Holding the Government Accountable

When All Hell Breaks Loose: Years After Deepwater Horizon, Offshore Drilling Hazards Persist

How critical safety systems can break down
(Illustration: CJ Ostrosky/POGO)

This is part one of a three-part investigation into offshore drilling safety. Read part two here. Read part three here.

They are known as the “last line of defense” against an offshore drilling blowout and uncontrolled spill. They are supposed to save the lives of oil workers and protect the environment.

But, as the Trump Administration proposes weakening safety requirements for these critical defenses, a Project On Government Oversight investigation found that they are dangerously vulnerable to failure.

In an emergency, the defenses known as “blowout preventers” are meant to choke off the flow of highly pressurized gas and oil rising through well pipes from deep beneath the ocean floor.

It seems a stroke of luck—or a streak of luck—that disasters like Deepwater Horizon haven’t resulted more frequently.

However, far from being fail-safe, blowout preventers have failed in myriad and often unpredictable ways. So have the people responsible for maintaining and operating them.

Bolts mysteriously break. Seals leak. Components get clogged. Torrents of gas and sand rip through steel. Design defects surface years after devices are put to work. Inspectors allegedly cut corners on inspections. Energy companies falsify safety tests. Operating instructions that leave little margin for error collide with messy and overwhelming forces.

One might take comfort in the fact that, since the Deepwater Horizon disaster of 2010, when the blowout preventer on which BP was depending failed catastrophically, there has been no offshore drilling calamity of comparable scale.

Deepwater Horizon in flames after the explosion.
(Photo: US Coast Guard / Wikimedia Commons)

But it seems a stroke of luck—or a streak of luck—that disasters haven’t happened more frequently.

That’s the picture that emerges from federal data, offshore safety records, and other government files on developments since the Deepwater Horizon rig exploded in the Gulf of Mexico.

In 2017, operators of drilling rigs in the Gulf reported 1,129 equipment failures involving blowout preventers, according to the U.S. Department of Transportation. Failures were reported on more than three-quarters of the rigs operating in the Gulf at the time.

Underwater footage of the oil spill plume from the Deepwater Horizon blowout.

(Source: Footage from BP, via NOAA)

Those malfunctions were generally detected under the calmest of circumstances—for example, during tests and inspections.

Reality can be less forgiving. When a blowout preventer is needed most—when a well is erupting with explosive force, catching a crew off-guard, spewing oil or gas, setting the rig aflame, showering workers with debris, and generally causing chaos—the equipment could be hardest to deploy.

The Deepwater Horizon’s blowout preventer looked formidable. Resting on the sea floor, it stood about five stories tall and weighed about 400 tons. It was equipped with hydraulically powered devices meant to cut the piping that passed through it and seal the well. It had six redundant means of activating a key component, and there were similar redundancies in the systems meant to ensure it was in working order, a 2011 study by the UC Berkeley-based Center for Catastrophic Risk Management said.

In April 2010, the study noted, all of those systems failed. Eleven people were killed, and oil gushed into the Gulf for months. It killed wildlife, fouled the coastline, contaminated fisheries, damaged local economies, cost people their livelihoods, and even disrupted the energy industry.

Cleanup crews at work near Perdido Bay, Alabama, on June 23, 2010 during BP’s Deepwater Horizon oil spill.
(Photo: NOAA)

BP reported that, as of the end of 2017, its own costs and liabilities from the spill—which are only a part of the economic toll—had reached $65.8 billion.

The rig’s blowout preventer wasn’t designed to handle the conditions it encountered, according to scientific analyses conducted since the disaster. For example, a 2012 study by the National Academies found that the “blind shear ram,” a component meant to cut and seal well pipe, “was not designed to shear all types and sizes of pipe that might be present.” 

Similarly, a 2014 study by the U.S. Chemical Safety and Hazard Investigation Board, which investigates industrial accidents, found that the blind shear ram wasn’t designed to cut pipe that was buckled or off-center. Not surprisingly, when the well that BP was drilling blew out, the pipe was neither straight nor perfectly centered in the well.

After the Deepwater Horizon disaster, the government tightened requirements for blowout preventers. Now, the Trump Administration is preparing to loosen them. The Administration says the aim of its proposal is boosting energy production and “reducing unnecessary regulatory burdens.”  

The Administration is also planning to open vast new areas to offshore drilling, including Arctic waters where extreme weather, remote locations, and sea ice could make the response to a blowout much more difficult.

As a backdrop for those developments, drilling has been advancing to deeper water, deeper wells, and higher extremes of temperature and pressure.

The records POGO reviewed tell a cautionary tale.

As the stakes get higher, and as memories of the Deepwater Horizon fade, blowout preventers—also known as “BOPs”—may provide a false sense of security, leaving offshore workers, coastal economies, and the environment at risk.

The Trump Administration’s plan to ease safety requirements would place even greater faith in technology that is inherently risky.

Robert G. Bea, an emeritus professor of engineering who led the UC Berkeley study of the Deepwater Horizon blowout, told POGO that if a commercial jetliner was only as reliable as a blowout preventer, “I wouldn’t get on that damn airplane if you made me.”

Bea, who began his career as a drilling rig roughneck and served as an expert witness against BP in litigation over Deepwater Horizon, said people “should have very low confidence . . . that a blowout preventer will stop a loss of well control.”

In areas vulnerable to an oil spill, some see the proposed reversal of safety rules as a misguided concession to oil companies.

“Have we learned nothing from the worst environmental disaster in American history?” Representative Vern Buchanan (R-FL), co-chair of Florida’s Congressional delegation, asked in an April 2018 news release.

“These safeguards should remain in place,” Buchanan added.


The Hercules 265 oil rig.
(Source: Bureau of Safety and Environmental Enforcement Panel Investigation Report, BSEE 2015-02)

On the morning of July 23, 2013, off the coast of Louisiana, aboard a rig known as Hercules 265, a rush of natural gas surged through the open blowout preventer, catching the crew by surprise.

According to a July 2015 government report on the incident, no one on the rig recalled hearing an alarm. As crew members struggled to respond, zinc bromide fluid that had been used in the well rained down on them, burning their skin and eyes. The noise from the blowout “was great enough to make verbal communication difficult.”

The owner of the rig, Hercules Offshore Inc., had a protocol for such situations—a sequence of steps to activate different components of the blowout preventer and close the well—but under the circumstances the crew was unable to follow it, the report said. Part of the trouble was that the blowout was pushing the pipe out of the well, “making it impossible to position the pipe so that the safety valve could be stabbed.”

The senior Hercules manager on board directed crew members to wake all hands and have them prepare to abandon the rig. Then he tried to shut the well by activating the BOP’s “pipe rams,” mechanisms meant to stop a leak. The flow from the well momentarily subsided—and then “quickly strengthened,” the report said.

As a last resort, the manager tried to deploy the BOP’s “blind shear rams,” which are meant to cut through the steel well pipe.

Again, the flow subsided briefly and then intensified.

“Despite attempts to control the well with the BOP, the natural gas continued to flow, forcing the rig crew of 44 to evacuate using the rig’s life boats,” the report recounted.

“The uncontrolled flow of flammable natural gas from the well continued for over thirteen hours, before igniting and burning for another two days,” the report said.

“The prolonged burning ultimately led to bending of the steel beams that supported the drill floor and derrick”—a tower-like structure—“which was directly over the well. The derrick and significant portions of the drill floor collapsed into the water, with the remainder of the Hercules 265 sustaining heat and smoke damage.”

Aftermath of the fire aboard the Hercules 265 oil rig.
(Source: Bureau of Safety and Environmental Enforcement Panel Investigation Report, BSEE 2015-02)

Photos of the rig show a scorched and twisted hulk. Crew members suffered what the report described as “minor injuries.”

The blowout could have been worse. A buildup of sediment in the well eventually stopped it. Then, a relief well was drilled to bleed the pressure and establish control.

However, a 2014 analysis commissioned by the operator of the well, Walter Oil & Gas Corp., drew troubling conclusions.

The gas flowing through the blowout preventer at high velocity carried with it sand, which eroded the insides of the BOP, carved holes in it, and rendered it useless.

What’s more, the BOP could have been crippled by a loss of fluid pressure in the hydraulic system used to control it, the analysis found.

The analysis, which was cited by the government in its July 2015 report on the incident, summed it up this way:

“It is believed that . . . high pressure in the well and a loss of hydraulic closing pressure would have allowed the blind shear rams to begin to leak continuously . . . if they had successfully sealed.”

The analysis added, “Gas moving through a small opening at sonic velocity and carrying sand is known to cause very high erosion rates that can cut through steel in a short period of time.”

In other words, the BOP was vulnerable to the very forces it was meant to control.

“In many cases, if you follow the rules and the codes you actually won’t be able to close the well,” said Glen Stevick, a mechanical engineer who served as blowout preventer expert on the forensic team.

Walter Oil & Gas Corp. did not respond to phone calls and emails for this story. Hercules Offshore Inc. is no longer in business.

Roger L. McCarthy, a member of the National Academy of Engineering, noted that the Hercules incident involved a gas well and a BOP mounted on the rig. Erosion would occur faster under those circumstances than in an oil leak involving a BOP on the sea floor, he said.

But wherever the BOP is located, the combination of flowing fluid and abrasive material like sand would be cutting, said McCarthy, who has investigated mechanical disasters such as the Deepwater Horizon blowout.

“If you fail to completely shear and seal one of these high-pressure oil streams enough to keep the flow down to a minimal level,” he said, then, eventually, “the flow is going to eat you alive.”

“Known Hazard”

In a crisis, people and equipment don’t always perform in textbook fashion. BOPs are no exception.

“Improper operation and maintenance of . . . controls is a known hazard to proper blowout preventer function that has been identified by industry in prior well control events,” the analysis of the Hercules blowout said.

The government panel that investigated that incident zeroed in on the speed of the crew’s reaction.

“The Panel found the actions to close the rams came too late; by the time the attempt to close was made, the well was already flowing at a pressure exceeding the BOP’s capabilities,” the panel reported.

Even during routine operations, complacency, carelessness, and corner-cutting can make an inherently risky business more dangerous. Those are some of the reasons BOPs are regulated and safeguards were tightened after the Deepwater Horizon disaster.

The lack of knowledge and experience of rig workers are additional problems.

The blowout preventer on the Hercules rig failed part of a federal inspection about a month before the July 2013 blowout.

“You have people offshore who are charged with doing maintenance on these pieces of equipment, and they are not always doing the job correctly because their skill set is not up to it,” said Don McClelland, chief technical officer at Offshore Inspection Group, a firm that inspects blowout preventers and other equipment for industry clients. “You may be playing Russian Roulette.”

The BOP on the Hercules rig failed part of a federal inspection about a month before the July 2013 blowout. According to the 2015 government report on the incident, the Interior Department’s Bureau of Safety and Environmental Enforcement (BSEE, pronounced “Bessie”) issued a citation to Walter Oil & Gas for not having “adequate documentation” of a high-pressure test that was supposed to have been performed.

But days before the blowout, the rig emerged from another inspection with no demerits, the report said. As far as BSEE investigators could determine, at the time of the blowout, the BOP on the Hercules rig was in compliance with federal requirements.

Changing the Rules

In September, the Trump Administration relaxed some safety standards governing valves and other equipment used in underwater wells.

For example, federal regulations had required that an independent third party certify that the equipment would function under the most extreme conditions to which it might be exposed. The Administration eliminated the requirement for third-party certification and it deleted from design requirements the wording about functioning under the “most extreme” conditions.

That step seemed merely a warm-up for a more sweeping plan to roll back rules adopted in 2016 in response to the Deepwater Horizon disaster. The bigger proposal by BSEE, which focuses on “blowout preventer systems” and “well control,” is awaiting final action.

... [I]t'll give the industry license to pretty much do as they please and bend the rules—whatever's left—how they wish.

David Pritchard, petroleum engineer specializing in drilling hazards management

The proposal will give oil companies more latitude, David Pritchard, a petroleum engineer who specializes in drilling hazards management, told POGO. “I think it’ll give the industry license to pretty much do as they please and bend the rules—whatever’s left—how they wish,” Pritchard said.

The Administration’s notice of proposed rulemaking shows that it is planning or considering changes that would thin one layer of protection after another.

First, the Administration is considering eliminating a requirement that drillers operate within a prescribed safety margin. That requirement is meant to regulate the pressure in the well and avert the kind of accident that could require use of the blowout preventer.

Second, the proposed overhaul of the rules could weaken onshore monitoring of drilling operations, which is meant to help detect problems before they escalate into blowouts.

Third, the proposal could relax certain technical specifications for blowout preventers—what features they are supposed to have, how they are supposed to work, and what they are supposed to be able to handle.

Fourth, it could weaken testing and inspection requirements meant to make sure that blowout preventers are in working order.

Fifth, it would gut a requirement that drillers have specific equipment on hand to contain a spill in the event the blowout preventer fails to contain a well.

And, sixth, it could weaken a requirement that drillers study and learn from BOP failures.

For instance, when it comes to the equipment’s capabilities, the BOP installed on any well is supposed to be able to withstand the maximum anticipated pressure. Some BOPs are now intended to handle anticipated pressures as high as 20,000 or 25,000 pounds per square inch. To make sure BOPs can perform as expected, current federal rules call for them to be subjected to a variety of pressure tests.

The Administration’s proposal would lower the pressure on two such tests to 1,000 psi, which is a fraction of the pressures involved in past incidents.

According to the national commission that investigated the Deepwater Horizon disaster, months after the explosion, after the gusher was finally capped, pressure in that well was logged at 6,920 psi.

Five minutes is not long enough to test something. You don’t know if it’s going to hold.

Don McClelland, chief technical officer at Offshore Inspection Group

During the 2013 blowout that set fire to the Hercules rig, the pressure in the BOP rose to more than 4,000 psi, the July 2015 government report said.

And, in January 2017, when the casing burst in a well operated by Fieldwood SD Offshore LLC, “the estimated internal pressure on the 16” casing exceeded 2000 psi,” a BSEE investigation found. A contributing cause of the accident, BSEE reported, was that “BOP’s [sic] and casing were only tested to 1000 psi.”

Fieldwood Energy spokesperson Kevin Bruce told POGO that the test pressure of 1,000 psi was higher than the expected pressure in the well—“five times the Maximum Anticipated Surface Pressure of 200 psi for this well.” 

BSEE’s report describes it differently. “[T]he maximum anticipated surface pressure (MASP) was 1236 psi,” the report says. 

Bruce also said by email that the BOP performed as it was supposed to and that pressure spiked in the well because a valve was set improperly. “This is a case of human error, not equipment failure,” he said.

In addition to reducing test pressures, the Trump Administration’s proposal would shorten key pressure tests.

Where the Obama Administration’s “Blowout Preventer Systems and Well Control” rule said blowout preventers had to withstand certain tests at high pressure for 30 minutes, the Trump Administration would shorten those tests to 5 minutes.

“That’s absurd,” McClelland of Offshore Inspection Group said. “I mean, five minutes is nothing, really.”

“That’s not long enough to test something,” he said. “You don’t know if it’s going to hold.”

To put five minutes in context, in the Hercules incident, there was a lull of 14 minutes after BOP components were activated, the investigation commissioned by Walter Oil & Gas Corp. found. Then the blowout continued unchecked.

Further, where the Obama Administration required that, if regulators are unable to observe tests firsthand, the test results must be submitted to the government, the Trump Administration would erase that requirement. Eliminating the requirement would ease regulators’ workload, the Trump Administration has explained in its notice of proposed rulemaking.

The Trump Administration’s proposal would also tweak wording in potentially important ways.

Under current rules, companies applying for a permit to drill must state how their BOP would “achieve an effective seal of each ram BOP.” Under the Trump Administration’s proposal, the wording “achieve an effective seal of each ram BOP” would be changed to “close each ram BOP,” which could amount to something short of containing the well.

Those are a sampling of the proposal’s many provisions. (For more detail, see related story.)

The Administration estimates that, over the next 10 years, the proposed changes to federal regulations would save industry more than $900 million.

In an official public notice laying out its proposal, BSEE made clear that it was taking its cue from industry. Since the 2016 regulations took effect, “oil and natural gas operators have raised various concerns” about provisions “that impose undue burdens,” BSEE explained.

The Administration’s proposal largely tracks a wish list the American Petroleum Institute (API) and six other industry groups presented to the Interior Department in 2017. It is part of the Administration’s broader program of support for the fossil fuel industry.

Paradigm Shift

On April 28, 2017, President Trump issued an executive order directing his Interior Secretary, Ryan Zinke, to reconsider the Obama Administration’s blowout preventer and well control rule as part of “an America-First Offshore Energy Strategy.” Within the Interior Department, that task fell to BSEE.

The politically appointed director of BSEE, former Louisiana state government official Scott Angelle, served on the board of an oil pipeline company. In a September 2017 speech, he told members of the Louisiana Oil & Gas Association that BSEE was changing its posture toward industry—moving “from an era of creating hardships to an era of creating partnerships.”

Angelle encouraged members of his audience to contact him directly. From the podium, he gave out his work cell phone number but warned, “Everything that you send me by text is a public record . . . so be cautious.” He also gave out his personal cell number, inviting industry members to use it for matters that are not business-related “and you don’t want in the public record.” POGO obtained a video of the speech in December 2017 through the Freedom of Information Act.

The Administration says its proposed overhaul of BOP rules “will not materially affect the economy nationally or in any local area.” That assessment puts any potential economic benefit in perspective, suggesting that, in the scheme of things, there’s no big economic upside.

The Administration also says its proposal would not cause “a major increase in costs” for consumers; federal, state, or local governments; or regions of the country.

That assessment does not appear to take into account the potential costs of a disaster. An uncontrolled oil spill could affect coastal economies and industries such as fishing and tourism—not to mention the energy industry itself, especially if, like the Deepwater Horizon disaster, the spill leads to a pause in drilling.

BSEE is assuming no disaster will result. It says its proposal “would not increase the safety or environmental risks” of offshore drilling. If the Administration is wrong about that, the costs to industry and the public could greatly exceed the projected $900 million of savings—even in strictly economic terms.

BP, the giant oil company that shared liability for the Deepwater Horizon spill, reported that, as of the end of 2017, the damages and other costs it had incurred or expected to incur from the deadly disaster had reached $65.8 billion.

Opening more coastal waters to drilling and at the same time loosening safety regulations could be a recipe for disaster.

Najmedin Meshkati, an engineering professor at the University of Southern California who worked on an investigation of the Deepwater Horizon disaster.

The proposed rule changes amount to a paradigm shift in safety regulation, said Najmedin Meshkati, an engineering professor at the University of Southern California who worked on the National Academies investigation of the Deepwater Horizon disaster. Where current rules prescribe specific mechanical requirements, under the proposed rules the government would set performance goals and, to a greater extent, trust industry to figure out how best to meet the goals, Meshkati said.

That approach—which is known among specialists by the term “safety case”—works only if industry has a strong safety culture, Meshkati said. It also imposes much heavier demands on regulators, Meshkati has written. Compared to the current approach to oversight of offshore drilling, it calls for more staff and greater sophistication, Meshkati said.

Opening more coastal waters to drilling and at the same time loosening safety regulations “could be a recipe for disaster,” Meshkati said.

The government has a history of deferring to industry on offshore drilling safety. In the years before the BP oil spill, the industry contended that blowout preventers were more reliable than regulators recognized and that they needed less frequent pressure testing, a national commission that investigated Deepwater Horizon recounted. The government “conceded and halved the mandated frequency of tests,” the commission reported. In the run-up to the Deepwater Horizon blowout, the commission added, the government refrained from revising the rules even after a series of studies warned of potential BOP failures.

More recent history gives more reason to doubt both the regulators and the regulated.

In May 2012, at a forum BSEE held on blowout preventers, the National Academy of Engineering’s McCarthy made a basic observation:  “If these things are going to be expected to work under conditions where all hell is breaking loose, they have to be tested in conditions that simulate all hell breaking loose.”

Three years after that forum and five years after the Deepwater Horizon disaster, a study commissioned by the federal government found that wasn’t happening.

The May 2015 study, conducted by the firm Wood Group Kenny, focused on blind shear rams, the BOP mechanisms of last resort. It examined whether blind shear rams were tested to withstand not just high pressures but also the “high velocity fluid effects . . . that are encountered during a blowout scenario.” In other words, forces to which the rams could be exposed if other BOP components had not already choked off oil, gas, water, sand, and other potentially abrasive material flowing from the well.

Spill-response crews gathering and burning oil in the Gulf of Mexico near the site of the leaking Macondo well.
(Photo: Dr. Oscar Garcia / Florida State University, via Flickr)

The study described those as “Macondo conditions,” referring to the Macondo well that the Deepwater Horizon was drilling when it exploded.

Among the study’s findings:

BOP manufacturers “state that the shear rams are not designed for flowing well conditions.”

“The industry has conducted no tests to evaluate the flowing fluid effect on the shearing process.”

Testing facilities “may be unable to replicate the high flows and pressures observed during the Macondo incident.”

The following year, in rules adopted in response to Deepwater Horizon, BSEE said BOP systems must be capable of closing and sealing the “wellbore”—the hole drilled in the earth—“at all times, including under anticipated flowing conditions.” Now, BSEE is proposing to delete from that rule the words “at all times.” BSEE is proposing to say instead that BOPs must be capable of closing and sealing the wellbore “in the event of flow due to a kick,” meaning an unexpected burst of oil or gas.

The 2016 rules also said BOPs must be able to seal the well “without losing . . .  sealing integrity due to the corrosiveness, volume, and abrasiveness of any fluids in the wellbore.”

POGO asked BSEE and the American Petroleum Institute how if at all the realities have changed since the 2015 study spotlighted shortcomings in shear ram design and testing. POGO also asked them to what extent BOPs currently in use are able to meet the 2016 requirement, and what changes BOPs have undergone to meet the requirement. They did not respond to those or other written questions and did not grant interviews for this report.  

“Industry is focused on effectively managing risk and ensuring the safety of workers and the environment while also fostering robust offshore development that’s critically important to the nation’s future,” Erik Milito, who handles regulatory and legislative matters for API, said in a statement API provided for a story POGO published in August.

“The U.S. oil and natural gas industry is well regulated, and our industry supports smart, effective regulation,” Milito added.

Oil companies, offshore drilling firms, and manufacturers of drilling equipment contacted for this report almost all declined to comment, did not respond to messages, or did not follow up.  For example, at Chevron, spokesperson Veronica Flores-Paniagua referred POGO to API. At Schlumberger, whose Cameron subsidiary makes BOPs, spokesperson Joao Felix said by email that Cameron is contributing information on blowout preventers to a report for the Interior Department on development of the Arctic.

“I would recommend that we wait until this report is publicly issued before we provide you with an interview or any additional information,” Felix said.

Companies that did not respond included BP and another central player in the Deepwater Horizon disaster, Transocean. 

Blowout preventers don’t tell the whole story of offshore hazards. Since the Deepwater Horizon disaster, BSEE has logged thousands of “incidents” in U.S. waters, some of them fatal. They range from fires and explosions to gas releases and industrial injuries. But BOPs are more than just critical in their own right. They illustrate the risky interplay of technology, safety rules, and human factors on which offshore drilling depends.

Nuts and Bolts

On December 18, 2012, while a rig called the Discoverer India was going about its drilling routine in the Gulf of Mexico, its colossal blowout preventer split in two.

The upper portion of the rig’s BOP stack separated from the lower part, releasing drilling fluid into the ocean, according to a BSEE report.

The explanation could hardly have been more mundane.

Chevron, which was operating the rig, told regulators that bolts holding the two pieces of equipment together had failed, the BSEE report said.

There were 36 of the bolts. They were big—about nine inches long and about two inches in diameter. They were four or five years old at the time, and they all cracked, according to the BSEE report and a 2018 account of the incident by the National Academies.

The Discoverer India belonged to Transocean, the same company that owned the Deepwater Horizon.

Bolt failures soon followed on two other rigs, the Discoverer Americas and the Petrobras 10,000, prompting a recall in which manufacturer GE Oil and Gas issued 10,982 replacement bolts.

I am concerned that industry is not moving quickly enough given the potential for catastrophic failure.

Brian M. Salerno, then-director of BSEE, addressing the oil and gas industry at a public forum in 2016.

Then, in June 2014, on a rig called the West Capricorn, a worker grabbed hold of one of the studs used to fasten the BOP—“and noticed that it moved,” according to a study cited by the National Academies. Nine such studs were found to be fractured, the study said. Until the accidental discovery, the fractures had gone undetected.

In early 2016, BSEE’s then-director, Brian M. Salerno, sent the oil and gas industry a call to action. “Although progress is being made in addressing these safety issues,” Salerno wrote, “I am concerned that industry is not moving quickly enough given the potential for catastrophic failure.”

Bolts had been failing since 2003, and the problems involved bolts made by three different manufacturers, Salerno wrote.

In August 2016, Salerno convened a forum on bolt failures, warning, “[I]t may only be a matter of time before our luck runs out.”

Salerno said BSEE by then knew of about a dozen cases in which bolts had failed, but added that “no one really knows the full extent of the problem.”

Another speaker at the forum, BSEE’s Joe Levine, said that, before the rash of bolt failures, when looking at a $500 million BOP, he had never given any thought to its connectors. “Now, today, I certainly don’t see a connector as inconsequential or insignificant,” Levine said. “I see it as critical piece of hardware which is really the Achilles heel of this critical piece of equipment.”

“If it’s not functioning right, if it’s not manufactured correctly, all it takes is a couple of those and we can have another Macondo,” he said.

The government commissioned the examination of bolt failures by the National Academies, which completed its report this year. In the end, mysteries remained. The “lack of knowledge” about the root cause of some failures “is cause for concern,” the report said.

Among other recommendations, the Academies called on the oil and gas industry to promote “an enhanced safety culture.”

“Complete bolting failures have been historically rare events, but how many near misses and incipient failures remain undiscovered is unknown,” the Academies said.

There is “no industry wide program to find bolts that are failing, or have failed and are just held in place by gravity,” the Academies said.

The oil and gas industry says it has been taking voluntary steps to address the problem. In an August 2018 letter to BSEE, the American Petroleum Institute gave an update on what it called the industry’s “significant progress.” The update explained how the industry had been studying the susceptibility of bolt materials to “embrittlement,” writing standards, conducting preventive maintenance, and replacing bolts. Progress toward assorted goals varied. According to an API chart, 100 percent of certain replacement bolts had been ordered, and 94 percent of them had been installed.

But for other bolts described as “critical,” only 44 percent of replacements had been ordered and only 3 percent had been installed. The schedule for installing those stretches into 2023.

The spate of bolt failures raises a deeper question.

If bolt problems were discovered only accidentally or as the result of an accident, what other vulnerabilities are waiting to be discovered?

Lying and Cheating

Sometimes, the weakest link isn’t mechanical. It’s human.

In 2012, on a platform in the Gulf of Mexico, workers were worried. Their boss had ordered them to perform “hot work”—such as welding—near a flowing well, according to a later investigation. That would have violated federal regulations and could have sparked an explosion. 

When one of the workers protested that members of the crew were uncomfortable, the boss, Race Addington, “asked everyone ‘Who is not comfortable?’” and then told them, “`I will run y’all off’ if you don’t do as directed,” a worker later told federal investigators

Sometimes, the weakest link isn't mechanical. It's human.

The alleged intimidation set the stage for what followed.

The night of November 27, 2012, the platform’s blowout preventer was subjected to a required pressure test. The next morning, when Addington started his shift, he saw the test chart and saw that it was bad. In fact, it “looked like shit,” he later told investigators.

Addington told two workers to create a new chart showing that the blowout preventer passed. 

The next day, inspectors from BSEE arrived at the platform for a routine inspection, a document filed in federal court recounted. Addington gave them the phony test chart.

Though Addington didn’t realize it, the phony chart was bad, too. One of the government inspectors explained to Addington that it showed the BOP failed the test. The inspector issued a citation.

Later that day, BSEE got a telephone tip from one or more whistleblowers complaining about unsafe hot work and a falsified pressure test. An investigation ensued.

One of the BSEE inspectors later told investigators that he was no stranger to fabricated BOP tests.

“He said that . . . he spent many years working in the private industry and became familiar with how facility personnel may ‘make charts’ that are not legitimate BOP pressure test charts,” according to a summary of an interview the inspector later gave investigators. The inspector explained “that he personally had learned many years ago when working for private industry . . . how to make such false charts.”

A BSEE inspector conducts an inspection in the Pacific Ocean.
(Source: BSEE)

As it happened, two workers on the platform were recorded on video as they went through the motions of conducting a test to produce the fake. A BSEE inspector who watched the video saw through it. Among the giveaways: one of the people making the chart was tapping the side of the box in which the chart was being generated in an effort “to imitate vibrations that would be seen on a true test chart,” according to an investigative record . Another giveaway: The device ostensibly charting the test results was not connected to the blowout preventer “in any way.”

Addington later pleaded guilty to charges of making false statements. He was sentenced to a year of probation and 40 hours of community service.

“To say I’m sorry doesn’t even begin to reflect the remorse that I have for this situation,” Addington said at his 2015 sentencing.

Addressing Addington at the sentencing hearing, Judge Helen G. Berrigan remarked that the oil worker “had a very tough life,” and she added, “I am actually very proud to have met you.”

Kenneth Johns, one of the workers who created the fake chart, also pleaded guilty to making false statements. He was sentenced to two years of probation and fined $750.

Energy Resource Technology Inc. (ERT), the company that operated the platform, was fined $4 million, ordered to pay restitution of $200,000, and sentenced to three years of probation, the government reported.

This account is based in part on documents POGO obtained from the Interior Department’s Office of Inspector General through the Freedom of Information Act. Those partially redacted records include an investigative report from April 2018 and summaries of interviews conducted during the probe. POGO’s account also draws from court records, including a statement of facts that Addington signed.

When asked how common it is for blowout preventer test results to be falsified: You would probably be shocked about how often it happens.

Race Addington, an offshore worker who pleaded guilty to a federal charge related to a falsified BOP test

Addington, who has spent more than 30 years in the industry, is currently working as an operations manager for a smaller oil services company.

In an interview with POGO, he said he provided false information about a BOP test to protect the jobs of the workers who had performed a faulty test. “Their understanding of the test procedures of the equipment was not right,” Addington said. “They tested it to their understanding.”

Rig workers would not necessarily be familiar with the latest regulations, he said. “You only have to have classes once a year or once every other year,” he said. “You wouldn’t know if there were any changes in rules or regulations until you go” back for further training, he said.

Addington said he would not put a crew in harm’s way, and he said the well for which the test results were fabricated was not in danger of blowing out because it was effectively contained.

“Nobody is out there trying to kill somebody,” Addington said. “Everybody is out there trying to make a living and doing it to the best of [their] abilities.”

Addington said government officials seemed interested in making an example of him and falsely viewed him as a cowboy. He recalled that one official asked him, “Is it true that they call you ‘Race’ because you like to get things done fast?”

“Race” is the name his parents gave him when he was born, Addington said. “God knows why.”

Addington denied that he threatened to run off members of the crew. In the interview with POGO, he brought up a comment that he made to federal investigators—a comment quoted in an investigative record: “If I stopped work every time they feel it’s unsafe nothing would get done.”
As a supervisor, Addington told POGO, it’s his job to keep the crew productive. Workers “will say or do anything to get out of doing something”—not because it’s unsafe, but “just because they don’t want to do it,” Addington said.

Addington said he doesn’t ask crew members to do things that he wouldn’t do himself.

Several months after the falsification of the test on the ERT platform, Addington was the company man on another ERT platform, and it experienced a blowout. The company was cited for safety violations.

Addington told POGO that, after that platform was evacuated, he voluntarily returned to fight the blowout.

Asked how common it is for BOP test results to be falsified, Addington said, “You would probably be shocked about how often it happens.”

“The reason why I say that it’s probably more common than what you think is that the government puts such harsh regulations on testing items,” Addington said.

Offshore conditions, as Addington described them, aren’t conducive to perfect test results. During years of use, a BOP bounces around on a boat and is exposed to the elements. In addition, the equipment used to chart the test results is exposed to vibrations and wave action.

“And you’re asking these guys to get 100 percent on a test,” Addington said. “They’re testing and they’re testing and they’re testing . . . and they see no leaks,” he said. The testing consumes time and causes frustration “and what do you think the natural thing is to do?”

“They know by experience that things are going to be good, so in order to make this 100 percent test they may falsify the test,” Addington said.

But don’t expect self-incriminating confessions, he said.

“[I]f you asked somebody to come and testify about it, it would be like asking a drug dealer . . . ‘How do you cut your cocaine?’ They’re not going to criminalize themselves to make a point.”

“The Bare Minimum”

The government doesn’t trust oil and gas companies to make sure that their BOPs are up to snuff. It requires them to have “independent third parties” verify that the BOPs measure up.

However, when the Interior Department’s Office of Inspector General investigated one such third party in 2016, it gathered some sobering accounts.

The investigation began with a complaint that Lloyd’s Register North America, Inc. conducted “substandard” BOP verifications and “may have falsified BOP verifications,” an April 2016 inspector general report said.

The report was posted by governmentattic.org in a batch of 30 Interior Department inspector general reports from 2016. Governmentattic.org vacuums up many federal records through Freedom of Information requests and posts them without comment.

The inspector general did not find that Lloyd’s falsified BOP verifications. Nor did it find that Lloyd’s conducted substandard verifications. But that wasn’t saying much. At the time, federal regulations “did not require the application of specific standards when completing verifications,” the report said. (The only requirement at the time was that the company doing the verifications be “a licensed professional engineering firm,” the report said.)

If there aren’t any standards, no one can be cited for substandard work.

“We did, however, receive concerns regarding the technical competency of Lloyd’s current management overseeing BOP verifications,” the inspector general reported.

That wasn’t all.

Lloyd’s in 2012 acquired another company that performed private inspections, West Engineering. Before being taken over by Lloyd’s, West did the majority of BOP verifications in the Gulf of Mexico, the report said.

“West had conducted its BOP verifications in a manner that exceeded compliance standards, but after the acquisition, Lloyd’s lowered its verification standards to meet minimum requirements established by Federal regulations and the American Petroleum Institute (API),” the inspector general reported.

The company “made a business decision to meet only the bare minimum requirements of the government,” one witness said.

The report compiled observations from people whose names are redacted. A recurring theme was Lloyd’s willingness to please its customers—companies that conduct offshore oil and gas operations.

If there aren’t any standards, no one can be cited for substandard work.

For example, one person “had heard of situations where a non-technical manager in Lloyd’s would sign a document that a technical engineer refused to sign because a ‘customer needed it,’ and Lloyd’s was in the business of ‘taking care of the customer,’” the report said.

“He believes that this type of customer ‘accommodation’ is not living up to the intent/spirit of the law, which as he articulated before, was to ensure another Deepwater Horizon explosion does not happen again,” the report said.

According to one or more sources whose name or names were redacted, Lloyd’s customers pushed back against West’s policy of subjecting BOPs to pressure tests that lasted 10 minutes. The customers allegedly wanted shorter tests, the report said. According to one of the sources, Lloyd’s “decided to override West’s technical personnel and concede to their customers’ requests that they only conduct the BOP pressure test for five minutes,” the report said.

That troubled people interviewed by the inspector general. Through experience, West had learned that pressure tests should be conducted for 10 minutes to ensure there were no small leaks in the blowout preventer that might not be detected in a 5-minute test, one said.

One of the people interviewed by investigators—apparently a Lloyd’s employee—recounted telling Lloyd’s that he considered it “absolutely necessary” to run a pressure test for 10 minutes and that Lloyd’s “would need to fire him” before he signed a verification based on a test of only 5 minutes.

As a result, Lloyd’s reportedly told BP—one of the companies involved in the Deepwater Horizon disaster—that it would have to run pressure tests for 10 minutes, the inspector general wrote. Subsequently, BP reportedly agreed that a 10-minute test was needed, the inspector general added. 

In the report, one observer said Lloyd’s was under pressure from upstart competitors. 

For example, “Lloyd’s, through West’s technical division, refused to sign off on a BOP ‘hop’ from one well to another well without having the BOP taken out of the water for inspection,” the observer reportedly said. “He explained that they were requiring this out-of-water inspection because they had learned through their many years of experience that BOPs could potentially be damaged by . . . previous use.”

However, the customer allegedly protested and turned to another verification company, “which provided the verification to the customer without ever having seen or inspected the BOP,” the report said.

In emails to POGO, Lloyd’s spokesperson Jason Knights declined to address specific allegations in the Inspector General’s report. “On the investigative report, the evidence is clear from the findings confirmed on the close-out of the investigation and final report, so we will not be drawn in to comment on those issues,” Knights wrote.  

Lloyd’s Register “met the requirements established by Federal regulations and the American Petroleum Institute,” Knights wrote. “We have worked, and continue to work, closely with industry authorities and regulators around the world, including BSEE to deliver independent third-party assurance in accordance with the prescribed requirements.”

In its plan to loosen safety rules that were adopted in 2016, the Trump Administration has proposed shortening the requirement for a particular pressure test from 30 minutes to 5 minutes. “BSEE believes the historical data indicates that five minutes is adequate to demonstrate effective sealing,” the proposal says.

In addition, the Administration has proposed weakening oversight of the organizations that perform BOP verifications.

Under the 2016 rules, verifications must be performed by organizations reviewed and approved by the government, and organizations seeking approval must state their qualifications, including their experience with BOPs.

Under the Administration’s proposal, BSEE would not vet or approve the organizations in advance.

“This change would not impact safety because independent third parties have been utilized as long-standing industry practice,” the Administration’s proposal says.

Washed Out

A spill last year from a well that Shell was operating in deep water highlighted other hazards.

On June 6, 2017, Shell stopped drilling operations to conduct a pressure test of the BOP on a drillship called the Noble Don Taylor. Such tests were required every 14 days.

During the test, a remotely operated underwater vehicle detected drilling fluid—synthetic “mud” used in the well—leaking from the blowout preventer and polluting the Gulf of Mexico, according to a federal accident investigation report. The BOP was raised to the surface and examined. Investigators found that a seal on the BOP had failed. They also found “washout damaged areas” in the BOP.

One reported equipment failure resulted in about 4,000 gallons of pollutant leaking into the Gulf of Mexico.

BSEE blamed the spill in part on a “buildup of debris” inside the BOP. The Bureau said there had been a “failure to conduct proper . . . cleaning and flushing of the BOP” as recommended in a manufacturer’s bulletin issued almost two years earlier. The Bureau indicated that someone—it didn’t clearly say who—had failed to get the word out well enough about the danger that the BOP could malfunction. BSEE’s report cited “inadequate communications of a known risk of loss of seal integrity as stated” in the manufacturer’s bulletin.

A separate government report on blowout preventer failures shed additional light on the subject. It said the manufacturer failed “to effectively communicate the level of effort needed to prevent debris buildup” or that “improper cleaning can lead to loss of seal integrity.” The main problem was the design of the BOP, the report said. Even with more thorough cleaning, debris might still build up, the report said.

In 2016, the year before the Shell incident, the government was informed of two failures involving the same component, the report added.

Based on the government’s accounts, the episode showed how failure upon failure can contribute to a spill. The BOP had an inherent weakness. The manufacturer knew about it and issued a bulletin on the subject. The government, too, had been put on notice. But the message didn’t come across as clearly as it should have, and Shell failed to make sure the BOP was maintained properly.

BSEE’s accident investigation report concluded that Shell “failed to protect health, safety, property, and the environment.”

Shell spokesman Curtis Smith did not follow up on interview requests or written questions.


The so-called “Product Information Bulletin” about the BOP in the Shell incident was not unique. The same manufacturer, National Oilwell Varco, has issued dozens of technical bulletins over the years about malfunctions, design changes, new maintence recommendations, and the like.

For example, on November 13, 2017, National Oilwell Varco reported that a “BOP actuator lost function.” It recommended that, for certain pieces of equipment, a “rod nut” should be replaced. On July 12, 2017, it alerted customers to a few “incidents of spiral failure in O-Ring piston seals.” It said that, on new units, it would use a “T-Seal” in place of an “O-Ring.” On December 2, 2015, it reported that a particular seal “was observed to be wearing prematurely” and in “intermittent cases” that “caused the seal to fail.” The company said that, effective “immediately,” parts should be replaced.

And, on June 12, 2015, it disclosed “a design flaw present since creation in 1995,” 20 years earlier. “This design oversight”—affecting spare blades—“caused the ineffectiveness of the seal,” the company said. The bulletin advised customers to contact the sales department “for immediate replacement.”

National Oilwell Varco did not respond to inquiries for this story. Reached by phone in October, company spokesperson Loren Singletary said he had referred POGO’s written request to the company’s legal department.


Like a lot of mechanical equipment that is subject to wear and tear under harsh conditions and that depends on effective maintenance, BOP components are susceptible to breakdowns.

To get a better handle on what could go wrong, what has gone wrong, and what might otherwise remain under the radar, the federal government in 2016 mandated that oil and gas companies confidentially report equipment failures. Those reports include so-called “near misses.”

In 2017, the first full year for which the Bureau of Transportation Statistics has issued data from those reports, 18 of 25 rig operators in the Gulf of Mexico reported BOP equipment failures—1,129 of them in total. The failures occurred on 45 of 59 rigs operating in the Gulf at the time, the Bureau reported.

The reported causes for equipment failure included wear and tear, maintenance errors, design problems, faulty manufacturing, and “procedural error” (which apparently includes bad instructions and/or user error), among other factors.

The Trump Administration has proposed loosening the reporting requirements.

The confidential reporting of equipment failures was intended to help industry and its regulators learn from experience, but in key respects the program has fallen short of expectations. When BOPs are pulled from the ocean floor for repairs, the faulty components are supposed to be sent to shore for further analysis by the manufacturer or some other third party, the report by the Bureau of Transportation Statistics said. However, in one-third of the so-called “unplanned stack pulls”—6 of 18—that didn’t happen, the report said.

Further, though 232 components overall were reportedly sent to shore for analysis by a manufacturer or third party, such analyses were shared with the government in only a small minority of cases. Offshore operators submitted so-called investigation and analysis documentation to the government program “for only 34,” the report said.

One of the equipment failures resulted in pollution of the environment—the Shell incident discussed above. About 4,000 gallons of pollutant leaked into the Gulf, the report said.

The rest of the failures merely hinted at the risks.

Feet of Clay

Even the most effective blowout preventer can be powerless to prevent a spill.  At the bottom of the ocean, it may be resting atop a fragile geologic foundation. It may be standing on proverbial feet of clay.  

The rock “formation,” which can include layers of salt, sandstone, and sediment, holds the highly pressured oil or gas—until it’s drilled. If the formation surrounding the well fractures, oil can find escape routes other than the well hole and then emerge from the ocean floor. Think of a bathtub: plugging the drain won’t contain the water if the tub cracks.

Aerial view of oil rising to the Pacific Ocean surface (upper left) near the polluting drilling rig during the 1969 Santa Barbara Oil Spill.

That’s what happened in the Santa Barbara spill of 1969. In one of the nation’s worst drilling disasters, oil fouled miles of California coastline. “The oil had burst through its fragile geological formation, ripping five long gashes through the top of the ocean floor,” a newspaper article quoted on a Santa Barbara county website explains.

During the Deepwater Horizon ordeal, authorities worried that efforts to control the well could lead to a similar outcome.

Short of opening new pathways for oil and gas to escape through the ocean floor, formation fractures can compromise the well itself. They can lead to an unexpected rush of oil and gas into the well, known as a “kick.” To contain a kick, a rig crew must first detect it—and then swiftly and effectively activate the BOP. Ironically, operation of the BOP can lead to a formation fracture.

All of that helps explain how seemingly formidable BOPs can create a false sense of confidence.

In 2015, fluid spilled from a well BP was drilling in the Gulf of Mexico. According to a BSEE accident investigation report, BP concluded that the formation, made of salt, might have been “weaker than expected.” Or maybe, BP theorized, the pressure applied during a BOP pressure test “resulted in a formation breakdown.”

A team of federal investigators tried to figure out whether the “geologic risk” could have been identified before the drilling began, the report said.

The report gave this answer: “The team could not identify any . . . data that would have changed the location and design of the well or prevented the event once it was in progress.”

In other words, they concluded that the breakdown could not have been foreseen or stopped.