The Macondo well blowout and perceived damage to the Gulf of Mexico marine and Louisiana coastal environments has dominated many headlines for months; that and the huge cost to BP and whether the company would survive the disaster intact.
But what about the Transocean rig that blew up and sank with the loss of 11 crew?
Prior to the explosion, were the risks to persons on board Deepwater Horizon acceptable?
According to chartered engineer Bill Campbell, who has closely analysed the disaster, blowouts are rare and some have not led to explosions, making recovery efforts more likely to succeed.
The fatalities and the total destruction of the installation may have been prevented if an explosion had not occurred.
Campbell has applied his 44 years in hazardous industries and specialist knowledge of the design, commissioning, operation and maintenance of offshore installations to analyse what appears to have happened aboard the rig before and during the blow-out and fatal ignition.
In his analysis of survivor testimony, he concentrates on what the source of the ignition was. And he postulates whether design and operating changes adopted after a previous disaster in the UK – Piper Alpha – had been enacted in the US offshore oil industry, the Deepwater Horizon explosion may not have happened.
On Deepwater Horizon, at the time of the explosion, there was a ceremony in the accommodation module celebrating seven years without a lost-time incident. Indeed, the installation, owned and operated by Transocean, had an outstanding record of preventing lost-time incidents. However, post-Piper Alpha, Campbell says it was recognised that having a low number of lost-time incidents or, as was the case on Deepwater Horizon, zero incidents, was no assurance whatsoever that the risks to the health and safety of persons from major-accident events on offshore installations were within acceptable limits.
“The reality was that Deepwater Horizon was a dangerous place for the persons on board irrespective of its world-class performance in protecting them from occupational injuries,” he says.
“Whether assessed numerically by quantitative risk analysis (QRA), or by qualitative risk analysis, Deepwater Horizon, as it operated in the period leading up to the incident, had risk levels likely to be in the intolerable range, at levels unacceptable to society, in the weeks prior to the explosion.”
Was the disaster not only foreseeable, but inevitable?
Due to well-control problems, a number of significant gas releases into the atmosphere occurred in the weeks prior to the disaster. Allied to this, and from examination of witness testimony, insufficient measures appear to have been in place to prevent gas being ingested into an enclosed non-hazardous area where sources of ignition are constantly present during normal operations. Campbell: “So the probability that a flammable atmosphere could exist on Deepwater Horizon was high, and the probability of subsequent ignition causing an explosion was high. The two combined on May 20 with catastrophic effect. This leads to two crucial questions. Why was there an apparent acceptance of gas leaks in the weeks prior to the explosion? Why did the gas cloud ignite that day when previous releases had not?”
In an attempt to answer these questions, Campbell has examined the testimony of various survivors, mainly that of Mike Williams.
“It’s relevant here to give a picture of how gas releases would have been handled offshore UK and the general attitude and intolerance of such events. This is of interest to any formal US inquiry.
“It is useful to remind ourselves of the Piper Alpha disaster. The source of ignition was as a result of gas entering a non-hazardous area where sources of ignition were present during normal operations.
“Post-Piper Alpha, an operator of any type of installation, fixed, floating production or mobile offshore drilling unit (MODU), needed to demonstrate that the risks to individuals, and to the total population of the installation, were within acceptable limits. Further, that the operator had to provide a safe haven or temporary refuge (TR) on the installation that could endure all foreseeable threats from fire or explosion due to escalating hydrocarbon events for a stated endurance period, normally one hour.
“Let’s take it as a given that the rig complied with class requirements. The dominant risk to persons on board were fire or explosion due to transient well instability with gas emitted at the shale shaker from the drilling cuttings or from an uncontrolled release from the well.”
So, on Deepwater Horizon, was a significant gas release foreseeable?
“As per testimony obtained from survivors and other sources on Deepwater Horizon, in the months before the blowout, significant releases of flammable gas into the atmosphere had occurred. Public address (PA) announcements warned those onboard to stop all work that may have caused an ignition.
“My assumption is that these releases were significant (meaning, in UK legislation, that they were potentially in the explosive range of the principal flammable gas, methane, about 4.8%-15% by volume in the air). “The mud-treatment area, shale shaker and drill floor, are areas where a flammable atmosphere is likely to occur in normal operation, and these were no doubt classified as Zone 1 or 2.
“Electrical equipment located in these areas would have been explosion-proof if installed, operated and maintained in line with certification requirements. My assumption is that, on Deepwater Horizon, hydrocarbon (HC) and toxic gas (H2S) detection systems were installed in these areas in line with industry practice.”
Gas releases in the UK are defined as dangerous occurrences. However, an apparent difference in attitude and approach to gas releases between the UK and US seems to exist. In the UK, all gas leaks are to be reported, large or small. Significant releases are defined as “dangerous occurrences” and must, by law, be reported.
Campbell: “Perhaps this is not surprising in the UK as 167 men died in 1988 as a result of an ignited gas leak. Like Deepwater Horizon, the Piper Alpha had forewarning when, earlier in its operations, a major gas leak had not ignited. Lord Cullen, in his recommendations, placed considerable emphasis on preventing gas leaks, but if they did happen, they must be prevented from igniting.
“If it had been operating in the North Sea, the Deepwater Horizon – with the significant gas leaks as described by survivors that occurred in the weeks before the incident – would have been expected to cease operations after making secure the well.
“The incident would have been reported to the Health & Safety Executive, whose inspectors would, more than likely, fly out the next day, and the operator would be required to indicate what actions he was to take before drilling could resume.
“The point I make is perhaps to highlight my perception of the attitude and behaviour to the risks associated with gas releases during drilling operations.
“Drilling ahead at all costs despite the risks would not have been acceptable in the UK. If flammable atmospheres are present on an offshore installation, it doesn’t matter whether they come from the flange of a gas compressor (Piper A) or from the well via the drilling cuttings, the consequences can be catastrophic if the gas ignites.
“From testimony and detail already in the public domain, the US regulator, MMS (Minerals Management Service), was aware of these problems and had requested that the operator was to ‘proceed with caution’. Any inquiry no doubt will determine how this not unreasonable request was enacted.”
Next question: was there adequate protection on Deepwater Horizon as regards prevention of explosions?
According to Campbell, there is no indication from any testimony that the developing blow-out itself caused deaths or injuries, and toolpusher, driller, mud engineer, and so on, as key players in the developing situation, may have been able to take manual actions locally re the BOP and the employment of the surge diverter.
“Although they would have very little time, just maybe, and with some difficulty, the situation could have been brought under control. With the explosion, all hope was gone.”
Where was the most likely source of ignition causing the explosion?
“Based on the testimony of Mike Williams who owes his life to the protection afforded by a heavy door on the workshop wall between the workshop and the diesel engine module, it seems clear that, when he heard the results of the gas ingesting into the air intakes of the diesel engines driving the AC alternators, no explosion had yet occurred, and AC generation was still ongoing because he talks about the lights still being on.
“At about 21.45, three fishermen in their boat immediately under the installation heard the roar coming from above and smelled the gas. This is reasonably assumed as the blow-out commencing. They beat a hasty retreat. From a distance they estimated at 100 yards, they saw blue flashes, and then all hell broke loose. They videoed the fireball which, by then, was covering a significant area of the rig’s topsides.”
Campbell says that any inquiry should determine the delay period between the uncontrolled release of hydrocarbons and the ignition. Survivors speak about gas shooting across the decks.
“My opinion is that this delay would have been more than sufficient for the gas to migrate from the drill floor or mud-treatment modules to the HVAC (heating, ventilation and air-conditioning) inlets of enclosed non-hazardous areas. The diesels, AC alternators, the 11kV switchboard and the emergency generator located in these areas are all capable of causing the ignition of the gas.
“The gas was clearly being ingested into the air intakes of the engines. These were over-speeding, the lights were getting incredibly bright, and then the first explosion occurred.
“If the gas had been ignited at the mud-treatment skid or in the area around the drill floor/riser, an explosion would have occurred prior to Williams hearing its effect on the diesel engines.
“Since the electrical equipment in these drilling areas should be explosion-proof, and since gas had entered these areas on several occasions in the weeks before the blow-out but had not ignited, it appears that the seat of the explosion was, on the balance of probabilities, where Williams was located.
“He has also testified to the force of this explosion at his location, indicating it was local. This, in my opinion, excludes other areas suspected of being the source of ignition, such as the accommodation galley. The second explosion outside the second door to the workshop appears as violent as the first, which would indicate this explosion was in another module adjacent to where Williams was located and not an explosion emanating from the accommodation module or elsewhere.”
What was Williams witnessing? Campbell points out that the centrifugal over-speed device on the engine output shaft (if fitted) would probably have operated to close the fuel-valve inlet.
Disconcertingly, however, to anyone who has ever witnessed this, the engine continues to rev and increase speed with an alternative source of fuel.
Campbell says this means that the gas-air mixture being ingested into the engine must have been in the explosive range. That gas-air mixture was fuelling the engine irrespective of the diesel fuel supply having been isolated or not.
“This again supports my opinion that, in the vicinity of the diesel engines in the non-hazardous area where they were located, a flammable atmosphere existed some time after the blow-out started, and prior to the explosion.
“Williams does not mention any sounding of a general platform alarm (GPA) or announcement on the PA system. His first realisation that something is amiss is ‘I hear the engines revving’.
“My assumption is that the beep alarm he is hearing is from the control instrumentation panels for the engines and not from any GPA. This should be clarified.”
The galley: could this have been the location of secondary explosion?
Campbell thinks that the description of the injuries to personnel located there could suggest a smaller secondary explosion within the accommodation, but the pressure wave is usually followed by a slow moving flame-front.
“Testimonies do not indicate that persons in the accommodation suffered burn injury. There is testimony too that the blast damaged escape walkways to the accommodation, and it seems that the injuries of those within may have occurred as the accommodation moved violently off its foundations.”
As for hot surfaces, Campbell points out that there is testimony that the ignition could have been from exposed surfaces of equipment in the mud-treatment area.
“The mud-treatment skid, if it had increased safety-certified equipment, would – or should – have been certified temperature class (T class) T1 of 450C,” says Campbell.
“This is the maximum temperature attainable within the enclosure even under short-circuit or other defined fault conditions and is well within the ignition temperature of methane – 595C.”
Deepwater Horizon has many open areas, around the helideck, outside muster stations, part of the pipe deck and other areas considered non-hazardous. But, in abnormal conditions, because they are open, Campbell considers that gas from a major leak such as a blow-out could be present in these areas.
“By convention, any electrical equipment in these areas is explosion-proof. I would expect the rig would be in line with this standard.”
However, Campbell’s main interest is enclosed non-hazardous areas. This is where the hazard area classification and the selection of electrical equipment work together.
According to BS 5345 Part 1:1976, “A non-hazardous area is an area in which explosive gas-air mixtures are not expected to be present so that special precautions for the construction and use of electrical apparatus are not required”.
Such areas on Deepwater Horizon would be rooms containing the diesel engines, AC alternators, 11kV high-voltage (HV) and the medium-voltage (MV) switchboards, emergency generator, and fire-pumps. Since gas could be ingested into areas with known sources of ignition, they are normally protected as described below in UK offshore installations, including being over-pressured.
It is usual to have an alarm linked from such areas to a central control room if the internal pressure falls to atmospheric, indicating forced ventilation failure.
Campbell: “This was how the HVAC on the Piper Alpha central control room operated, but on the fateful day in 1988, it was thought gas was ingested into the control room by the forced ventilation. There were no gas detectors in the HVAC inlets.
“A significant post-Piper Alpha design change was that all such enclosed areas would have gas detection in the air inlets. In addition, a signal from the gas sensors would trip the main AC generation to all the installation.
“So there were, in essence, two barriers of protection after gas was detected in its HVAC inlets to enclosed non-hazardous areas. The area was essentially sealed to prevent ingress of gas by the closure of the fire-rated dampers and by tripping the ventilation fans. And the electrical equipment capable of causing a source of ignition was isolated by the tripping of the main AC generation.”
He says this is the same system of protection afforded the temporary refuge, but with the addition of smoke detection at inlets.
In addition, some areas, such as that housing the temporary generator, have gas detection also within the room which will inhibit the generator from starting if above 20% LEL is detected.
What Campbell would have expected to happen on Deepwater Horizon on May 20 if it had been afforded the same degree of protection as an offshore installation in the UK operating under a safety case – where fire and explosion studies had been completed and risks reduced to acceptable levels – is a phased alarm/alert system, automatic, phased shutdown of relevant systems and clear procedures for personnel.
Say the gas detection system failed to operate in the drilling areas. On gas detection at 20% LEL in the HVAC inlets to the enclosed areas of the workshop where Williams was, or the engine space, the forced ventilation would trip and fire dampers would close. The main AC generation would also be tripped and the GPA would show change of status.
Contrast this with Deepwater Horizon on May 20:
Although gas was present all over the moon pool and mud-treatment area, Williams was not aware of this (nor anyone else not at the scene) as there was apparently no alarm (GPA).
On gas entering the diesel engine area, there was still no GPA and no gas detection apparently operated to close fire dampers and trip the forced ventilation. The AC generation system was still running and the lights still get brighter and brighter.
The diesel engines were revving and over-speeding.
An explosion occurred.
Campbell: “It would appear that, almost a quarter of a century after 167 people were killed because gas entered a non-hazardous area containing sources of ignition, this apparently happened again on Deepwater Horizon.”
It should never have happened.