Analysis of the cause of the Deepwater Horizon explosions.

Published:  29 July, 2010

Bill Campbell, retired HSE Group Auditor for Shell International – a renowned expert on offshore platform safety issues – discusses if the risk levels onboard Deepwater Horizon in advance of the April 20th explosions were acceptable.

Many commentators around the World talk about the cause of the explosion on Deepwater Horizon when they actually mean the cause of the blowout and subsequent pollution. Blowouts are thankfully rare events and some have not led to explosions making recovery efforts more likely to succeed. The fatalities and the total destruction of the installation may have been prevented if an explosion had not occurred.  So in this analysis of survivor testimony I concentrate on what the source of the ignition was.  And postulate if design and operating changes adopted after a previous Disaster in the UK had been enacted in the US offshore oil industry the explosion may not have happened.

Occupational safety versus risk awareness

On Deepwater Horizon (DH) at the time of the explosion a ceremony was held in the accommodation module which celebrated seven years without a “Lost Time” Incident. The installation, owned and operated by Transocean, had an outstanding record of preventing lost time incidents. 

Post Piper Alpha, it was recognized that having a low number of “Lost Time” incidents – in the case on DH Horizon, zero incidents – was no assurance whatsoever that the risks to the health and safety of persons from major accident events on offshore installations were within acceptable limits. 

Within US the oil industry in recent years, the technical investigation into the Texas City refinery explosion was critical in that whilst BP concentrated on occupational risks, e.g. slips trips and falls, it paid inadequate regard to the risks of catastrophic events.

The reality was that DH proved a dangerous place for the persons on board, irrespective of its world class performance in protecting them from occupational injuries.

If the probability of an undesirable event is high, and the consequences of that undesirable event are potentially catastrophic, then the risks are dangerously high. Risk is the product of the probability and the consequence of the event happening.  Whether assessed numerically, by Quantitative Risk Analysis (QRA), or by Qualitative Risk Analysis, DH as it operated in the period leading up to the incident had risk levels likely to be in the intolerable range, at levels unacceptable to society in the weeks prior to the explosion.

Was the disaster not only foreseeable but inevitable?

Due to well control problems a number of significant gas releases into the atmosphere occurred in the weeks prior to the disaster.  Allied to this, and from examination of witness testimony, insufficient measures appear to have been in place to prevent gas being ingested into an enclosed non hazardous area where sources of ignition are constantly present during normal operations. 

So the probability that a flammable atmosphere could exist on DH was high and the probability of subsequent ignition causing an explosion was also high. The two combined on the 20th April with catastrophic effect.

Why was there an apparent acceptance of gas leaks in the weeks prior to the explosion and why did the gas cloud ignite on the 20th May when previous gas releases had not ignited?

In the attempt to answer these questions the testimony of various survivors is examined, mainly the one that Mike Williams gave in the CBS 60 minutes video. 

So, was there an inadequate reaction in the weeks before the blow-out to the gas releases caused by well control instability?

It’s relevant here to give a picture of how gas releases would have been handled Offshore from the UK and the general attitude and intolerance of these events. This is of interest to any formal US Inquiry and to the work professionals in this industry have been tasked with. 

Background

Piper Alpha was as a result of gas entering a non-hazardous area where sources of ignition were present during normal operations. 

Post Piper Alpha an operator of any type of installation –fixed, floating production or MODU – needed to demonstrate that risks of the installation were within acceptable limits to the population and individuals. This could be done by using a QRA or Qualitative Risk Analysis. To assist this Explosion and Fire Analysis were completed.  Also Survivability analysis to show that critical safety systems could withstand fire and explosion. 

In addition, the operator had to provide a safe haven or temporary refuge (TR) on the installation that could endure all foreseeable threats from Fire or Explosion due to escalating hydrocarbon events for a stated endurance period, normally one hour. The fire, explosion and survivability studies thus also helped in the design requirements for the TR.

Other risks were assessed such as ship collision, dropped objects etc both relevant also to a MODU such as DH which since it was certified as a vessel the competent authority ABS would have I assume ensured it met all SOLAS requirements. Lets take it as a given, that the vessel complied with class requirements. The dominant risk to persons on board were the risks of fire or explosion due to transient well instability with gas emitted at the Shale Shaker from the drilling cuttings or from an uncontrolled release from the well. 

On DH was a significant gas release foreseeable?

As per testimony obtained from survivors and other sources on DH in the weeks and months before the blowout significant releases of flammable gas into the atmosphere had occurred. PA announcements warned those onboard to stop all work that may have caused an ignition. My assumption is that these releases were significant (meaning in UK legislation that they were potentially in the explosive range of the principal flammable gas methane circa 4.8 to 15 % by volume in the air).  The mud treatment area, shale shaker etc, drill floor are areas where a flammable atmosphere is likely to occur in normal operation and these were no doubt classified as Zone 1 or 2.  Electrical equipment located in these areas would have been explosion proof if installed, operated and maintained in line with certification requirements.  My assumption is that on DH Hydrocarbon (HC) and Toxic Gas (H2S) detection systems were installed in these areas in line with industry practice. 

Gas releases in UK are defined as Dangerous Occurrences

An apparent difference in attitude and approach to gas releases between UK and US seems to exist. In the UK all gas leaks are to be reported large or small. There is almost a zero tolerance to numerous small leaks and significant gas releases i.e. those that get into the explosive range in the UK. Such significant releases are defined as “dangerous occurrences” and must by Law be reported.

Perhaps this is not surprising in the UK as 167 men died in 1988 as a result of an ignited gas leak. Like DH the Piper Alpha had forewarning when earlier in its operations a major gas leak had not ignited. Lord Cullen in his recommendations placed considerable emphasis on preventing gas leaks, but if they did happen, they must be prevented from igniting. The threat to persons on board installations from an escalating hydrocarbon event was to be reduced as far as was reasonably practicable (ALARP).

If, it had been operating in the North Sea the DH, with the significant gas leaks as described by survivors that occurred in the weeks before the incident, would have been expected to cease operations after making secure the well. The incident would have been reported to HSE.  HSE Inspectors would more than likely fly out the next day and the operator would be required to indicate what actions he was to take before drilling could resume.

The point I make is to highlight my perception of the attitude and behavior to the risks associated with gas releases during drilling operations. 

Drilling ahead at all costs despite the risks would not have been acceptable in the UK.

If flammable atmospheres are present on an offshore installation it doesn’t matter whether they come from the flange of a gas compressor (Piper A) or from the well via the drilling cuttings, the consequences can be catastrophic if the gas ignites. 

From testimony and detail already in the public domain the US regulator MMS was aware of these problems and had requested that the Operator was to proceed with caution. Any Inquiry no doubt will determine how this not unreasonable request was enacted.

Was there adequate protection on Deepwater Horizon regarding prevention of explosions?

There is no indication from any testimony that the developing blow-out itself caused any deaths or injuries and tool pushers, drillers, mud engineers etc. as key players in the developing situation may have been able to take manual actions locally on the BOP and the employment of the surge diverter. 

Although they would have had very little time, just maybe, and with some difficulty, the situation could have been brought under control.  The actions they were to take would have had to be quick but it would have been much easier to tackle the problem with the installation in situ and the riser undamaged.  With the explosion all hope was gone due to the destructive forces created in a methane/air explosion

Mike Williams in the CBS 60 minutes interview. 

It is very rare to get such testimony from someone so near the scene, and as he describes he owes his life to the protection provided by heavy door on the wall between the workshop and the diesel engine module. With vivid description he gives the reader an idea of the enormous forces created by the instantaneous pressure reached in the enclosed module in the microseconds following ignition, where flameproof electrical equipment was stored that designed to withstand an explosion of methane/air without distortion of the enclosures or covers, and which is normally tested by hydraulic pressure at 50psi.  Consider the workshop door was 8 ft by 5 ft, or 5,760 sq. inch.  Now assume by conservative estimate 20psi was applied to every sq. inch of the workshop door. This makes it easy to imagine the destructive effects of an explosion and how fortunate Mike William was to survive.   I discuss these particular forces later in relation to the accommodation module.

Where was the most likely source of ignition causing the explosion?

Consider the testimony of Mike Williams (CBS 60 minutes). It seems clear that when he heard the results of the gas ingesting into the air intakes of the Diesel Engines driving the AC alternators no explosion had yet occurred and AC generation is still ongoing because he talks about the lights still being on. 

At around 21:49 the three fishermen in their boat, immediately under the installation, heard the roar coming from above and smell the gas.  This is reasonably assumed as the blowout commencing. They beat a hasty retreat. From a distance they estimated at 100 yards, they saw blue flashes and then all hell broke loose. They filmed the fireball, which covered a significant area of the topsides.

Any Inquiry should determine the delay period between the uncontrolled release of hydrocarbons and the ignition. Survivors speak about gas shooting across the decks. So my opinion is that this delay would have been more than sufficient for the gas to migrate from the drill floor or mud treatment modules to the HVAC inlets of enclosed non-hazardous areas. The diesel engines, the AC Alternators, the 11 kV switchboard and the emergency generator located in these areas are all capable of causing the ignition of the gas.

In summary, the gas reached where Williams was located after as period of delay still to be determined but an explosion had not occurred and the AC Alternators had not tripped. The gas was clearly being ingested into the air intakes of the engines, these were overspeeding, the lights getting incredibly bright and then the first explosion occurred.  If the gas had been ignited at the mud treatment skid or in the area around the drill floor/ riser an explosion would have occurred prior to Williams hearing its affect on the diesel engines.

Since the electrical equipment in these drilling areas should be explosion proof, and since gas had entered these areas on several occasions in the weeks before the blowout, but had not ignited, it appears that the seat of the explosion was, on the balance of probabilities, where Williams was located. He has also testified to the force of this explosion at his location, indicating it was local.

This in my opinion excludes other areas suspected of being the source of ignition such as the accommodation galley.The second explosion outside the second door to the workshop appears as violent as the first which would indicate this explosion was in another module adjacent to where Williams was located and not an explosion emanating from the accommodation module or elsewhere.

What was Williams witnessing?

The centrifugal over-speed device on the engine output shaft (if fitted) would probably have operated to close the fuel valve inlet.  Disconcertingly however, to anyone who has ever witnessed this, the engine continues to rev and increase speed with an alternative source of fuel. This means that the gas/air mixture being ingested into the engine must have been in the explosive range 4.8 to 15% by volume or combustion could not have continued in the engine cylinder heads.  The gas air mixture was fueling the engine irrespective of the diesel fuel supply having been isolated or not. This again supports my opinion that in the vicinity of the diesel engines in the non hazardous area where they were located, a flammable atmosphere existed some time after the blowout had commenced, and prior to the explosion.

Williams does not mention any sounding of a general platform alarm (GPA) or announcement on the PA system. His first realization that something is amiss is: “I hear the engines revving”. My assumption is that the beep beep beep alarms he is hearing is from the control instrumentation panels for the engines and not from any GPA but this should be clarified. 

Could the galley have been the location of secondary explosion?

The description of the injuries to the personnel within the accommodation galley could suggest a smaller secondary explosion within the accommodation. However, the pressure wave is usually followed up with a slow moving flame-front. Testimonies do not indicate that persons within accommodation suffered burn injury. Also, there is testimony from others that the blast damaged escape walkways to the accommodation and it seems the injuries of those within may have occurred as the accommodation moved violently of its foundations.

Non hazardous areas

There are many open areas, around the helideck, outside muster stations, part of pipe deck etc considered non hazardous, but in abnormal conditions – because they are open areas – gas from a major leak such as a blowout could be present in these areas.  By convention therefore, any electrical equipment in these areas is explosion proof. I would expect DH should be in line with this standard design practice.

Enclosed non hazardous areas

This is my main area of interest.

Such areas have HVAC systems of forced ventilation normally 12 air/changes of the space per hour with internal pressure circa 5mm water gauge above atmospheric maintained. Thus over pressure ventilation ensures no significant ingress of air (or gas). It is usual to have an alarm from these enclosed areas to some central control room if the internal pressure falls to atmospheric indicating that the forced ventilation has failed.

This was how the HVAC on the Piper Alpha central control room operated, but on the fateful day in 1988 it was thought gas was ingested into the control room by the forced ventilation. 

A significant post Piper Alpha design change therefore was that all such enclosed areas would have gas detection in the air inlets at 20% LEL would close the fire dampers in the HVAC inlets and trip the forced ventilation. In addition, a signal from the gas sensors would trip the main AC generation. So there were in essence two barriers of protection after gas was detected in its HVAC inlets.

The area was essentially sealed to prevent ingress of gas by the closure of the fire rated dampers and loss of ventilation. The electrical equipment capable of causing a source of ignition was isolated by the tripping of the main AC generation

This is the same system of protection afforded the TR but with the addition that the inlets have smoke detection also.

In addition, some areas such as which provide space for the temporary generator are fitted with gas detection as well, that will inhibit the generator from starting if above gas above 20% LEL is detected.

So what would I have expected to happen on DH on 20th April if it had been provided with the same degree of protection as an offshore installation in the UK operating under a safety case, where fire and explosion studies had been completed and risks reduced to acceptable levels.

On gas reaching 20% LEL in drilling areas the main AC generation would trip

A general platform alarm (GPA) would sound indicating change of status from normal alert – on many installations there are status lights, a traffic light system, green is normal, followed by yellow (10%LEL) and red (20% LEL), blue is “abandon platform” operated manually by the OIM.

Persons with no emergency duties would proceed to their muster stations in the TR immediately.

Persons with emergency duties would proceed to their designated areas (Search and Rescue Teams for example).

Say for argument sake the gas detection system failed to operate in the drilling areas.

On gas detection at 20% LEL in the HVAC inlets to the enclosed areas of the workshop where Williams was located, or the area containing the diesel engines, the forced ventilation would trip and the fire dampers close, the main AC generation would also be tripped and the GPA would indicate change of status

Contrast this with DH on 20th May

Although gas was present all over the moon pool and mud treatment area Williams was not aware of this (nor anyone else not at the scene) as there apparently no alarm (GPA)

On gas entering the diesel engine area there was still no GPA and no gas detection apparently operated to close fire dampers and trip the forced ventilation

The AC generation system was still running and the lights still get brighter and brighter

The Diesel Engines were revving and overspeeding

An explosion occurred

In conclusion, it would appear that that almost a quarter of a century after 167 people were killed because gas entered a non hazardous Area containing sources of ignition this apparently happened again on DH.

The International Association of Drilling Contractors (IADC) based in Houston have HSE Case Guidelines Issue 3.2.1 May 2009 and on examination

These adequately cover the requirements of what a TR is and how it is protected including smoke and gas detection in the air intakes

However it does not give guidance on non hazardous areas specifically other than normally manned areas should have smoke and gas detection on HVAC inlets

This does not appear to be competent guidance is that the intent of the various worldwide standards is to protect areas containing non-explosion protected electrical equipment whether these areas are normally manned or not.  Utility Modules as those described above are attended from time to time but are not normally manned, so what does normally manned mean in the IADC context.

In any Case IADC inform me that the Regulator MMS does not require Operators in the US to produce or comply with HSE Cases or any relevant guidelines pertaining to them including the IADC guidelines. 

Could it be that the Deepwater Horizon and other installations offshore US are operating with similar risks because the benefits of having perhaps a more systematic approach to risk was ignored along with many of the recommendations from the Piper A Fatal Accident Inquiry?

I would appreciate a response, but in any case wish you well.

Bill Campbell

Please, email am.knegt@hisdorset.com , and we will pass your comments on to Bill.

  • Operation Florian

Sign up: eMagazine & eNewsletter

The latest issues in your inbox.

Company Profiles

HazSim - Bringing situational HazMat training to life

HazSim, LLC provides innovative simulation training to ensure your team works safely and effectively. HazSim Pro simulation equipment is in use by hundreds of fire departments, training schools, industrial fire teams, and private trainers across the US, Canada and further afield as well as the US Army.

Revolutionizing fire fighting foam technology

The one-stop resource for fire fighting foam concentrates and custom-designed foam suppression systems hardware.

Advancing rescue technology

The specialist supplier of quality PPE and Rescue Equipment to Emergency Services.

The ultimate in innovation, quality and service

For 60 years Lehavot has been delivering the world’s most advanced fire detection and suppression automatic systems

Trust the best, let us be your foam solution

AUXQUIMIA is a Spanish company whose main activity is the design, manufacture and commercialization of firefighting foam concentrates.

Williams Fire & Hazard Control offers a full line of specialized fire response equipment for oil and gas platforms

From storage tanks and pipeline emergencies to offshore platforms and vessels at sea, Williams' response personnel and specialized equipment quickly address adverse fire emergencies.

Foam fights fire

Europe’s foremost fire fighting foam manufacturer has been developing and producing foams since the 1920s.

The leader in truck-mounted hydraulic platforms

Our mission is to provide the best and the safest solution to professionals that work at height.

The independent alternative

Dafo Fomtec AB is a privately owned company with head office in Stockholm Sweden and manufacturing in Helsingborg in the south of Sweden.

If you want quality, you want Zico

Since its inception Ziamatic Corp has provided the men and women of the fire service with products designed to make their jobs safer and easier.

Calendar