In May 2003, the Transocean drillship Discoverer Enterprise, under contract from BP, was getting ready to pull out of a nearly-completed development well for the Thunderhorse project in the Gulf of Mexico, about 40 miles south of the current (2010) spill at the Macondo prospect. For some reason, the ship was dragged off its position such that the riser reaching down 6000 feet to the well at the seafloor was snapped off in two places. In this case, a blind-shear ram blow out preventer (BOP) did its job, sealing off the well below and preventing what could have been the largest U.S. oil spill. As it was, the only thing spilled was the drilling mud remaining in the various riser pieces dangling from the ship, buried in mud, or stuck vertically into the seafloor. After rehabilitating the well and then taking stock of the fact that the unthinkable could have happened, BP and Transocean apparently decided not to think about it too much more.

Don't Push That Button!

Drilling a well in thousands of feet of water from surface vessel is tricky business, and accidents do happen. For a good survey of the various ways in which blowouts can occur, see this rather extensive report. Also, the US Minerals Management Service (MMS), which oversees oil and gas extraction in the northern Gulf of Mexico, makes available on its web site reports of assorted accidents. A number of cases involve the riser becoming disconnected from the wellhead and spilling drilling mud into the water. It can be necessary to do this intentionally, or as part of an automated sequence, if the drillship cannot maintain its position directly above the well within some tolerance due to weather or strong currents. For example, here is one incident from 2005:

On July 5, 2005, an unplanned riser disconnect was initiated on the Ensco 7500 semi-submersible rig, which had been engaged in exploratory drilling activities, because of unfavorable sea and wind conditions associated with an approaching tropical depression. While the riser volume was being displaced with seawater in preparation for the disconnect operation, the rig was no longer able to maintain station adequately enough to complete the operation. As a result, the riser was disconnected from the Lower Marine Riser Package (LMRP), at which time 710 barrels of synthetic-based mud was released from the riser into the GOM. At the time of the disconnect, there were no open hole hydrocarbons exposed below the casing depth.

Here is a case where the disconnect became necessary due to bad data:

On December 2, 2007 at approximately 1300 hours with well completion operations in process, the Dynamic Positioning Operator (DPO) was performing a routine preventive maintenance procedure for the Dynamic Positioning (DP) system when the riser Emergency Disconnect Sequence (EDS) was activated. The disconnect was below the Lower Marine Riser Package (LMRP) where it connects to the BOP stack on top of the wellhead and resulted in the discharge of approximately 550 barrels of Sodium Bromide brine into GOM waters. For this procedure, DP functional control was transferred from the primary console to the secondary console and the primary console was subsequently shut down. DP functional control using the secondary console was observed to be normal. The primary console was restarted approximately three minutes later and the data backup function was initiated by the DPO. This function transfers control data from the online master console, at this time the secondary console, to other DP consoles to ensure correct synchronization between all consoles. The data transfer from secondary console to primary console was completed but some of the data transferred was corrupted and the DPO did not observe this. Functional control was then transferred from the secondary console to the primary console. The DPO recognized there was a discrepancy for the rig position shown on the both the primary and secondary consoles. In an attempt to correct the error, the DPO performed a second Initialize Backup function from the now master console, the primary console. This caused corrupt data to be transferred back to secondary console which now gave both the primary console and secondary console corrupt control data. The DPO, along with the Captain, observed the difference between the primary and secondary consoles and began trying to identify the fault. This was done by changing position references, transferring control capability between the control consoles, and enabling/disabling different position reference sensors. This resulted in another position reference sensor inadvertently becoming the master reference sensor and reset the apparent rig position such that the rig began to move further away from location when the DP system was trying to correct the rig position by moving the rig back on location. This led the DP system to chase after an erroneous position causing the rig to move outside its watch circle and exceed the riser angle limit, thus leading to the initiation of the EDS by the DP system which took approximately 58 seconds to complete. The process was initiated at the Driller Control Panel after confirmation was given by the DPO. The ROV was launched to inspect the wellhead, subsea tree, and BOP stack. The rig was moved to a safe location for the DP system to be analyzed and corrected.

This sequence of events is rather comical. But better still are the cases due directly to human error (although other humans contributed with poor design). Here is one:

Investigation of Riser Disconnect and Blowout, Mississippi Canyon Block 538, OCS-G 16614 Well #2, February 28, 2000

The Ocean Concord was in the process of running a liner on drill pipe when the lower marine riser package (LMRP) was inadvertently disconnected from the blowout preventer (BOP) stack. The disconnect resulted in the discharge to the sea of approximately 806 barrels of synthetic mud from the riser and 150 barrels of synthetic mud and 150-200 barrels of crude oil from the wellbore. Some findings: The SSE [Subsea Engineer] was installing the panel guards on the Riser Connector function button on the remote panel at 1410 hours on February 28, 2000.

The remote panel cover was open and the face of the panel was pulled out at the time of the incident.

The SSE inadvertently contacted the LMRP disconnect button while he was drilling mounting holes in the BOP panel.

while he was drilling mounting holes in the BOP panel. The SSE was unaware of the LMRP disconnection until he heard the alarms sounding, indicating low accumulator pressure.

The SSE stated during the Diamond SIR meeting that he did not follow any lockout/tagout procedures to de-energize the BOP control panel prior to working on the panel.

The light bulbs for the LMRP latch/unlatch functions were burned out at the time of the panel modifications. The following information was provided to the panel by Diamond from their post-accident SIR meeting: The SSE stated that he did not realize it was possible to lock out the remote panel until after the incident.

The SSE had never been to well-control training . He had worked for another contractor as a roughneck and had recently trained with both subsea engineers on the Concord. The SSE stated that additional training may have helped him prevent this incident. The OIM stated that this was the SSE’s second hitch on his own on the Concord.

. He had worked for another contractor as a roughneck and had recently trained with both subsea engineers on the Concord. The SSE stated that additional training may have helped him prevent this incident. The OIM stated that this was the SSE’s second hitch on his own on the Concord. The SSE stated that he knew that if the riser unlatched that there would be a loss of mud from the riser, but he did not know that the well would flow. The SSE also stated that he did not consider "any such risk prior to the job" of installing the panel guards.

Here is yet another problem involving a Sea Surface Engineer pushing buttons by mistake. It can be found in the MMS reports here. The incident date was January 19, 2000.

The rig's subsea engineer was function testing the blind shear rams. The weekly function test was performed from the remote blowout preventer (BOP) panel in the offshore installation manager's office. Instead of testing the blind shear rams, the engineer inadvertently pushed the LMRP button on the panel which unintentionally activated and disconnected the lower marine riser package (LMRP). The control panel buttons for the lower marine riser package (LMRP) did not have enough security to prevent activating the wrong function. It was determined that 2,400 barrels of 60% synthetic-based drilling mud (SBM) leaked into the Gulf of Mexico. It is estimated that the lost SBM contained approximately 1,440 barrels of synthetic base oil.

Based on the block (822), this would be an early well in the Thunderhorse field. However, the first well in that block wasn't completed until 10 months later, based on the development history of the field.

Thunder Horse 2 was drilled in Block 822. It reached its total depth of 29,060ft in November 2000. The well was drilled by the Discoverer Enterprise in 6,300ft of water, 1.5 miles south-east of the discovery well. It encountered 675ft net of pay in three primary intervals.

The discovery well Thunderhorse 1 was completed in 1999 in a different block, leading to the strong probability that this well is indeed Thunderhorse 2 -- and that it took another ten months to finish. This document seems to confirm this identification (see Appendix Table H-2), indicating the drilling started in December 1999. In any case, it brings us back to the broken riser incident we started with as the drillship involved above was also the Transocean Discoverer Enterprise. BP's currently underperforming Thunderhorse endeavor seems to have had a storied beginning as well.

Failure to Disconnect

Here is a brief MMS report on the riser break incident:

The spill occurred at Mississippi Canyon (MC) 778, latitude 28.19 degrees N. and longitude 88.49 degrees W. It occurred as the Discoverer Enterprise was pulling out of the wellhole with bottom location at MC 822. At the time of the incident, conditions were 2-3 ft seas with a 1.9 knot current. The drilling vessel was in the process of pulling of of the hole when it experienced wave action heaving and jarring. The riser parted in two places at approximately 3,200 ft an 5,087 ft. water depths. There was a release of 2,450 barrels of 58% Accolade synthetic-based drilling mud (SBM). It is estimated that the lost SBM contained approximately 1,421 barrels of Accolade synthetic base oil .

I found more details, also apparently from MMS, here.

While drilling in approximately 6,000 feet of water, a drillship recently experienced a catastrophic failure of the marine riser. The drillship was equipped with a dual derrick, and dual activity was being conducted at the time of the incident. On the forward rotary, where the marine riser was installed, the rig crew was in the process of pulling out of the hole from total depth. On the aft rotary, the rig crew was in the process of running 20-inch casing for an adjacent well. The failure of the flanged marine riser occurred when drillpipe had been pulled a couple hundred feet off-bottom. At that time, the rig experienced a heave motion followed by a strong jarring action. The ROV, which had been launched to observe the running of the 20-inch casing, was dispatched to examine the marine riser. When the ROV reached approximately 3,200 feet of water, it was determined that the riser had separated between riser joint 39 and 40 and was unloading the synthetic-based mud that was in use at the time. The drillpipe was observed to be intact at this depth. As the ROV traced the drillpipe deeper, it was found penetrating the lower section of buoyant riser that was free-standing from the seafloor to approximately 1,000 feet from the mudline. The remainder of the riser was found scattered on the seafloor surrounding the wellhead and BOP stack. As the ROV scanned the BOP stack, it was determined that the riser was cleanly parted about one foot above the lower marine riser package. There was no flow observed from the well. When the riser parted, the "dead man" system activated, and all fail safe valves, casing shear rams, and lower blind shear rams were closed. The drillpipe was successfully sheared by this activation. At a later point, the ROV used a hot stab to activate a second set of upper blind shear rams to provide another barrier on the wellbore. Although the well control equipment functioned as designed, the parting of the marine riser resulted in a release of an undetermined amount of synthetic based mud. The subject accident is currently under investigation by MMS. Upon its completion, the investigation report, as well as a possible follow-up Safety Alert, will be made available to the public. Your attention is directed to our conditions of approval for Applications for Permit to Drill involving the use of subsea BOP stacks. The approval outlines our requirements for the shut-in capability of the well in the event of an unplanned disconnect of the lower marine riser package or the parting of the marine riser. It should be noted again that, in this incident, the "deadman" system functioned properly and prevented the release of well bore fluids into the water column.

Shown below is a comparison of the Lower Marine Riser Package (LMRP) for the 2003 Thunderhorse well (with the riser "parted") with that for the 2010 BP Macondo well after the bent riser was cut off with a saw. In the case of the former, the LMRP was disconnected from the BOP using the hot stab panel. For the Macondo well, this must not have been possible, since the "Containment Cap" to collect the oil was apparently designed to be sealed around the existing LMRP.

Left: LMRP for BP Thunderhorse, 2003. Right: LMRP for BP Macondo, 2010

The Afterspill, and What Could Have Been

The final MMS report on this incident was rather inconclusive as to why the riser was ripped apart.

Fate and Effects of a Spill of Synthetic-Based Drilling Fluid at Mississippi Canyon Block 778

In particular, the Loop Current in the Gulf of Mexico was exonerated:

The Loop Current did not directly affect the MC 778 drill site on May 21, 2003. Currents were weak in the upper 1,100 m (3,609 ft). Current speeds below 1,100 m (3,609 ft) are not known because measurements taken by the operator and made available to MMS did not extend from 1,100 m (3,609 ft) to the seafloor at 1,841 m (6,040 ft).

However, one report on this incident, excerpted in the TAMU spreadsheet, reads as follows:

At the time of the incident, conditions were 2-3 ft seas with a 1.9 knot current. The drilling vessel was in the process of pulling of of the hole when it experienced wave action heaving and jarring. The riser parted in two places at approximately 3,200 ft an 5,087 ft. water depths.

What differentiates this incident (along with many other cases of riser separation) from the 2010 Macondo spill is that the BOPs did what they are supposed to in 2003. Most importantly, the blind-shear BOP engaged, cutting through the drillstring and closing off the well.

Shear blades to cut through the DP and seal the well (Varco )

What if this hadn't happened? BP definitely thought about this, and worked with the NOAA Office of Response and Restoration to consider the potential impact.

The top connector of the BOP was damaged, with one joint leaning against the BOP, dangerously close to the control lines .... Loss of well containment would result in more oil spilled in a week than occurred during the whole of the T/V Exxon's Valdez oil spill.

From: COMBINING MODELING WITH RESPONSE IN POTENTIAL DEEP WELL BLOWOUT: LESSONS LEARNED FROM THUNDER HORSE

NOAA performed modeling to gauge the consequences of such a large spill in deepwater, but many unknown parameters prevented definitive conclusions. Indeed, the realization of the scenario with the Macondo spill has provided many surprises with regards to the fate of the oil and gas.

Heck of a Job, BP

Other paperwork which emanated from the near-spill seems less contemplative, but rather more inwardly focused on what went right in a corporate sense. First, we have an article in the Society of Professional Engineers (SPE) journal, which is available in this preview:

Thunder Horse Drilling-Riser Break—The Road to Recovery

Here are the "Major Learnings":

Show Leadership Commitment.

Implement Project-Management Practices Quickly.

Secure the Right External Technical Expertise.

Get the Right Support Staff.

Get People in the Right Places.

Plan How To Communicate Internally and Externally.

Also, BP funded a study by the School of Psychology at the University of Aberdeen, King’s College, Aberdeen, Scotland.

Following the initial message from the rig to the Operations Manager, an Incident Management Team (IMT) was assembled in the Houston office. The IMT immediately began to assess the situation, take steps to give instructions to the rig to assess and control damage, and to plan a longer-term response. The IMT was faced with a challenging situation, one which had never been experienced before especially in such depths of water. Fortunately neither injuries, nor environmental leakage had occurred. A number of separate sub-teams were established and tasked with dealing with issues such as Operations, Riser recovery, Blow Out Preventer (BOP) operability, Well integrity, Well re-entry, and Relief well planning. The task for the IMT was to assess and respond to any potential threat to people, wildlife or the environment, to secure the remaining riser section, to recover scattered riser pieces (on the sea bed), and eventually to re-attach the pipes connecting the rig to the well-head. After a period of 68 days, with a financial cost of $100,000 per day, the rig was re-attached to the well head and the well was stabilised without any leakages to the environment

From: INCIDENT COMMAND SKILLS IN THE MANAGEMENT OF AN OIL INDUSTRY DRILLING INCIDENT

The Missing Memo

While such self-reflection is useful, recent events suggest that something is missing. The difference between a cost of $6.8 million plus 68 days delay, and a cost of untold $billions plus environmental disaster, was the last line of defense, the blowout preventer. In the 2003 spill, and in many similar cases, the fact that the blind-shear BOP functioned as intended is not a sign that the system worked, for a truly fail-safe system would be where the last line of defense from disaster is never reached. MMS did note the alarming trend in this 2005 memo:

Human Engineering Factors Result in Increasing Number of Riser Disconnects

A significant number of accidental riser disconnects have been experienced in deepwater operations during the last five years. Each event had the potential for causing serious well-control issues.

So here we are five years later, and we finally hit paydirt with a failed BOP and a spill for real. We can ponder about what would have transpired if the oversized wire cutters would have worked on the Deepwater Horizon, stopping the Macondo spill before it started. A few internal studies by those involved. Another MMS report of a drilling mud leaking from a severed riser. Louisiana fishermen still working.

Snip.