Industrial Accidents 2.1 Accidents
2.4 The Importance of Accidents
2.4.4 Deepwater Horizon Drilling Rig Explosion
hazardous materials, in cooperation with the local authorities having jurisdiction (as Seveso Directive imposes). It is a preventive strategy and it should be preferred. If, for space availability or control
necessity, it is a requirement to have people nearby the potential
incidental area, then a robust structural design needs to be pursued. It is a protective strategy.
After the Flixborough events, a number of papers were written about the behavior of large leaks, under various wind and weather
conditions. Only a few papers were written on the reasons for large leaks and the actions required to prevent them. This happened
because large leaks, being also occasional, were considered inevitable.
We know that this is not true. Having observed how large leaks are caused by pipe failures, the most effective action to prevent them is to follow the piping design strictly, and to test and maintain them after construction.
Just like the Bhopal plant, the Flixborough plant was also jointly owned. It becomes therefore crucial to clarify the responsibilities of the joint venture's members, regarding safety, design and operations, to avoid a misleading tasks assignment.
The plant was then rebuilt, with a different process to manufacture cyclohexanol: it was made by the hydrogenation of phenol instead of oxidizing the cyclohexane. The process, however, is as hazardous as the previous one and it was not carried out in Flixborough but
elsewhere: the risks were only exported, not really diminished. The rebuilt plant was then closed after a few years for commercial reasons.
damaged during a hurricane. The sea floor was at 1500 m depth and the intent of the project was to drill up to 5500 m under the sea floor, using progressively smaller diameter casing strings.
On 20 April 2010, 11 workers died and 17 were seriously injured by an explosion on the Deepwater Horizon (Figure 2.37). The offshore
drilling rig was located approximately 50 miles off the coast of
Louisiana and it burned continuously for two days, eventually sinking.
The incident is the largest oil spill in US history.
Figure 2.37 The Deepwater Horizon drilling rig on fire.
Different authorities and investigators, including the U.S. Chemical Safety Board (CSB), carried out their examinations to discover the technical, organizational, and regulatory factors that contributed to the accident. They also suggested the corrective actions necessary to prevent a similar occurrence.
Drilling an offshore well means the creation of a pathway between the
drilling rig and the reservoir under the seafloor. The bore is drilled through layers of rocks that can trap water, crude oil, and natural gas under pressure. An unplanned flow of these fluids into the wellbore may happen: in the industry, this phenomenon is known as “kick”. A kick can be very dangerous, since it can lead to a blowout, that is an uncontrolled release of flammable oil and gas. A blowout may bring severe consequences, as oil and gas reaching the drilling rig can ignite resulting in a fire or explosion. In order to prevent kicks, drillers pump a dense slurry, named drilling mud, to create a barrier between oil and gas (undersea) and the piping leading to the rig. If this barrier is not sufficient to contrast the blowout or it is removed, then the safety is entrusted to the Blow Out Preventer (BOP), a critical equipment located on the seafloor.
The BOP is an essential device to control the well and to prevent a disaster. It is both electrically and hydraulically powered. The BOP and the rig are connected through a large diameter pipe named riser.
When a kick occurs, the BOP prevents the travel of oil and gas through the riser up to the drill. This prevention system is done by sealing the annular space (the area around the drill pipe). To do so, the crew can manually close pipe rams using rubber devices known as annular preventers, which are donut shaped. If they fail, the last protection layer is a pair of sharp metal blades designed to cut the drill pipe and seal the well. This protection can be activated either manually or automatically. On the evening of 20 April 2010, at 8:45 p.m., a kick occurred. The undetected oil and gas ingress passed above the BOP and travelled up the riser towards the rig. The drilling mud, pushed by the rising oil and gas, suddenly blew out onto the rig at about 9:40 p.m. Being aware of this occurrence, the crew members closed the upper annular preventer in BOP, but it did not work as intended and flammable oil and gas continued to flow into the riser towards the rig.
Then, the pipe ram was also closed, properly sealing the well.
Unfortunately, this was only a temporary fix, since the oil and gas already above the pipe ram continued to flow towards the Deepwater Horizon. At 9:49 p.m. the flowed materials ignited, resulting in a violent explosion. The pressure in the annular space above the pipe Ram immediately decreased because of the oil and gas escaped from the riser. At the same time, the pressure in the drill pipe increased. So,
the drill pipe was closed at the top but the flow of oil and gas kept continuing from the reservoir. According to the investigation carried out by CSB [44], this difference in pressure caused the buckling of the drill pipe, bending it and limiting the barrier effectiveness of the shear ram blades. The explosion and the subsequent loss of energy and
hydraulic power activated an automatic system on the BOP, known as AMF deadman. This system closes the blind shear ram and cuts the drill pipe. But electricity, hydraulic pressure and communications from the rig have been lost. The AMF deadman worked with two
redundant control systems on the BOP, named the yellow pod and the blue pod. The two pods are independent; thus, the reliability of the system is supposed to be increased. They were comprised of identical embodied computer systems and solenoid valves which controlled fundamental BOP functions, including closing the blind shear ram. On 20 April 2010, the electrical supply was lost. The two control pods could rely on backup 27 and 9 volt batteries: the 9 volt batteries supplied power to computers that would activate the solenoid valves, powered by the 27 volt batteries. The collected evidence showed that the blue pod was mis wired, causing the drainage of the 27 volt
batteries and resulting, in the end, in the impossibility to operate with the blind shear ram. Also, the yellow pod was mis wired. Each solenoid valve was controlled by two coils, designed to work in concert. In the mis wired solenoid valve, the two coils acted in contrast to each other, leaving the valve immobile. A third failure allowed the yellow pod to operate: one of the 9 volt batteries had failed, consequentially the computer system was not capable of giving the command to energise the mis wired coil. Thanks to this failure, opposite forces on the
solenoid valve were not generated and the working coil succeeded in opening the solenoid valve. This opening started the closure of the blind shear ram, which should have cut the drill pipe and sealed the well. But, because of the bent condition of the buckled pipe inside the BOP, it was only partially cut. Once the last barrier failed to prevent the blowout, the massive oil spill could not be stopped and the
destruction of the rig prevented. According to the CSB investigation, the effective compression was the phenomenon that caused the buckling of the pipe. It happens because of invisible irregularities of the pipe that, even if it appears perfectly straight to the naked eye,
curve the pipe. As a consequence of these irregularities, one side of the pipe is slightly longer and offers a wider surface respective to the
opposite side. Now, with the limited difference in pressure, these geometric irregularities are negligible, but with the large difference experienced in this case, the geometric diversity eventually causes different forces and a resulting buckling effect. According to CSB, similar pressure conditions could be experienced by many others existing drilling rigs, significantly reducing the effectiveness of the BOP barrier. The spillage following the Deepwater Horizon accident lasted 87 days, with 5 million barrels of oil spilt in the Gulf of Mexico:
regardless of the impact on humans (victims and injured people), it resulted in one of the worst environmental disasters of history.
Figures 2.38 to 2.40 show the application of the Apollo RC™ method to this incident, using RealityCharting® [43]. At this stage, the reader is not asked to fully understand the RCA methodology, but having a first look at the trees obtained is a useful introduction into the
investigation methods, fully described in Chapter .
Figure 2.38 Application of the Apollo RCA™ Method using RealityCharting® to the Deepwater Horizon incident.
Source: Reproduced with permission from [43].
Figure 2.39 Application of the Apollo RCA™ Method using RealityCharting® to the Deepwater Horizon incident. Used by permission. Taken from [43].
Figure 2.40 Application of the Apollo RCA™ Method using RealityCharting® to the Deepwater Horizon incident.
Source: Reproduced with permission from [43].