2010 Austin American-Statesman carried a portion of Prof. Patzek's prepared testimony, which can be found in full at http://alt.coxnewsweb.com/statesman/pdf/07/070410patzek.pdf.

Military and Civilian Engineering: The X-37B and the Space Shuttle

The profession of engineering has deep roots in military culture and military organizations. Both in France and the U. S., the first engineering schools in the late 1700s and early 1800s were military academies, and the first people trained in what we would now call the profession of engineering were military servicemen educated in the technicalities of forts, armaments, and related matters. When such training proved to be useful in fields other than war, the first practitioners of non-military engineering were called "civil engineers" to distinguish them from the only other kind at the time. Although the military employs only a minority of engineers today, the story of the X-37B says a lot about the different ways a military and a civilian organization go about achieving similar goals.

The X-37B is a recently launched unmanned space vehicle that the U. S. Air Force has developed, apparently to maintain its ability to launch spy satellites now that the last scheduled Shuttle flight is taking place as I write this. Like the Shuttle, it is a reusable craft with vestigial wings whose design was based on the Shuttle when NASA asked Boeing to develop an earlier version, the X-37, back in 1999. During the last decade, according to Wikipedia, the NASA design served as the basis for the Air Force's X-37B, which was announced in 2006 and then cloaked mostly in secrecy. Unlike NASA, whose proceedings are open and publicized almost to a fault, the Air Force gives out only such information as suits its purposes. So for example, we have only an early artist's conception of what the X-37B really looks like. But when the launch of the first X-37B took place last month (April 22, to be exact), amateur satellite observers and others figured out pretty fast what was happening.

The Air Force has always had a claim on a certain number of Shuttle flights to deliver its most advanced spy satellites into orbit. Even now we do not have full data on the nature of these satellites, but there is enough indirect evidence to show that they produce images superior to anything you can find on Google Earth, for example, and can be reconfigured and steered to watch trouble spots in most parts of the world as needed. During the Cold War, these satellites played an essential role in arms-reduction verification and many other aspects of that conflict, and after the Soviet Union came apart the programs continued for obvious reasons, since having eyes in the sky better than anyone else's will always provide a strategic advantage in both war and peace.

As long as the Shuttle was in operation, it could be relied upon to deliver new spy satellites, but the hiatuses caused by the two major accidents (Challenger in 1986 and especially Columbia in 2003) plus the planned ending of the Shuttle program inspired the Air Force to find an alternative. The nice thing about a military organization is that it is largely unencumbered by democracy. Democracy, I am convinced, is the best way to conduct public affairs. But once a specific technical objective has been decided upon, a well-run military organization has a much better chance of delivering the goods on time and under budget than other types of organizations. So now at fairly low cost (in the hundreds of millions rather than many billion, apparently) and in about a decade (including the seven-year NASA development, or even less time if you consider only the Air Force version), we have a space vehicle that does one of the most important functions of the Shuttle. And by its very nature, nobody on board can ever get killed because nobody is on board to start with.

Of course, the X-37B has a limited range of tasks it can do. Compared to the Shuttle, it is a butter knife to the Shuttle's Swiss army knife—it can do only one thing, but it should do it pretty well. Advances in remotely piloted vehicles and robotics have allowed the Air Force to do without people on board, and while this may lead to situations that a person in space would come in handy for, you can still do a lot with robots nowadays, only perhaps slower. But during an X-37B flight, there is no time pressure to get a task done before the oxygen and food runs out and the humans have to be carted back safely to Earth. Things can just take as long as they take. So in some ways, operations with the X-37B should be more deliberate and therefore better planned and executed.

Does this mean I favor a military type of organization for all engineering works? To a large degree, that is what we already have. The large commercial firms that do engineering have mimicked military organization in more ways than you might think. An engineer at a large company may not have to salute his boss or do kitchen-police duty for getting to work late, but everyone in a company knows there is a strict chain of command that one violates at his or her peril.

Of course, there are problems with the military style of doing things as well. When input from a large number and variety of constituencies should be considered, as in a public work that affects lots of people, the military style does not function that well. This problem has played out in such situations as the deteriorated state of dikes and flood protection systems that was the nominal, but not total, responsibility of the U. S. Army Corps of Engineers in New Orleans before Katrina struck. To be fair, the Corps had its hands tied with regard to much of that infrastructure, and things might have gone better if it had taken over complete control of all aspects of the system. But that was a political impossibility.

Nevertheless, when you have a specific, clear-cut job to be done, it looks like handing it over to the military arm can work pretty well. That assumes, of course, that the military either possesses or has access to the necessary technical expertise. The Deepwater Horizon oil spill that is still going on in the Gulf of Mexico has inspired calls to shove British Petroleum out of the way and put the military in charge. As I mentioned a few blog posts ago, the problem with this idea is that BP and their contractor Transocean have all the smarts in this case. But if the problems that BP and Transocean are having are organizational rather than technical, they might benefit from having the Marines run things for a while.

Sources: The Wikipedia article "Boeing X-37" supplied most of my data on the NASA X-37 and the Air Force X-37B.

Deep Problems from the Deepwater Horizon

Two weeks ago tomorrow, on Apr. 20, an explosion and fire on the oil-drilling platform Deepwater Horizon off the Louisiana Coast resulted in the presumed deaths of eleven people and the sinking of the structure two days later. Initially, it was thought that an automated device called a "blowout preventer" (BOP in petroleum-engineer speak) would shut off the high-pressure oil from the well, which is about a mile below the ocean's surface. But soon after the structure sank, oil started showing up on the surface. British Petroleum, the owner of the well, and Transocean Inc., the operator hired by BP, initially estimated that 1,000 barrels a day were leaking out. More recently the number has risen to 5,000 barrels a day, and the slick has come within nine miles of the Louisiana coastline by today (Monday morning May 3). Already the federal government has prohibited all fishing operations for the next ten days in the region, and things look like they will get worse before they get any better.

There are nearly 4,000 offshore oil rigs in the Gulf of Mexico, most of them concentrated south of Louisiana, and as long as things operate smoothly, they are out of the public consciousness despite the fact that almost a third of our domestic oil production originates there. Partly because there have been no major headline-grabbing spills in recent years, President Obama recently called for increased offshore drilling in selected areas. The Deepwater Horizon disaster has put that on hold, and threatens to turn public opinion against offshore drilling for a long time.

Out of the 4,000 or so offshore oil rigs that operate without major problems, why did the Deepwater Horizon explode and sink? And even more urgently now, why didn't the blowout preventer work? These are technical questions that will require months of investigation to answer, although computerized logs and telemetry from the platform should help considerably. The blowout preventer, a three-story-high assemblage of hydraulic equipment designed to withstand the tremendous pressures five thousand feet underwater, is a sophisticated multi-stage system that sits on top of the ocean floor and surrounds the well pipe assembly. It is essentially a large automatic shutoff valve, using hydraulic pressure to acivate guillotine-like rams or rubber-and-steel rings that impose enough counterpressure to block the several-thousand-pounds-per-square-inch pressure behind the oil emerging from the ocean floor. Normally it is activated by remote control from the platform, but before the platform sank, operators tried to activate it without success. When underwater remotely operated vehicles (ROVs) reached the BOP's control panel and flipped the control switches, nothing happened. According to online discussions, in the event of a major disaster such as the loss of the platform, stored hydraulic energy in devices called accumulators should be sufficient to make the BOP do its job. But this didn't work, for reasons that are not yet clear.

Time is now critical, but unless something on the shrinking list of things British Petroleum engineers haven't tried on the BOP works, the other options to shut off the increasing flow of oil from the well will take at least weeks, if not longer. A risky idea that has apparently never been tried at such depths involves lowering large metal cans or funnels over the leaks (there are apparently at least two in the broken and twisted riser pipe) and trying to "vacuum" up the oil that way. All sorts of complications and challenges attend this approach, from the buoyancy of oil that might literally float the cans away to the differential pressure that could crush pipes and disable suitable submersible pumps, only a few of which exist anywhere in the world. The third way, which is going to be done sooner or later in any event and is pretty likely to work, is to drill a relief well, which could be better understood as a capping well. This involves drilling sideways at some safe distance to hit the exact location of the original well in order to send mud or cement into it and stop the flow. For the relief well to work, pinpoint accuracy is required, somewhat like hitting a rain gutter on the side of a building from half a mile away. While accuracy like this can be achieved, it takes two to three months to do it. And by that time, the oil could have reached Gulf shores all the way from Louisiana to Florida.

By now, British Petroleum is the poster child of the Petroleum Industry Hall of Infamy. The Houston refinery explosion that killed about two dozen people five years ago happened largely due to BP's lax safety standards, and while it is too soon to assess BP's culpability for the initial explosion and fire on the Deepwater Horizon, which was operated in any event by Transocean, no amount of feel-good institutional advertising is going to overcome the public perception that BP is careless about safety. In the meantime, let's hope that the effort to stop the oil leak is managed safely, efficiently, effectively, and fast.

Sources: I used information from the following websites: http://en.wikipedia.org/wiki/File:Gulf_Coast_Platforms.jpg has a map of oil platforms in the Gulf, http://www.timesonline.co.uk/tol/news/world/us_and_americas/article7114487.ece is an article in The Times of London about attempts to shut off the oil flow, and attached to the photo of the ROV shutoff attempt at http://www.flickr.com/photos/uscgd8/4551846015/ is a long thread of discussion among engineers about the problems surrounding the disaster and how to shut off the well flow. Also, CNN has a good graphic of the three major approaches to shutting it off at http://www.cnn.com/2010/US/05/01/explainer.stopping.oil.leak/index.html.