By any measure, the construction of a deepwater well involves “Extreme Engineering”. And like other applications of technology at the frontier of knowledge, proper operating practices are often a response to failure, and examination of lessons learned.

The Deepwater Horizon disaster represents the first time deepwater drillers have experienced multiple failures of the redundant systems that are designed to keep a well from flowing uncontrollably. In hindsight, it may well be determined that some combination of questionable design choices, human error and equipment malfunction conspired to cause the blowout and spill. No one (that I’m aware of) has suggested that BP was operating outside of its permitted authority.

BP had a reputation for being fixated on safety. In speaking with folks with direct knowledge of the Deepwater Horizon and BP’s safety procedures and practices, I’ve heard the word “overkill” more than once. Extreme Engineering can be exceedingly unforgiving, and perhaps that is the main lesson of this incident.

The Times-Picayune sketch above conveys quite a bit of information – most of it correct – about how the BP blowout well was constructed. It also gives a couple of hints as to possible failure mechanisms.

The key component of any well design is the pipe called casing, which functions to keep the hole from caving in and to keep wellbore fluids (and pressure) out. This cross-sectional view shows concentric strings of casing, one inside the other like an inverted wedding cake. As you drill deeper, the pipe sizes get smaller.

Casing is held in place by cement. Cement also functions as a seal to prohibit fluid migration outside the pipe in the annular area between the pipe and the borehole, or between the pipe and the next size larger pipe.

In the BP well, an oil-bearing zone was discovered in the portion of the hole around 18,000 feet, measured from the drilling floor of the rig. Rather than plugging the hole as originally planned, BP decided to save it for future production. They ran the long string of casing called the production string (colored green in this diagram). It is 7 inches in diameter at the bottom, and tapers up to 9-7/8 inches at the top of the well. (In this detail, the diagram is misleading. I presume that the well would have fully penetrated the oil-bearing zone, with the casing set all the way to the bottom of the hole.)

As the diagram indicates, the choice of a long production string has come under criticism from some drilling engineers. Conservative engineering, given the high bottomhole pressures, would have called for a 7″ liner, as opposed to a full string to the surface. A liner would have been “hung off” from the shallower 9-7/8″ liner, around 17,000 feet. BP could then have performed positive and negative pressure tests on that liner top, before proceeding with a “tieback string” to complete the connection to the wellhead at the seafloor.

By running a full casing string, BP was exposed to the consequences of a poor cement job. In that case, the annular area, shaded orange in the diagram, has poor pressure integrity and offers an alternate flow path to the surface (indicated by the arrow), one that was never intended. Even though BP ran a seal assembly at the top to isolate that flow path (not shown in the diagram), that system may have failed.

“Poor cement job” is not shorthand for “it’s Halliburton’s fault”. Halliburton is responsible for the quality of the cement slurry that is pumped, but BP is responsible for the well conditions and the timing of pumping the cement job. BP may point to bad cement as a root cause of the accident; Halliburton might counter that the well conditions were not optimum for a good cement job if, for example, there were excessive gas in the mud prior to cementing.

On the other hand, BP has been criticized – as in the linked article – for not running a Schlumberger cement bond log to evaluate the condition of the cement. I’m no deepwater drilling expert, but I would have found it a little unusual for them to run this evaluation so soon after cementing the well.

While we’re on the subject, I found the 60 Minutes coverage of issues related to well construction and control to be confusing and misleading. For one thing, their diagrams depicted the well to be an open hole, as if the entire wellbore were open to the oil-bearing zone at all times. Not true: at the time of the accident, the well was fully cased an operations were underway to temporarily abandon the well.

Another misleading aspect was the discussion of the condition of the annular blowout preventer. Chunk of its heavy rubber bladder were found in the mud returns, an indication of damage. Professor Robert Bea of Cal-Berkeley asserted that this missing rubber would prevent a good seal and lead to misleading pressure test of the casing. On the contrary, a bad annular element, if it were leaking, would create a failed test and cause the BOP to be changed out at that point.

Cross-posted at VladEnBlog.