Hollywood movies glamorize oil gushers. The scrappy driller overcomes all odds imposed by nature and man to find "black gold" and is rewarded by a shower of the icky stuff in the climactic scene. We cut away knowing that the oil-drenched hero, and his heroine, will enjoy their hard-earned riches, at least until the sequel.
In real life, there is nothing glamorous about a gusher, especially if the oil and gas catch fire. As the crew struggles to put out or prevent fire and cap the well, they are in mortal peril. The loss of product and costs of clean-up hurt the investors.
A gusher or blow out on dry land is bad enough. At least crews and specialized equipment can reach the well head to try to stop the flow ("cap" the well). When the well head is a mile under the ocean, it is that much harder, as we are finding to the horror and frustration of the public watching the disaster unfold at the Deepwater Horizon rig in the Gulf of Mexico.
In 1922, two men named Abercrombie and Cameron created a device to eliminate gushers, called a blow out preventer, or BOP. Basically, it is a big valve that sits on the top of the well hole. When the pressure or flow from within the well is too great, the valve closes, stopping the flow. There are two different kinds of valves: ram and annular. A ram valve uses a number of pistons or rams that close around the drill pipe (called a "drill string" in the trade), shear through the pipe, and then seal the well hole. The annular design, created in 1946 by a man named Knox, uses a hemisphere of rubber reinforced by steel ribs for the same purpose. The annular valve operates more smoothly, requiring less hydraulic pressure, resulting in longer service life.
Valves can be closed or "actuated" either manually or by hydraulics. The control can come from an automatic control system which is part of the blow out preventer assembly or remotely. Normally, the remote control is provided by an electrical cable that runs from the blow out preventer to the drilling rig on the surface.
For a mere half million dollars more, one could add a control that uses sound pulses transmitted through the water to control a valve. This mechanism is not required by the US government for blow out preventers in the Gulf of Mexico, but is required by other countries.
A modern blow out preventer for an undersea well consists of a series or "stack" of several different valves, with different methods of actuation, and a control system. Stacks can have 4 to 10 or more valves of different types (ram or annular), with different control mechanisms. The idea is to provide redundancy: if one valve or control mechanism fails, another should be able to take over to close the well.
Finally, a BOP stack can include a top-kill or choke mechanism. As we have learned, the idea of a top-kill mechanism is to allow the drillers to pump heavy "drilling mud" into the well to counter the natural pressure. When enough weight of drilling mud is in the well, the flow stops, and the well can be closed. Later, the well can be re-opened and the drilling mud pumped out to get the well flowing for production.
Thus, it takes several things going wrong for a blow out preventer to fail to prevent a gusher. It should be, and is, a very rare event. Since 1980, we drilled over 3,800 wells in the Gulf of Mexico, which account for one-third of US domestic oil production. Deepwater Horizon is the second failure in that period. The other one was some thirty years ago.
And that appears to be the story. BP, Transocean, and Halliburton avoided standard tests and inspections on the blow out preventer stack. The stack apparently does not have a top-kill mechanism, forcing the crews to improvise on the battered BOP stack on the sea floor. We also learned that three days before the disaster, the crews took an economic short cut by pumping free seawater instead of expensive, man-made drilling mud into the well to try to close it. The crews apparently knew, or should have known, that the seawater was not countering the pressure in the well. The crew knew for at least an hour before the explosion that the blow out preventer was failing. This much we know, even before the formal investigation ordered by the White House gets going.
Blow out preventers are not new technology. But like any technology, they are only as safe and effective as the people and procedures that use them. Even if the formal investigation finds flaws in the equipment, the failure to follow known, established procedure is clearly a major factor in the disaster, and is the likely root cause of it.
We can tolerate failure in many technologies we use daily. When our PC crashes, we curse and reboot.
But some failures cause too much havoc to tolerate, so we focus on prevention. Just as our technology is not adequate for dealing with an off-shore oil spill after it happens, there is little we can do to save the passengers after an airplane crashes. Thus, for decades, the aviation industry and government regulators cooperated on prevention.
It looks like what happened in the Gulf is like an airliner taking off a list of outstanding maintenance reports, plus ice on the wings, and letting it fly into a thunderstorm. In aviation, that nightmare scenario just would not happen. Pilots, mechanics, and controllers would be fired first for neglecting the rules.
An off-shore oil well can affect the lives and livelihood of far more people than the passengers on an airliner. Shouldn't the people responsible for the well be held to at least the same standard as the people responsible for the airliner?
This failure occurred not because off-shore oil drilling is morally bad, but because it is inherently risky, and people who should know better took short cuts. The investigation may indeed show that enforcement of existing rules would have been sufficient to avert the disaster. After all, that seemed to work for over 3,800 other wells drilled in the last 30 years in the Gulf of Mexico.