Fire on the Horizon (18 page)

In simplified, everyday terms, it was a little like driving a car that is burning oil. You can put it in the shop and pay to rebuild the engine, or wait until you have more time and money, and in the meantime just keep driving, dump in a quart of oil every time you fill the gas tank, and cross your fingers.

Mike Williams was an ex-marine who had become the Horizon’s chief electronics technician around the time they drilled the deepest well, six months earlier. He’d come to the Horizon six months before that, in the spring of 2009. Almost from the moment he’d arrived, he’d been seeing things that alarmed him.

One of his duties as an electronics tech was maintaining the fire and gas detection and alarm system, an extensive network of sensors throughout the rig tied into the rig’s mainframe computer. When he arrived, Mike found it in horrible disarray, with many of the sensors not functioning or locked out. As he set about trying to put things to rights, he stumbled on a page deep in the computer for the rig’s general alarm. He saw that the alarm had been switched to the inhibited mode, which meant it wouldn’t automatically sound if the sensors detected a potentially life-threatening situation. When he reported it, thinking he’d uncovered a serious mistake, he was told that everyone, from the OIM down, wanted it that way, so the crew wasn’t awakened at 3 a.m. for a false alarm. They wanted the watch officers on the bridge, who could see fire/ gas sensor alerts on their computers, to decide if it merited sounding the rig-wide alarm.

Williams understood the thinking—sometimes a cloud of cement dust could trigger the sensors harmlessly, waking up the sleeping crew members, leaving them drowsy for the next day’s long tour—but he didn’t agree with the conclusion. Seconds matter in emergencies.

For the last few months, Williams had been struggling with an aging computer system in the drill shack. The system was the driller’s window on all the conditions in the well and on the rig, and his control over everything from the mud pumps to the top drive. Out
of nowhere, the computer would just lock up—the screen went blue, the “blue screen of death,” as it’s called. It happened all hours of the day or night. It was more than an inconvenience. When the screen froze, the driller was blind. Williams was told that on an earlier well, the screen went to blue and for a few minutes they had no way to monitor what was happening in the well. By the time they’d fired up the backup computer, they discovered they’d taken a kick.

The system was antiquated, so no matter how heroic their efforts to tinker with it, the threat of a crash would remain. They’d ordered an entirely new system—new computers, new servers, new everything—except software. They couldn’t get their old software to run correctly on the new operating system. So they were letting their sister rig, the Nautilus, work out the bugs for them before they installed the new equipment.

The Nautilus was built just before the Horizon, a nearly identical twin except that it did not have dynamic positioning capability. But the drilling mechanisms were almost carbon copies, so what worked on the Nautilus computer system should work on the Horizon’s. Meanwhile, they were limping along with what they had.

Sometime in March, Williams had been called yet again from his office near the engine room to the driller’s cabin to nurse the computer system. A contractor walked into the back. Cradled in his hands, as if he were carrying a dead bird, was a double handful of stripped rubber. Williams instantly identified it as rubber from the annular preventer—after all, it was pretty much the only rubber down in the well.

Williams glanced nervously at the rubber and said, “What the hell is that?”

“Oh, no big deal. That’s normal,” he says he was told. “It’s not a problem. This happens all the time.”

One of the advantages of using the annular preventer was that you could still do some drilling operations while it was closed by gently sliding the drill pipe through the clenched rubber. When used that way, some stripping of rubber did occur, and the driller was careful not to have the annular closed too tightly, or pull the pipe too hard.

But these seemed like awfully big chunks to Williams. Though he would be the first to admit he was no drilling expert, the incident stayed with him.

Then he remembered something: Late one night, not long before he’d seen the chunks of rubber, he’d received a call summoning him to the drill shack. When he arrived, he was told that they had been doing some pressure testing and the annular was closed, and closed tight. Williams saw 10,000 pounds per square inch on the screen. He was asked to investigate whether there had been an input to the control stick that had hoisted the block while the annular was closed.

When Williams asked why they needed to know, he was told, “Well, the block moved about fifteen or twenty feet. We need to know why. We need to know if it was inadvertent stick movement or if it went up by itself.”

They eventually discovered it had indeed been an inadvertent stick movement, and Williams now wondered if that mistake had resulted in the extensive hunks of stripped rubber.

Williams didn’t know how rubber loss would affect the function of the annular, but he did know there was nothing they could do about it until Macondo was completed and they’d pulled the BOP stack back up on deck.

Within days, Williams was called to the cabin again and told to hurry down. This time it was the BOP control panel. It had gone dead.

Because the driller is likely to be the first to notice the signs of a well about to kick, he needs to be able to activate the BOP instantly, which is why there is a panel in the drill shack, as well as on the bridge and in the subsea supervisor’s office. But the drill shack is also directly over the moon pool, and the first place likely to be engulfed in a cloud of gas if a kick gets out of control. So both the drill shack itself and the BOP panel are set up to operate in positive pressure—which means air flow is always out, and never in. That way, even if gas surrounded the shack, it can’t enter inside it. And just in case the drill shack was breached and the gas did enter, it wouldn’t enter inside the BOP panel, which has its own positive pressure within its glass case. This could be an important consideration because even a small electronic spark can ignite a massive fireball in the presence of natural gas.

What had happened now was someone had held the door to the drill shack open too long, causing it to lose its pressure purge. It was not uncommon for that to happen with all the traffic in there. In just a few seconds, pressure would build back and the purge would be reinstated.

But in this case, the purge system on the BOP panel was faulty, so while the door was open and the pressure seal was lost, the BOP panel detected the lost purge and automatically shut itself down.

By the time Williams arrived, he found the panel was back up, switched by an assistant driller to bypass mode. That meant that the panel could operate even without purge, running the risk—likely a tiny risk, but a risk nonetheless—that in an emergency situation, it would touch off a fireball.

Williams said that he had worked on that system during the
last rig move and discovered how to make the automatic system work, keyed to the purge or lack of purge in the drill shack.

“Do you want me to start it back in automatic?” Williams asked.

“No,” Williams says he was told. “The damn thing’s been in bypass for five years. Why did you even mess with it?”

It sounded callous, but there were almost always two sides to every safety equation. Mike Williams wasn’t wrong to worry. While the chance of the BOP panel igniting a fireball was remote, it was a real possibility. But a potentially more troubling possibility was that if the BOP panel shut down during a gas event, the driller would be left helpless, with no way to close off the well himself. It was a catch-22 that could only be resolved with the correct parts, parts that Williams knew had been on order for some time but had yet to arrive on the rig.

Jason Anderson would always tell anyone who’d listen how much he loved his work. But on this well, he was feeling the pressure. Doing things right, the way he’d taken such pride in learning, sometimes meant taking more time. The wear on the rig that went unattended and the mechanical breakdowns, combined with the exhortations from the BP men to hurry, were all starting to make him uncomfortable.

When this hitch ended and he went back home, he confided in his dad, Billy, a former high school football coach who’d gotten into the offshore business himself and steered Jason to his first rig job. Jason told his dad about the pressure to just get things done even if it meant cutting corners. In the past, he’d always been able to talk the company men out of something when he really felt it
was important. This time, he told his dad, the pressure was more intense than ever, and he was worried he was losing the argument.

It was an odd coincidence, but even as his worries peaked, surveyors for a risk management company showed up on the Horizon, contracted by Transocean to conduct a confidential survey. The survey suggested that Jason’s concern was shared by others. An analysis concluded that a significant number of workers worried that the quest to keep drilling always trumped the need for maintenance, forcing them to work with equipment that was becoming unsafe to use.

One man’s comment to the surveyors summed up the general frustration. “At nine years old, Deepwater Horizon has never been in drydock,” he said. “We can only work around so much.”

Both Transocean and BP put a lot of money, time, and effort into promoting the “core value” that any worker at any time could stop work he deemed unsafe. But half the workers surveyed said they feared that if they spoke up, especially about things being controlled by managers in Houston, they’d face serious reprisal.

With that fear hanging in the back of your mind, it could be hard to speak up. It wasn’t even just speaking up. What if you made your case, and the boss said, “I hear you, but we’re going ahead and doing it my way,” or the more common “I told the beach, it’s in their hands now.” How far were you going to go? The decisions were never black-and-white. Drilling a well was intensely complex and inherently risky. If you wanted to be 100 percent safe, you probably should never board a rig in the first place, nor start digging a hole in the ocean. And since risk was never entirely eliminated, you were never debating safety and danger in absolute terms. Millions of dollars were spent in accordance with percentages: How much was it worth to reduce the risk of a bad outcome from 1 percent to a half a percent?

After all, the Horizon had been drilling wells for a decade now, and nothing catastrophic had ever happened.

When his three weeks were up, Jason headed back to New Orleans and Port Fourchon, Louisiana, for that helicopter ride to the rig. At Macondo, things were starting to get interesting.

Up to this point, the hole had been passing mostly through sand and rock. The little pockets of gas it had hit along the way were mere soap bubbles compared to where they were headed—a fifty-foot-deep lake of liquid oil and natural gas permeating spongelike sandstone. Squeezed on all sides by billions of tons of rock exerting pressures of around 25,000 pounds per square inch, once pierced, it would explode to the surface as if a giant had stomped on a tube of toothpaste.

And the whole point of well construction was to build in such a way that the enormous force of upwelling oil and gas could be controlled, neatly shuffled into pipelines and sent harmlessly away to refineries. Job one was to ensure that this pipe they were sinking down, under enormous pressures deep inside the earth, did not leak. That would have been easier if a well were a single seamless cylinder of thick steel from top to bottom. But Macondo, and all deep wells, had to be made of pipes with seams and screw-together ends, and with smaller pipes hanging from larger ones—each connection a prime invitation to a leak. The first defense was to make sure that every individual section of the well was sealed up tight with cement.

Aboveground—pouring the foundation for a new house, say—cementing sounds simple enough. A plywood form is nailed together outlining the perimeter of the foundation, a cement truck backs up, dangling its cement chute over the mold, and pours
down liquid cement until the form is filled. When the cement is fully cured, workers break off the plywood and the foundation is complete. What the homeowner does not see is more complicated. The humidity, ground temperature, and location all determine the amount and types of material—rocks, chemicals, silica—that go into the slurry to ensure the right drying time and strength of the hardened product.

Cementing a well is even more complex and much more difficult. You can’t just pour cement in at the top and let gravity pull it down. You first have to get the correct mixture of chemical additives figured out, then find a way to pump the cement so that it flows out the bottom of the pipe and is forced up the thin annulus space between the pipe and the well wall, which is where the seal needs to be. As you pump the cement, it has to be untouched by any contaminants—like drilling mud or seawater, one or the other of which fills the hole at all times. Any mixing of those things with the cement will destroy its chemical integrity and render the cement job worthless. And you need to be certain, without being able to see it, that the cement went exactly where you meant it to go, and rose to an exact height in the annulus. To recap: The goal is to pump cement into spaces a couple of inches wide and completely submerged in water or mud without letting the water or mud contaminate the cement, using only tools that can be lowered through a narrow opening and operated from thousands of feet above.

It sounded like a trick even David Blaine wouldn’t dare attempt. But the rig had its own magicians. They had nothing up their sleeves, but they did put a “shoe” on the bottom of the casing. The shoe had rounded edges that helped guide the casing as it was lowered to the bottom without scraping the sides of the hole or getting caught on ledges. A high-pressure nozzle that could pump
mud or cement was lowered down into the casing pipe. To make sure that the pipe was clean and free of debris, mud was pumped through the pipe and out ports in the shoe. It hit the bare bottom of the hole, which forced it back up. The shoe, and the high-pressure flow coming out the holes in the shoe, prevented the mud from flowing back up the pipe. It had nowhere else to go but up the space between the outside of the casing and the bare wall of the hole until it came back out the top, carrying any debris with it.