While double blind shear rams are an improvement over singles they do not solve the myriad of problems that have contributed to a forty percent blow out preventer failure rate in real world conditions. It is insanity to consider BOPs fail-safe devices. The reality is that they more closely resemble a wobbly safety layer.
Since the Deepwater Horizon catastrophe I have not read a single thing about there being a top to bottom review devoted to identifying and eliminating all single points of failure in BOPs nor there being a method devised to adequately test them to be sure that they will operate at the tremendous pressures under which they are currently being used. Water pressure at a mile deep is over one ton per square inch contrasted with 14.7 pounds per square inch at the ocean surface.
It was the last line of defense, the final barrier between the rushing volcanic fury of oil and gas and one of the worst environmental disasters in United States history.
Its very name — the blind shear ram — suggested its blunt purpose. When all else failed, if the crew of the Deepwater Horizon oil rig lost control of a well, if a dreaded blowout came, the blind shear ram’s two tough blades were poised to slice through the drill pipe, seal the well and save the day. Everything else could go wrong, just so long as “the pinchers” went right. All it took was one mighty stroke.
...
But the questions raised by the failure of the blind shear ram extend well beyond the Deepwater Horizon.
An examination by The New York Times highlights the chasm between the oil industry’s assertions about the reliability of its blowout preventers and a more complex reality. It reveals that the federal agency charged with regulating offshore drilling, the Minerals Management Service, repeatedly declined to act on advice from its own experts on how it could minimize the risk of a blind shear ram failure.
...
As it turns out, records and interviews show, blind shear rams can be surprisingly vulnerable. There are many ways for them to fail, some unavoidable, some exacerbated by the stunning water depths at which oil companies have begun to explore.
But they also can be rendered powerless by the failure of a single part, a point underscored in a confidential report that scrutinized the reliability of the Deepwater Horizon’s blowout preventer. The report, from 2000, concluded that the greatest vulnerability by far on the entire blowout preventer was one of the small shuttle valves leading to the blind shear ram. If this valve jammed or leaked, the report warned, the ram’s blades would not budge.
...
Whatever the reasoning, the result was that the Deepwater Horizon was left with just one blind shear ram to contain a blowout. And yet, The Times examination found, government regulations do not require any regular checks of several important elements of blind shear rams.
What’s more, when those elements were put to the test after the blowout, some appeared to malfunction. In addition, interviews and documents show that after the crew abandoned the rig, the initial frantic efforts to find another way to activate the blind shear ram were hampered by the lack of submersibles with sufficient power.
...
Using the world’s most authoritative database of oil rig accidents, a Norwegian company, Det Norske Veritas, focused on some 15,000 wells drilled off North America and in the North Sea from 1980 to 2006.
It found 11 cases where crews on deepwater rigs had lost control of their wells and then activated blowout preventers to prevent a spill. In only six of those cases were the wells brought under control, leading the researchers to conclude that in actual practice, blowout preventers used by deepwater rigs had a “failure” rate of 45 percent.
...
Rising five or more floors and weighing hundreds of thousands of pounds, these devices were daunting in their scale and complexity. There were hundreds of ways they could malfunction or be improperly maintained, tested and operated. Not only did they have to withstand extreme environments, they were relied upon to tame the ferocious forces often unleashed when drilling rigs penetrate reservoirs of highly compressed oil and gas.
They were also costly to maintain. An industry study last year estimated the price of stopping operations to pull up a blowout preventer for repairs at $700 per minute.
...
Blowout preventers are designed to handle a range of well control problems. They come with several types of rams, giving rig workers flexibility if a situation escalates. But one component in particular has to work properly: the blind shear ram, the last finger in the dike during an uncontrolled blowout.
...
More than three decades ago, the failure of a shear ram was partly to blame for one of the largest oil spills on record, a blowout at the Ixtoc 1 well off the Yucatan Peninsula in Mexico. Descriptions of the accident at the time detailed problems both with the shear ram’s ability to cut through thick pipe and with a burst line carrying hydraulic fluids to the blowout preventer.
In 1990, a blind shear ram could not snuff out a major blowout on a rig off Texas. It cut the pipe, but investigators found that the sealing mechanism was damaged. And in 1997, a blind shear ram was unable to slice through a thick joint connecting two sections of drill pipe during a blowout of a deep oil and gas well off the Louisiana coast. Even now, despite advances in technology, it is virtually impossible for a blind shear ram to slice through these joints. In an emergency, there is no time for a driller to make sure the ram’s blades are clear of these joints, which can make up almost 10 percent of the drill pipe’s length.
...
But in two studies, in 2002 and 2004, one of the industry’s premier authorities on blowout preventers, West Engineering Services of Brookshire, Tex., found a more basic problem: even when everything worked right, some blind shear rams still failed to cut pipe.
West’s experts concluded that calculations used by makers of blowout preventers overestimated the cutting ability of blind shear rams, so-called because they close off wells like a window blind. Modern drill pipe is nearly twice as strong as older pipes of the same size. In addition, the intense pressure and frigid temperatures of deep water make it tougher to shear a pipe. These and other “additive pressures,” the researchers found, can demand hundreds of thousands of additional pounds of cutting force.
Yet when the team examined the performance of blind shear rams in blowout preventers on 14 new rigs, it found that seven had never been checked to see if their shear rams would work in deep water. Of the remaining seven, only three “were found able to shear pipe at their maximum rated water depths.”
...
The study found that blowout preventers almost always passed the required government tests — there were only 62 failures out of nearly 90,000 tests conducted over several years — but it also raised questions about the effectiveness of these tests.
“It is not possible,” the study pointed out, “to completely simulate” the actual conditions of deepwater wells.
...
The Minerals Management Service knew the problems, too. In fact, the agency helped pay for many of the studies that warned of their shortcomings, including those in 2002 and 2004 that raised doubts about the ability of blind shear rams to cut pipe under real-world conditions.
...
Last year, when BP applied for its permit to drill the Macondo well, its application was reviewed by Frank Patton, an engineer in the New Orleans office of the Minerals Management Service. With nearly three decades of experience working for the agency and the oil industry, Mr. Patton was fully aware of the blowout preventer’s importance.
“It is probably the most, in my estimation, the most important factor in maintaining safety of the well and safety of everything involved, the rig and personnel,” he testified last month during the Coast Guard’s inquiry into the disaster.
Yet Mr. Patton said he approved BP’s permit without requiring proof that its blowout preventer could shear pipe and seal a well 5,000 feet down. “When I was in training for this, I was never, as far as I can recall, ever told to look for this statement,” he explained.
Mr. Patton said he had approved hundreds of other well permits in the gulf without requiring this proof, and BP likewise contends that companies have never been asked to furnish this proof on drilling applications.
In subsequent testimony, Michael Saucier, the agency’s [Minerals Management Service now Bureau of Ocean Energy Management, Regulation and Enforcement] regional supervisor for field operations in the gulf, insisted that the regulation was enforced. But asked if anyone ensures that a blowout preventer functions properly, Mr. Saucier replied, “I don’t know if somebody does or not.”
...
The deadman, the autoshear and the underwater robots constitute the critical backup systems that have given regulators and oil industry officials great confidence that no matter what, they could always find a way to activate their last line of defense.
This was more an act of faith than a fully tested proposition.
The Minerals Management Service had never required any of these backup systems to be tested despite a report it commissioned in 2003 that said these systems “should probably receive the same attention to verify functionality” as the rest of the blowout preventer. The agency had also declined to take the modest step of requiring rigs to have these backup systems in place at all, though it had sent out a safety alert encouraging their use.
...
So six days after the explosion, they began the fifth effort to close the blind shear ram. This time they sent down tanks of pressurized hydraulic fluid that a submersible could inject directly into the ram.
Shockingly, the blind shear ram’s hydraulic system leaked, meaning pressure could not be maintained on its shearing blades.
This leak shocked engineers because the blowout preventer’s hydraulic system was obsessively checked for leaks. “We see tests fail because the hydraulics leaked two drops,” said Benton Baugh, a leading authority on blowout preventers. Indeed, the blind shear ram had been tested for leaks only hours before the blowout, and according to Transocean, no hydraulic leaks had been detected in the weeks before the blowout.
The underwater robots tried to find and fix the leak, but by now, leaks were springing up on nearly every component of the blowout preventer.
...
Finally, seven long days after the explosion, operators of the underwater robots managed to repair the leak on the blind shear ram and apply 5,000 pounds per square inch of hydraulic pressure on its blades. This was nearly double the pressure it typically takes to shear pipe.
A BP report tersely described the results: “No indication of movement.”
...
In mid-May, Mr. Watson [an expert in gamma ray imaging at Los Alamos National Laboratory] ventured to the well site, where robotic submersibles were sent down to the seafloor with cobalt 60, a radioactive isotope that generates gamma rays. The team from Los Alamos was able to get a clear view of only one half of the blind shear ram. But the images showed one wedge lock fully engaged, meaning at least one half of the shear ram had deployed.
“I don’t think anybody who saw the pictures thought it was ambiguous,” Mr. Watson said.
It was a crushing moment.
...
The last line of defense was a useless carcass of steel.
...
But Mr. Salazar stopped short of what Mr. Hayward, the BP chief executive, said was called for in the aftermath of the Deepwater Horizon disaster. “We need a fundamental redesign of the blowout preventer,” Mr. Hayward testified last Thursday.
Still, J. Ford Brett, a drilling expert who contributed to Mr. Salazar’s list of suggestions, cautioned that blowout preventers, whatever their design, “will not save you in every situation.”
