Sample Chapter: Blowout!

A Sea in Flames by Carl Safina

Chapter One: Blowout!

April 20, 2010. Though a bit imprecise, the time, approximately 9:50 P.M., marks the end of knowing much precisely. A floating machinery system roughly the size of a forty-story hotel has for months been drilling into the seafloor in the Gulf of Mexico. Its creators have named the drilling rig the Deepwater Horizon.

Oil giant BP has contracted the Deepwater Horizon’s owner, Transocean, and various companies and crews to drill deep into the seafloor forty-odd miles southeast of the Louisiana coast. The target has also been named: they call it the Macondo formation. The gamble is on a volume of crude oil Believed Profitable.

Giving the target a name helps pull it into our realm of understanding. But by doing so we risk failing to understand its nature. It is a hot, highly pressurized layer of petroleum hydrocarbons—oil and methane—pent up and packed away, undisturbed, inside the earth for many millions of years.

The worker crews have struck their target. But the Big Payback will cut both ways. The target is about to strike back.

A churning drill bit sent from a world of light and warmth and living beings. More than three miles under the sea surface, more than two miles under the seafloor. Eternal darkness. Unimaginable pressure. The drill bit has met a gas pocket. That tiny pinprick. That pressure. Mere bubbles, a mild fizz from deep within. A sudden influx of gas into the well. Rushing up the pipe. Gas expanding like crazy. Through the open gates on the seafloor. One more mile to the sea surface.

The beings above are experiencing some difficulty managing it. A variety of people face a series of varied decisions. They don’t make all the right ones.

Explosion.

Fireball.

Destroyed: Eleven men. Created: Nine widows. Twenty -one fatherless kids, including one who’ll soon be born. Seventeen injured. One hundred and fifteen survive with pieces of the puzzle lodged in their heads. Only the rig rests in peace, one mile down. Only the beginning.

Blowout. Gusher. Wild well. Across the whole region, the natural systems shudder. Months to control it. Years to get over it. Human lives changed by the hundreds of thousands. Effects that ripple across the country, the hemisphere, the world. Imperfect judgment at sea and in offices in Houston, perhaps forgivable. Inadequate safeguards, perhaps unforgivable. No amount of money enough. Beyond Payable.

******

Deepwater exploration had already come of age when, in 2008, BP leased the mile-deep Macondo prospect No. 252 for $34 million. By 1998 only two dozen exploratory wells had been drilled in water deeper than 5,000 feet in the Gulf of Mexico. A decade later, that number was nearly three hundred.

With a platform bigger than a football field, the Deepwater Horizon was insured for over half a billion dollars. The rig cost $350 million and rose 378 feet from bottom to top. On the rig were 126 workers; 79 were Transocean employees, 6 were BP employees, and 41 were subcontractors to firms like Halliburton and M-I Swaco. None of the Deepwater Horizon’s crew had been seriously injured in seven years.

Operations began at Macondo 252 using Transocean’s drilling platform Marianas on October 6, 2009. The site was forty -eight miles southeast of the nearest Louisiana shore and due south of Mobile, Alabama. As the lessee, BP did the majority of the design work for the well, but utilized contractors for the drilling operation. Rig owner Transocean was the lead driller. Halliburton—formerly headed by Dick Cheney, before he became vice president of the United States under George W. Bush—was hired for cementing services. Other contractors performed other specialized work.

The initial cost estimate for the well was approximately $100 million. The work cost BP about $1 million per day.

They’d drilled about 4,000 feet down when, on November 8, 2009, Hurricane Ida damaged Marianas so severely that the rig had to be towed to the shipyard. Drilling resumed on February 6, 2010, with BP having switched to Transocean’s Deepwater Horizon rig.

By late April, the well would be about $58 million over budget.

Being a deepwater well driller—what’s it like? To simplify, imagine pushing a pencil into the soil. Pull out the pencil. Slide a drinking straw into that hole to keep it open. Now, a little more complex: your pencil is tipped not with a lead point but with a drilling bit. You have a set of pencils, each a little narrower than the last, each a little longer. You have a set of drinking straws, each also narrower. You use the fattest pencil first, make the hole, pull it out, then use the next fattest. And so on. This is how you make the hole deeper. At the scale of pencils-as-drills, you’re going down about 180 feet, and the work is soon out of sight. As you push and remove the pencils, you slide one straw through another, into the deepening hole. You have a deepening, tapering hole lined with sections of drinking straw, with little spaces between the hole and each straw, and between the sections of straw. You have to seal all those spaces, make it, in effect, one tapering tube, absolutely tight.

And here’s why: the last, narrowest straw pokes through the lid of a (very big) pop bottle with lots of soda containing gas under tremendous pressure. As long as the lid stays intact and tight, there’s no fizz. But only that long. Everyone around you is desperate for a drink of that pop, as if they’re addicted to it, because their lives depend on it. They’re in a bit of a hurry. But you have to try to ignore them while you’re painstakingly working these pencils and straws. And you’d better keep your finger on the top of the straw, or you’re going to have a big mess. And you’d better seal those spaces between sections of straw as you go down, or you’re going to have a big mess when you poke through that lid. And before you take your finger off the top of the straw, you’d better be ready to control all that fizz and drink all that pop, because it’s coming up that straw. And if, after poking a hole in this lid that’s been sealed for millions of years, you decide you want to save the soda for later, then you’d better—you’d better—have a way to stopper that straw before you take your finger off. And you’d better have a way to block that straw if the stopper starts leaking and the whole thing starts to fizz. If it starts to fizz uncontrollably, and you can’t regain control, you can get hurt; people can die.

The real details beggar the imagination of what’s humanly and technologically possible. Rig floor to seafloor at the well site: 5,000 feet of water, a little under one mile. Seafloor to the bottom of the well: about 13,360 feet—two and a half miles of drilling into the seabed sediments. A total of 18,360 feet from sea surface to well bottom, just under three and a half miles.

Equally amazing as how deep, is how narrow. At the seafloor—atop a well 2.5 miles long—the top casing is only 36 inches across. At the bottom it’s just 7 inches. If you figure that the average diameter of the casing is about 18 inches, it’s like a pencil-width hole 184 feet deep. Nine drill bits, each progressively smaller, dig the well. The well’s vertical height gets lined with protective metal casings that, collectively, telescope down its full length. At intervals, another telescoping tube of casing gets slid into the well hole. The upper casing interval is about 300 feet long. Some of the lower ones, less than a foot across, are 2,000 feet long. The casings and drill pipes are stored on racks, awaiting use. Casings are made in lengths ranging from 25 to 45 feet; the drill pipe usually comes in 30-foot joints. They are “stacked” in the pipe racking system. You assemble three at a time and drop approximately 90 feet in, and then repeat. When you get ready to put the casing in, you pull all the drill pipe out. Rig workers also remove the drill pipe from the hole every time the drill bit gets worn and needs changing or when some activity requires an open hole. Pulling the entire drill string from the hole is called “making a trip.” Making a trip of 10,000 feet may take as long as ten or twelve hours. The uppermost end of each casing will have a fatter mouth, which will “hang” on the bottom of the previous casing. You will make that configuration permanent with your cementing jobs. When you want to start drilling some more, you have to reassemble the drill pipe and send it down.

On drillers’ minds at all times is the need to control the gas pressure and prevent gas from leaking up between the outside of the casings and the rock sides of the well. At each point where the casing diameter changes, the well drillers must push cement between the casings and the bedrock wall of the well. This cements the casings to the well wall. It controls pressure and eliminates space.

Drillers continually circulate a variety of artificial high-density liquid displacements or drilling fluids, called “mud,” between the drill rig and the well. The circulating fluid is sent down the drill pipe. It causes the drill bit to rotate, then leaves the drill bit and comes up to the surface, carrying the loose rock and sand that the drill bit has ground loose. Because the well is miles deep, the fluid creates a miles-high column of heavy liquid. (The drilling fluid is heavier than water. Imagine filling a bucket with water and lifting it; then imagine that the bucket is three miles tall. It’s heavy.) That puts enormous downward pressure on the entire well bore. As the drill digs deeper, the drilling “mud” formulation is made heavier to neutralize the higher pressures in the deepening depths. But that heavier fluid can exert so much pressure on the shallower reaches of the well (where the ambient pressure is less) that it can fracture the rock, damage the well, seep away, and be lost into the rock and sand. Steel casings can protect weaker sections of rock and sand from these fluid pressures.

Because things fail and accidents happen, a 50-foot-high stack of valves sits on top of the well on the seafloor. Called a “blowout pre-venter,” it is there to stop the uncontrolled release of oil and gas when things go wrong in a well. If something goes seriously wrong below, the valves pinch closed, containing the pressure. The blowout preventer is relied on as the final fail-safe.

Designs vary. This rig had a 300-ton blowout preventer manufactured by Cameron International. A blowout preventer’s several shutoff systems may include “annulars,” rubber apertures that can close around any pipe or on themselves; “variable bore rams,” which can seal rubber-tipped steel blocks around a drill pipe if gas or oil is coming up outside it; “casing shear rams” or “super shear rams,” designed to cut through casing or other equipment; and “blind shear rams,” designed to cut through a drill pipe and seal the well. Blind shear rams are the well-control mechanism of last resort. Though often designed with redundant equipment and controls, blowout pre-venters can fail. On occasion, they have. Neither casing shear rams nor blind shear rams are designed to cut through thick-walled joint connections between sections of drill pipe. Such joints may take up as much as 10 percent of a pipe’s length. So having redundant shear rams ensures that there is always one shear ram that is not aligned with a tool joint.

The drilling fluid is the primary stopper for the whole well. If you’re going to remove that stopper, you’d better have something else to hold the pressure. Usually, that something else is several hundred feet of cement. On the night of the explosion, as rig workers were preparing to seal the well for later use, drillers were told to remove the drilling fluid and replace it with plain seawater—in essence, to pull out the stopper. The cement did not hold. And in the critical moment, the blowout pre-venter failed. The consequent gas blast was the blowout.

That’s what went wrong. But so many things had gone wrong before the blowout that assistant well driller Steve Curtis had nicknamed it “the well from hell.” Curtis, thirty-nine, a married father of two from Georgetown, Louisiana, was never found.

******

Right from the start—beginning with Hurricane Ida forcing the Marianas rig off the well location—various things didn’t proceed as planned, or struck people as risky.

The Deepwater Horizon, built at cost of $350 million, was new in February 2001. In September 2009, it had drilled the deepest oil well in history—over 35,000 feet deep—in the Gulf of Mexico’s Tiber Field.

It was a world-class rig, but it was almost ten years old. The wonderful high-tech gadgets that were state of the art in 2001 did not always function as well in 2010. Equipment was getting dated. Old parts didn’t always work with new innovations. Manufacturers changed product lines. Sometimes they had to find a different company to make a part from scratch.

The world has changed a lot since the rig was built. So has software. More 3-D, a lot more graphics. Drillers sit in a small room and use computer screens to watch key indicators. Depth of the bit, pressure on the pipe, flows in, flows out. But on this job, the soft ware repeatedly hit glitches. Computers froze. Data didn’t update. Sometimes workers got what they called the “blue screen of death.” In March and April 2010, audits by maritime risk managers Lloyd’s Register Group identified more than two dozen components and systems on the rig in “bad” or “poor” condition, and found some workers dismayed about safety practices and fearing reprisals if they reported mistakes.

Risk is part of life. And it’s part of drilling. Yet drilling culture has changed, with much greater emphasis on safety than in the past. Many people still working, however, came up the ranks in a risk-prone, cowboy “oil patch” culture. A friend of mine who worked the Gulf of Mexico oil field in the 1970s says, “It was clear to me that I was way underqualified for what I was doing. Safety didn’t get you promoted. They wanted speed. If we filled a supply boat with five thousand gallons of diesel fuel in twenty-five minutes, they’d rather you disconnect in a big hurry and spill fifty gallons across the deck than take an extra three minutes to do it safe and clean. I’d actually get yelled at for stuff like that. Another thing that was clear: if you could simply read or write, you could pretty much run the show. They actually gave oral exams to workers who couldn’t read. I was still a kid, but pretty soon I was put in charge of a supply boat because I could read and write. That was the culture then.” Another friend, now a tug captain, says, “Never in the four years I worked the rig did I hear anyone say, ‘Let’s wait for better sea conditions.’ We were always dragged into situations we didn’t want to be in, doing things I didn’t think were safe. Now it’s a lot better. It used to be the Wild West out there.”

When you pump drilling fluid down the well, it comes out the bottom of the drill pipe and circulates up between the drill pipe and the wall of the well, and comes back to you. For every barrel of drilling fluid you push down, you’d better get a barrel back. If you get more—that’s really bad, because gas and oil are coming up in your fluid. If you get less—that’s really bad, too. Drillers call it “lost returns.” It means the returning fluid has lost some of its volume because fluid is leaking into the rock and sand of the well’s walls, sometimes badly. Sometimes there are fractures in the rock and the fluid’s going there. When it’s leaking like that, you can’t maintain the right pressure in the well to tamp down the pressure of oil and gas that wants to come up from below.

In a March 2010 incident, the rig lost all of its drilling fluid, over 3,000 barrels, through leaks into the surrounding rock and sand formation into which they were drilling.

BP’s onshore supervisor for this project, John Guide, later testified, “We got to a depth of 18,260 feet, and all the sudden we just lost complete returns.”

BP’s senior design engineer, Mark Hafle, was questioned on this point:

Q: “Now, lost returns, what does that mean in plain everyday English?”

Hafle: “While drilling that hole section we lost over 3,000 barrels of mud.”

Three thousand barrels is a lot of barrels. At over $250 per barrel for synthetic oil-based mud, that’s $750,000.

A high-risk pregnancy is one running a higher than normal risk for complications. A woman with a high-risk pregnancy needs closer monitoring, more visits with her primary health-care provider, and more careful tests to monitor the situation. If BP can be called the birth parent, this well was a high-risk pregnancy.

Several times, the well slapped back with hazardous gas belches called “kicks,” another indication that the deep pool of hydrocarbons did not appreciate being roused from its long sleep.

At around 12,000 feet, the drill bit got stuck in rock. The crew was forced to cut the pipe, abandon the high-tech bit, and perform a time-consuming and costly sidetrack procedure around it to continue with the well. The delays cost a week and led to a budget add-on of $27 million.

The work had fallen forty -three days behind schedule, at roughly $1 million a day in costs. At a “safety meeting,” the crew was informed that they’d lost about $25 million in hardware and drilling fluid. Not really safety information. More pressure to hurry.

High-risk pregnancy, added complications. On April 9, 2010, BP had finished drilling the last section of the well. The final section of the well bore extended to a depth of 18,360 feet below sea level, which was 1,192 feet below the casing that had previously been inserted into the well.

At this point, BP had to implement an important well-design decision: how to secure the final 1,200 or so feet and, for eventual extraction of the petroleum, what kind of “production casing” workers would run inside the protective casing already in the well. One option involved hanging a steel tube called a “liner” from the bottom of the previous casing already in the well. The other option involved running one long string of steel casing from the seafloor all the way down to the bottom of the well. The single long string design would save both time (about three days) and money.

BP chose the long string. A BP document called the long string the “best economic case.” And though officials insist that money was not a factor in their decisions, doing it differently would have cost $7 to $10 million more.

BP’s David Sims later testified, “Cost is factor in a lot of decisions but it is never put before safety. It’s not a deciding factor.”

Sims was John Guide’s supervisor. Guide described the long string design as “a win-win situation,” adding that “it happened to be a good economic decision as well.”

Guide insisted that none of these decisions were done for money.

Q: “WiThevery decision, didn’t BP reduce the cost of the project?”

Guide: “All the decisions were based on long-term well-bore integrity.”

Q: “I asked you about the cost of the project. Didn’t each of these decisions reduce the cost, to BP, of this project?”

Guide: “Cost was not a factor.”

Q: “I didn’t ask if it was a factor. I asked if it reduced the cost. It’s a fact question, sir. Did it not reduce the cost, in each case?”

Guide: “All I was concerned about was long-term well-bore integrity.”

Q: “I just want to know if doing all these decisions saved this company money.”

Guide: “No, it did not.”

Q: “All right; what didn’t save you money?”

Silence.

Q: “Which of these decisions that you made drove up the cost of the project, as opposed to saving BP money? Can you think of any?”

Guide: “I’ve already answered the question.”

Q: “What was the answer?”

Guide: “These decisions were not based on saving BP money. They were based on long-term well-bore integrity.”

Some people called the long string design the riskier of two options. Greg McCormack, director of the University of Texas at Austin’s Petroleum Extension Service, calls it “without a doubt a riskier way to go.”

But others disagree. Each of the two possible well casing designs represented certain risk trade-offs. One called for cement around casing sections at various well depths, providing barriers to any oil flowing up in the space between the rock and casing. The other called for casing sections seamlessly connected from top to bottom with no outside barriers except the considerable bottom cement. Investigators would later focus lasers on this aspect of the well design for weeks after the well blew. The cost savings led many to believe that this was a cut corner that resulted in the blowout. Months later, however, it became clear that this decision was not a direct cause of the disaster.

Final hours. In the eternal darkness of the deep sea, the well is dug, finished. All that’s needed: just seal the well and disconnect. The plan was for a different rig to come at some later date and pump the oil for sale.

At BP’s onshore Houston office, John Guide is BP’s overall project manager for this well. He has been with BP for ten years, has oversee n more than two dozen wells. Mark Hafle is BP’s senior design engineer. With twenty -three years at BP, Hafle created much of the design for this well. Brian Morel, a BP design engineer involved in many of the key meetings and procedures in the final days, splits his time between Houston and the rig. Out on the drilling rig itself, BP’s supervisors, titled “well site leaders,” are often called the “company men.” They oversee the contractors. Because a drilling rig operates twenty -four hours a day, BP has two well site leaders aboard, working twelve-hour shifts: Don Vidrine and Bob Kaluza. Vidrine is in his sixties. Kaluza in his fifties. Vidrine has been with the rig for a while. Kaluza is new.

Because the Deepwater Horizon was both a drilling rig and a vessel, rig owner Transocean has two separate leadership roles. When moving, the rig is under the authority of the captain; when stationary at the well site, an offshore installation manager, or OIM, is in charge. Jimmy Harrell, OIM, managed the drilling. He’d been with Trans-ocean since 1979 and on the Deepwater Horizon since 2003. Curt Kuchta was the Deepwater Horizon’s captain.

Managers play an important part in the decision process, but the drilling team executes the plan. At the top of the drilling personnel chart are the “tool pusher,” who oversees all parts of the drilling process, and the driller, who sits in a high-tech, glass-paneled control room called the “driller’s shack” and leads the actual work. Many people work under the direction of the tool pusher and driller.

On duty on the evening of April 20 were Transocean’s tool pusher Jason Anderson and driller Dewey Revette. Thirty-five years old, Jason had worked on the Horizon since it launched, in 2001, and was highly respected by his crewmates. At home before the explosion, Jason had been concerned about putting his affairs in order. He wrote a will and gave his wife, Shelley, instructions about things to do if anything were to “happen to him.” Jason told his father that BP was pushing the rig operators to speed up the drilling. In telephone calls from the rig before the explosion, Jason told Shelley he could not talk about his concerns because the “walls were too thin,” but that he would tell her about them later, when he got home. Jason had just been promoted to senior tool pusher. He had been due to leave for his new post aboard the Discoverer Spirit on April 14, but was persuaded to stay aboard the Deepwater Horizon for one more week. He was scheduled to be helicoptered to his new job at 7:00 A.M. on April 21. By then, he had died in the explosions and the rig was an inferno.

At the closing of a well, it might seem you’d want the team members most familiar with the well and one another to be present. But approaching the critical juncture of closing up the well they’d been drilling for months, one of BP’s company men, with thirty -three years of experience as a well site leader, was sent off the rig to take his mandatory biannual well-control certification class. Just four days before the explosion, his replacement, Bob Kaluza, appeared on the rig. A Wall Street Journal article said of Kaluza, “His experience was largely in land drilling,” and he told investigators he was on the rig to “learn about deep water,” according to Coast Guard notes of an interview with him. We don’t have a better feel for Kaluza because he has exercised his Fifth Amendment right not to provide testimony that could incriminate himself.

Transocean’s onshore manager responsible for the Horizon, Paul Johnson, testified that he was troubled by the timing in BP’s switch of well site leaders. “I raised my concerns,” he noted. “I challenged BP on the decision. We didn’t know who this gentleman was. I wasn’t making any assumptions on him, I just—I heard he come from a platform, so I was curious about his deepwater experience in a critical phase of the well. They informed me that Mr. Kaluza was a very experienced, very competent well site leader, and it wouldn’t be a concern.”

Kaluza showed a tendency toward appropriate caution, but the simple fact that he was new seemed to get in the way. At a critical juncture, Kaluza was uncertain enough about a crucial procedure called a “negative pressure test” that he sought out Leo Lindner, a drilling fluid specialist with the company M-I Swaco. Lindner, who’d worked on the rig for over four years, was in charge of the diff erent types of fluids used during the negative test, an important role.

“Mr. Bob Kaluza called me to his office,” Lindner testified. “He wanted to go over the method. I briefly explained to him how the rig had been conducting their negative tests and he just wanted—.” Lindner interrupted himself to note, “Bob wasn’t the regular company man on the Horizon.”

So, competence aside, there were working dynamics, team cohesion. It was a time for familiar faces and an almost literally well-oiled team. But it felt like BP was taking out its quarterback during the fourth quarter of a playoff game.

And on the morning of April 20—the day the rig exploded—BP engineer Brian Morel departed the rig, creating space for visiting company VIPs. Wrote one industry analyst later, “Let’s face it; the timing of that VIP visit was terrible. It could not have been at a worse time.”

A difficult pregnancy, new doctors, altered procedures: BP decided to turn this exploratory well into a production well. Usually, the purpose of an exploratory well is to learn about the geological formation and what the oil and gas–bearing production zone contains. Then the well is closed out. Engineers use the information to decide where to drill a production well, perhaps in a nearby spot. If you decide to turn an exploratory well into a production well, you obviously save a fair amount of drilling expense. But is an exploration crew going to be familiar with production technology? BP’s drilling and completion operations manager David Sims testified that the decision was not a major technical issue. Yet veteran well site leader Ronnie Sepulvado who’d been on the rig for eight and a half years had a different take: “We’re in the exploration group, so we hardly ever set production strings. We did maybe a handful of wells that was kept for production.”

Added complications. The oil and gas—in the pay zone, or “production zone”—lay between 18,051 and 18,223 feet. The well was drilled to below the zone, to 18,360 feet below the sea surface, which allowed cement to be placed under the oil and gas reservoir as well as around it.

Because this was an exploratory well, the idea was to find the oil, then seal the well shut so a different rig could later tap it for commercial production. Cement is the main barrier for preventing the pressurized oil and gas from entering the well. So it was crucial that the cement job at the bottom of the well absolutely seal off the oil and gas reservoir from the well casing. A bad cement job could let oil and gas into the well.

The environment at that depth means cementing is not a matter of getting a few bags of concrete from the hardware store. Temperatures and pressures at the bottom of a well like this—it’s hotter than boiling, 240º Fahrenheit—make cementing a highly technical endeavor, requiring calculations and tests to select several chemical mixtures, which will be used in layers.

Earlier heavy losses of drilling fluid told technicians that they could be into very loose rock and sand. If you are nervous about a soft zone, you also worry that when you insert cement to seal the well bottom, your cement may ooze into the loose stuff. This complicated the cementing deliberations. John Guide: “The biggest risk associated with this cement job was losing circulation. That was the number-one risk.”

If you’re worried that the well walls may be so porous that they’ll suck in cement pumped under pressure, you might add some nitrogen gas to the cement mixture, to get it to form foamy bubbles; this would prevent the cement from leaking into the loose spots.

From the well’s training resources document: “Foamed cement is more expensive than regular cement and it works better than regular cement in some applications. One of the advantages is that the bubbles stiffen the wet cement so that it is less prone to being lost into a zone or being invaded by fluids in a zone. A remote analogy is that when a sink is drained after washing dishes, the water flows out the drain while the soap bubbles remain in the sink.” But, the document notes, while foamed cement is good at sealing off shallow areas, “use of nitrogen foam is less common for deep high-temperature, high-pressure zones.”

Halliburton cement specialist Jesse Gagliano first proposed including nitrified cement. After some back-and-forth, BP agreed. But because nitrified cement is usually used for shallower jobs, the depth created concern on the rig.

Transocean offshore installation manager Jimmy Harrell: That nitrogen, it could be a bad thing. If it gets in the riser, it will unload the riser on you. . . .  Anything can go wrong.

There were three parts to the cement and three formulations. “Cap cement” topped the cement in the space between the casing and the oil-bearing rock and sand formation of the well’s sides. Below that, the nitrified “foamed cement” filled the rest of the narrow space outside the casing and along the formation. “Tail cement” filled the “shoe track” at the bottom and was used inside the lower part of the casing itself.

So in various ways this was going to be a difficult cement job. As late as the afternoon of April 14, BP was still reconsidering the chosen long string casing design, with its heavier reliance on the integrity of the cement deep at the well bottom. And the porous surrounding rock was on everyone’s mind. Cement has to be pumped in under some degree of excess pressure in order to fully fill the gap and get a good bond to the rock and sand on one side and to the outside of the production casing on the other. You need enough pressure both to keep the hydrocarbons contained and to force the cement against the sides, but too much pressure will inject the cement into the sand, and you’ll lose it. The team spent days determining how to approach the cement job. BP engineer Mark Hafle testified to this: “We were concerned that the pore pressure and frac gradient was going to be a narrow window to execute that cement job. That’s why we spent five days.” BP’s Brian Morel apologized to a colleague for asking yet another question about the design in an April 14 e-mail that he ended with this resonant comment: “This has been a nightmare well.” Hafle added, “This has been a crazy well for sure.”

When BP won the lease to this piece of seabed, it held an in-house contest to name it. The winner, “Macondo,” came from the mythical town hewn from a “paradise of dampness and silence” in Gabriel García Márquez’s novel One Hundred Years of Solitude. In the novel, Macondo is an accursed place, a metaphor for the fate awaiting those too arrogant to heed its warning signs. What had seemed a nice literary allusion now carries ominous portent.

More complications. Part of Jesse Gagliano’s task was to model the cement’s likely performance in this well and design a procedure that would get the cement to the proper locations. On April 15, he discovered some problems. This space between the casing and the wall of this well was very narrow. And the previous experience with lost drilling fluid indicated soft walls, requiring a low cement-pumping rate.

These conditions contributed to a model predicting that if the casing moved too close to one side of the well-bore wall, drilling fluid could get left behind, creating pockets or channels where the cement would not distribute uniformly. That is, it wouldn’t fill in all of the space it needed to fill.

To prevent a casing from getting too close to one side of a well bore, drillers slip flexible metal spring devices called “centralizers” over the casing so that it will stay centered in the well bore. By keeping the casing centered, centralizers help achieve good, even, thorough cementing between the casing and the well’s geological wall. In this case, BP had six centralizers. That number concerned Gagliano. On April 15 Gagliano e-mailed BP saying he’d run different scenarios “to see if adding more centralizers will help us.”

BP’s Brian Morel replied, “We have 6 centralizers. . . .  It’s too late to get any more to the rig. Our only option is to rearrange placement of these centralizers. . . .  Hopefully the pipe stays centralized due to gravity.”

But Jesse Gagliano continued his calculations. He determined that twenty-one centralizers should create an acceptably safe cement flow.

And it wasn’t really too late. On April 16, BP engineering team leader Gregg Walz e-mailed BP project manager John Guide, saying that he’d located fifteen more centralizers that could be flown to the rig in the morning with “no incremental cost” for transporting them. “There are differing opinions on the model accuracy,” he wrote to Guide, “but we need to honor the modeling.” He added, “I apologize if I have overstepped my bounds.”

The centralizers made the helicopter trip to the rig.

But Guide expressed dismay at these particular centralizers’ design, the addition of new pieces “as a last minute decision,” and the fact that it would take ten hours to install them. He wrote, “I do not like this,” adding that he was “very concerned about using them.”

Walz backed off.

Later that afternoon BP’s Brian Morel wrote to his colleague Brett Cocales, “I don’t understand Jesse’s centralizer requirements.”

Cocales replied, “Even if the hole is perfectly straight, a straight piece of pipe in tension will not seek the perfect center of the hole unless it has something to centralize it.” And then he added this: “But who cares, it’s done, end of story, will probably be fine and we’ll get a good cement job.”

That was on April 16. It seems to suggest a certain willingness to add risk.

That’s not how BP’s managers saw it. Guide later testified: “It was a bigger risk to run the wrong centralizers than it was to believe in the model.”

But months later in September, BP’s own internal investigation concluded, “The BP Macondo team erroneously believed that they had received the wrong centralizers.”

In late July 2010, examiners from BP contractors Anadarko, Trans-ocean, and Halliburton questioned Guide on his decisions.

Q: “That left you several days to get whatever centralizers you felt might be needed.”

Guide: “I didn’t feel they were needed.”

Q: “So what you’re telling me is that there was just no discussion among you between you and Mr. Walz about just waiting for the right centralizers? None, zip, zero, true?”

Guide: “That subject never came up.”

Q: “You still had time between the 16th and the 20th—”

Guide: “Well, we didn’t know if we could find them. That subject never came up.”

Q. “Sir, can you tell us the number of times, that you have personal knowledge of, that BP did not follow the recommendations of Halliburton in connection with the cementing of any of its jobs, if any?

Guide: “I don’t know of any.”

Well, perhaps we know of one. Halliburton’s Gagliano accepted BP’s decision and, on April 17 and 18, developed the specific procedure for pumping the cement. Gagliano created and sent one final cementing model out to the team on the evening of April 18.

The model would later cause a firestorm for a particular page that no one at BP seems to have looked at. That page said that using only six centralizers would likely cause channeling; it also noted: “Based on analysis of the above outlined well conditions, this well is considered to have a SEVERE gas flow problem.” But with twenty -one centralizers, it added, “this well is considered to have a MINOR gas flow problem.”

This report was attached to an e-mail sent to Guide on April 18, but it went unopened because the casing with just the six centralizers was already down the hole. Although BP had had days to get the centralizers, it was now too late to read the e-mail predicting severe gas-flow problems. Guide later testified: “I never knew it was part of the report.”

The cement job will fail. But a few months later, in September 2010, BP’s own investigation will conclude, “Although the decision not to use twenty-one centralizers increased the possibility of channeling above the main hydrocarbon zones, the decision likely did not contribute to the cement’s failure.”

That’s BP’s executives exonerating themselves, so season it with a grain of salt. But numerous industry analysts think centralizers are not the smoking gun. We’ll get back to that question later, but for now, it’s important to understand the distances involved. The recommended twenty-one centralizers were meant to keep the bottom 900 feet of casing evenly centered in the well. If the workers had had all twenty one, they would have put fifteen above the span containing the oil and gas, four in the zone that held the oil and gas, and two below that zone.

BP placed the six centralizers so as to straddle and bisect the 175 vertical feet of oil and gas–bearing sands deep in the well, at depths of around 18,000 feet. They placed two centralizers above the oil and gas zone, two in the zone, and two below it.

But even if centralizers won’t be the smoking gun, the e-mail exchanges over the centralizers convey the sense that the BP team isn’t treating this endeavor with the utmost care. When red flags go up, BP’s decision makers seem rushed, rather than thorough.

BP e-mails suggest that its personnel believed that any problem with cement could be remediated with additional cement. And actually, that’s often what’s done; well cement jobs sometimes do fail. The reason why they fail is seldom precisely ascertained. Usually the failure is not catastrophic and the fix is to pump more cement in, then test it again. For this reason, the industry has developed several ways of testing the soundness of cementing jobs.

But detecting problems assumes, of course, that the cementing job will be properly tested.

The crew did their cementing over a five-hour period, starting at 7:30 P.M. on April 19. When they finished, at around 12:30 A.M., the calendar had turned over to April 20.

Testing. More complications: when wells lose drilling fluid—as this one did weeks earlier—one possible solution is to send down a special mixture of fluids to block the problem zones in the well bore. Think of the stuff made to spray into a flat tire to seal it enough to get you home. A batch of this mixture is called a “kill pill.” It is a thick, heavy compound (16 pounds per gallon, compared to 14.5 for drilling fluid and 8.6 for seawater).

Two weeks before the accident, when the rig had its serious 3,000-barrel loss of drilling fluid, the fluid specialists made up a kill pill and pumped it down to the problem zone. It didn’t seem to work, so they mixed up another batch: 424 barrels of a combination of two materials. But just as they were preparing to send this second kill pill down the hole, the losses stopped.

They now had a thick, unused 424-barrel kill pill sitting in an extra tank, taking up space on the rig. To dispose of it they had two options: take it onto shore and treat it as hazardous waste or use it in the drilling process. The second choice would allow them to skirt the land-based disposal process and dump the compound directly into the ocean.

The drilling fluid specialists got the bright idea of using the unused kill-pill material in a “spacer.” A spacer is a distinct fluid placed in between two other fluids. When you’re pushing different fluids down a well, you’ll often decide to use a spacer between the different fluids— between displacement fluid and drilling fluid, for instance—so that they won’t mix and so you can keep track of where things are. A spacer also creates a marker in the drilling flow, which allows the rig team to watch the fluid returns, to ensure that flow in equals flow out.

Because BP didn’t want to have to dispose of the thick kill-pill material, they mixed it with some other fluid to create a spacer. BP’s vice president for safety and operations, Mark Bly, later said that that using such a mixture was “not an uncommon thing to do.” The rig’s drilling fluid specialist, Leo Lindner, put it differently, saying, “It’s not something that we’ve ever done before.” At a government hearing in August, BP manager David Sims was asked if he had ever used a similar mixture as a spacer. “No, I have not,” Sims said.

Down the hatch it goes. Just like that.

Q: “What if you hadn’t used it that way, what would the rig have had to do; hazardous waste disposal, right?”

Lindner: “Yes.”

Q: “When these pills are mixed, have you ever heard anybody characterize it as looking like snot?”

Lindner: “It wasn’t quite snotty.”

Q: “But it was close?”

Lindner: “It was thick. It was thick, but it was still fluid.”

Q: “So it was very viscous?”

Lindner: “Yes.”

Q: “And really the only reason for putting those two pills down there was just to get rid of them; is that your understanding?”

Lindner: “To my knowledge—well, it filled a function that we needed a spacer.”

Chief engineer Steve Bertone later recalled that after the explosion, “I looked down at the deck because it was very slick and I saw a substance that had a consistency of snot. I can remember thinking to myself, ‘Why is all this snot on the deck?’ ”

Back on the rig, Transocean installation manager Jimmy Harrell outlines the well-closing procedure. BP’s company man (later testimony is conflicting as to whether Kaluza or Vidrine was speaking) suddenly perks up. Interrupts. Says, “Well, my process is different. And I think we’re gonna do it this way.” Chief mechanic Douglas Brown will later testify that BP’s company man said, “This is how it’s going to be,” leading to a verbal “skirmish” with Transocean’s Jimmy Harrell, who left the meeting grumbling, “I guess that’s what we have those pincers for” (referring to the blowout preventer). Harrell will later testify that he was alluding to his concerns about risks inherent in the cementing procedure, but say, “I didn’t have no doubts about it.” He’ll claim he had no argument but that “there’s a big difference between an argument and a disagreement.” Chief electronics technician Mike Williams, seated beside BP’s company man, will later recall, “So there was sort of a chest-bumping kind of deal. The communication see med to break down as to who was ultimately in charge.”

This is certainly not the time for chest bumping or blurred authority. If you’re gonna release the parking break, you’d better agree on who’s gonna be in the driver’s seat. And whoever grabs the wheel better know how to drive.

High-risk pregnancy enters labor. To determine if the cement job has worked and the well is sealed, rig operators can choose from several tests. On the Deepwater Horizon the engineers decide to do two kinds of pressure tests. In a “positive pressure test,” they introduce pressure in the well; if it holds, it means nothing’s leaking out from the well into the rock. They do this test on the morning of April 20, between about 11:00 a.m. and noon, roughly eleven hours after the cement job ends. It goes well; it seems nothing’s leaking out.

But the reason nothing’s leaking out may be that there’s pressure from oil and gas pushing to get in. So the engineers prepare to do a “negative pressure test.” A negative test is a way of seeing if pressure is building in the well, indicating that gas and oil are leaking in. That could mean the cement has failed.

To do a negative test, they close the wellhead, then reduce the downward pressure on the well by replacing some heavy drilling fluid with lighter water. Then they look at pressure gauges. If the pressure increases, hydrocarbons are entering, exerting upward pressure from below. What they want to see is zero pressure.

Until the negative pressure test is performed successfully, the rig crew won’t remove the balance of the heavy drilling mud that stoppers the well; that’s their foot on the brake.

Between 3:00 P.M. and 5:00 P.M., about fifteen hours after the cement job was finished, they start reducing the pressure by inserting seawater into the miles-long circulating-fluid lines. To make sure the drilling fluid and the seawater don’t mix, they precede the seawater with a spacer. The spacer they use contains that extra kill-pill material, the “snot.” And though a typical amount of spacer is under 200 barrels, this time it’s over 400 barrels because, remember, they’re trying to get rid of that left over stuff.

There are various places all this fluid is getting to, because there are various lines and pipes going into and out of the blowout preventer. One such line is called the “kill line.” Another is the drill pipe.

A little before 5:00 P.M., they work for a while to relieve any residual pressure and are looking for the fluid to stabilize at zero pressure, indicated by a reading of zero pounds per square inch, or psi. They’ve got the pressure down to 645 psi in the kill line, but it’s at 1,350 psi in the drill pipe. So they try bleeding the system down, venting off some of that pressure. They achieve zero in the kill line. The drill pipe retains 273 psi. They need zero.

Over six minutes right around 5:00 P.M., the drill pipe pressure increases from 273 psi to 1,250.

The engineers tighten the blowout preventer’s rubber gasket and add 50 barrels of heavier-than-water fluid.

So the lines are filled with a variety of different fluids snaking through in segments: there’s a stretch of drilling fluid, or “mud,” a stretch of the unusual spacer material, followed by plain seawater. At this point in the circulation of the various fluids, the spacer—the “snot”—should be above the blowout preventer. But some of it has found its way into the blowout preventer and has entered one of the lines being tested.

The engineers see pressure building in the drill pipe, zero pressure in the kill line. They’re unsure what to make of that, so they repeat the test procedure several times. From shortly after 5:00 to almost 5:30, they get the pressure in the drill pipe down a little, from 1,250 to almost 1,200.

The Deepwater Joint Investigation panel asked Dr. John R. Smith, whose PhD is in petroleum engineering, to describe a negative test:

“If it’s a successful test, there’s no more fluid coming back. You’ve got a closed container. There’s no hole in the boat. There’s no fluid leaking in through the wall of the container or the casing. It just sits there. If you have an unsuccessful test, external pressure is leaking through the wall of the system somewhere. Through the wall of the casing, past the casing hanger seals, up through the fl oat equipment in the casing—. Somewhere there’s a leak from external pressure into the system. You’d expect to continue to see some fluid coming back.”

To reach for an analogy: if you did a negative test in a swimming pool, you’d empty the pool. If the pool stayed dry, you’d have a successful test. If you had a problem, the pool would start filling itself through leaks in its walls. A well 18,360 feet deep is a bit trickier to test than a swimming pool. Even though you’re reducing the pressure, you still have to keep enough downward pressure on the well to control any oil and gas that might start entering. And you must check specific pipes for indications of pressure.

Wells come in many different sizes and shapes and pipe setups. So, somewhat surprisingly, there isn’t a “standard” negative test.

Q: Do you know if there’s any standard negative test procedure that the industry follows?

Dr. John Smith: I was unable to find a standard.

The Minerals Management Service’s permit specified that this negative test be conducted by monitoring the kill line above the blowout preventer. John Guide: “And that was really the only discussion, was to make sure that we did it on the kill line so that we would be in compliance with the permit.”

Drilling fluid specialist Leo Lindner had spent four years on Deep-water Horizon.

Q: “And what is a good negative test?”

Lindner: “Where you don’t have any pressure up the kill. Of course . . . I haven’t been a witness to that many negative tests.”

And that’s another thing: negative tests are not routine on exploratory wells. The Deepwater Horizon mainly drilled exploratory wells. This well was unusual, because it was an exploratory well that was being converted to a future production well that would later be reopened and tapped. Not all the crew were familiar with all these steps and procedures.

Dr. John Smith: “Before they ever started the test, they’ve got enormously high pressure on the drill pipe.” That should have been, he noted, “a warning sign right off the bat.”

Leo Lindner: “They decided to go ahead and try to do the first negative test. They bled off some pressure from the drill pipe and got fluid back. They attempted it again and got fluid back.”

But as Dr. Smith had said: “If it’s a successful test, there’s no more fluid coming back.”

The crew had been replacing heavier fluid with seawater. But Lindner was sufficiently worried by the initial results that at around 5:00 P.M., he ordered his coworker to stop pumping drilling fluid off the rig. He wanted to keep his foot on the emergency brake.

At 5:30, Transocean’s subsea supervisor Chris Pleasant comes on duty in the drill shack. “My supervisor was explaining to me that they had just finished a negative test. Wyman Wheeler, which is the tool pusher, was convinced that something wasn’t right. Wyman worked to 6:00 P.M. By that time his relief come up, which is Jason Anderson, which is a tool pusher as well.”

It was a bad time to change guards.

But now it’s approximately ten minutes till 6:00. Bob Kaluza, the BP company man, tells Jason Anderson, “We’re at an all stop.”

Kaluza’s relief, BP company man Don Vidrine, is scheduled to come on at 6:00 P.M.

Chris Pleasant: “Jason Anderson, he’s convinced that it U-tubed. Where that U-tube’s at, I don’t know. But, you know, I guess we never really had a clear understanding. Anyway Jason is telling Bob that, ‘We want to do this negative test the way Ronnie Sepulvado does it.’ And Bob tells Jason ‘No, we’re going to do it the way Don wants to do it. So, probably five minutes after 6:00 or something Don comes to the rig floor. Him and Bob talks back and forth for approximately a good hour.”

They discuss possible causes for the fact that they’re reading pressure on the drill pipe but not on the kill line. Don Vidrine believes that if the pressure in the drill pipe was evidence of a surge of gas deep in the well, they would be seeing similar pressure in the kill line.

Later question: “Based on industry standard ways of reading negative tests, you’re looking for something pretty simple, right? A zero on the drill pipe and a zero on the kill line; right?”

Dr. John Smith: “Right.”

Q: “And if you don’t see that, you need to be very concerned; right?”

Smith: “Yes.” Dr. Smith further says, “We know there’s all this heavy spacer mud stuff in the well below the blowout preventer. Likely that mixture is what’s going back up into the kill line, holding the pressure back.”

Smith adds, “We’re doing a test with a line that’s got this dense stuff in it. So, the symptoms are a successful test, but the reality is— it’s not a test at all. My opinion.”

In other words: the only reason they’ve got zero pressure showing on the line they’re relying on is that the thick spacer material has gotten in; the line is clogged.

Aft er thirty minutes of staring at zero pressure on the kill line, the team is convinced that they’ve completed a successful negative test. Never mind that the drill pipe has 1,400 psi on it. They’ve convinced themselves that this was due to something Jason Anderson was calling a “bladder effect.”

BP well site leader trainee Lee Lambert was later examined on this point.

Q: “What was Mr. Anderson saying about the bladder effect? Can you tell us?”

Lambert: “That the mud in the riser would push on the annular and transmit pressure downhole, which would in turn be seen on your drill pipe.”

Q: “Was Mr. Anderson explaining why they were seeing differential pressure on the drill pipe versus the kill line?”

Lambert: “Yes.”

Q: “Okay. And did anyone say anything or disagree with Mr. Anderson’s explanation?”

Lambert: “I don’t recall anybody disagreeing or agreeing with his explanation. At the time it did make sense to me. My lack of experience—. After learning things after the incident, it did not make sense to me, because the kill line and the drill pipe are open up to the same annulus, so in theory should see the same pressure.”

Q: “And since then have you had an opportunity to study this so-called ‘bladder effect’?”

Lambert: “I have not found any studies on the bladder effect.”

In September 2010, BP’s internal investigation concluded: “According to witness accounts, the toolpusher proposed that the pressure on the drill pipe was caused by a phenomenon referred to as ‘annular compression’ or ‘bladder effect.’ The toolpusher and driller stated that they had previously observed this phenomenon. After discussing this concept, the rig crew and the well site leaders accepted the explanation. The investigative team could find no evidence that this pressure effect exists.”

After the negative pressure test, Vidrine tells Bob Kaluza, “Go call the office. Tell them we’re going to displace the well.” They’re about to remove their fluid and replace it with seawater. Poised on a mountaintop, over an oil volcano, they’re about to release the brake.

They’re in a bit of a hurry. But what about the cement job; had it cured correctly already? The negative test helped convince them that it had. But that was only because the kill line was clogged and they chose to explain away the pressure they were seeing on the drill pipe.

The industry standard for judging the success of cement work, to best try to ascertain whether the cement is bonding to everything properly, is called a “cement bond log test.” Halliburton, which did the cement job, will later tell a Senate committee that a cement bond log test is “the only test that can really determine the actual effectiveness of the bond between the cement sheets, the formation and the casing itself.”

Of course, because Halliburton did the cement job, its people would like to blame BP for not using the definitive test. They don’t want anyone focusing on their cement itself.

Using sonic tools, a cement bond log test makes 360-degree representations of the well and can show where the cement isn’t adhering fully to the casing and where there may be paths for gas or oil to get in. In reality, even a cement bond log test is not perfect. But it is the best test going.

Perhaps the most skilled people to do a cement bond log test work for the rig-servicing company Schlumberger. They’re on the rig on the morning of April 20, ready to get to work.

BP decides instead to just rely on the pressure tests and other indicators that say that all’s well with the well. BP tells the Schlumberger workers that their services won’t be needed after all, and arranges for them to leave.

John Guide explains: “Everyone involved on the rig site was completely satisfied with the job. You had full returns running the casing, full returns cementing the casing. Saw lift pressure, bumped the plug, floats were holding. So really all the indicators you could possibly get. So it was outlined ahead of time in the decision tree that we would not run a bond long if we saw these indicators. So the decision was made to send the Schlumberger people home.”

As the Schlumberger folks board a helicopter and lift off the rig, oil and gas are already trying to get into the well, pushing hard on the cement. At 11:00 A.M., as the helicopter flies out of sight, eleven men on the rig have eleven hours left to live.

The main critical error was in not recognizing that the drill pipe pressure they were reading during the pressure test indicated that gas was already getting in—and, therefore, that the cement job had failed.

Why did it fail? People will speculate for months. Some will suggest that the cement was not allowed to set adequately before BP began altering the well pressure during the positive and negative pressure tests. Others will see that as irrelevant. Even the time required for the cement to harden at the pressure and temperature deep in the well will be subject to controversy.

Not until September and October did some of the most important pieces of this puzzle start to fit into a clearer glimpse of what happened.

First, as promised, let’s revisit the centralizers. In late September 2010, when the relief well finally intersects the original well, it will find no oil outside the casing above the oil-bearing zone in the rock. This will confirm that the oil and gas flowed first out of the sand, then down more than 80 feet outside the casing, then into the well casing and up through 189 feet of “shoe track” cement within the casing. This entire 270-foot run—down outside, then up inside the casing— was supposed to be filled with cement. It’s astonishing that the cement in the casing failed. The inner cement was designed to be a solid seven-inch-diameter, 189-foot-long plug.

Though Halliburton had recommended twenty-one centralizers to help ensure a good cement job, BP used only six. But the other fifteen would have been placed above the zone bearing the oil and gas. Above that hydrocarbon zone where the other fifteen centralizers would have gone, the engineers poured 791 feet of cement into the gap between the casing and the well wall. That upper cement, above the oil and gas, remained sound. Cement failed in and below the main hydrocarbon zone. The part of the cement job that failed was where the centralizers were, and in the reach below them, and inside the casing. The flow of gas and oil was not up outside the casing but out of the sand, then down to the bottom of the well, then up inside the casing—despite the cement there—and then out to the surface.

This seems to acquit the centralizers. So, was there something wrong with the cement formulation itself?

In its September 8, 2010, investigative report, BP will blame the cement. They’ll offer several reasons why the cement could have failed: contamination with drilling or spacer fluids, contamination among the three cement parts, or “nitrogen breakout,” in which the nitrogen breaks out of the foam and forms big gas pockets.

BP will have a third party make cement samples designed to resemble Halliburton’s and test them in a lab. (They could not get cement samples from Halliburton because those are impounded as legal evidence.)

BP’s report will claim that Halliburton’s foamed cement would have broken down in the well. BP will say Halliburton used a mixture containing 55 to 60 percent nitrogen, and that lab results indicate that “it was not possible to generate a stable nitrified foam cement slurry with greater than 50% nitrogen by volume at the 1,000 psi injection pressure.” The investigation team will conclude that “the nitrifi ed foam cement slurry used in the Macondo well probably experienced nitrogen breakout, nitrogen migration and incorrect cement density. This would explain the failure. . . .  Nitrogen breakout and migration would have also contaminated the shoe track cement and may have caused the shoe track cement barrier to fail.”

Of course, BP’s investigation is suspect of pro-BP bias. But even if the BP report is self-serving and finger-pointing, this we do know: the cement did fail.

Just before Halloween 2010, the president’s Oil Spill Commission will make its own explosive announcement: Halliburton officials knew weeks before the fatal explosion that its cement formulation had failed multiple tests—but they used the cement anyway.

On March 8, 2010, Halliburton e-mailed results of one failed test to BP, but sent only the numbers; there’s no evidence that Halliburton specified that the numbers indicated failed testing. BP had overlooked Transocean’s warning of “severe gas flow,” and might also have not understood it had been given information predicting that the cement would fail.

Halliburton altered the testing parameters, but the cement failed several tests. Finally, just days before the blowout, one last test indicated that the cement would remain stable. But Halliburton may not even have received the results of that final test before pouring the cement on April 19. BP definitely did not get notified that one of the formulations tested successfully. In other words, when Halliburton pumped cement into the BP well, both companies apparently possessed lab results indicating that what they were doing was unsafe.

After the blowout, Halliburton will refuse to give its exact cement formulation to BP for independent testing for its September report. But in coming weeks the president’s Oil Spill Commission’s chief counsel, Fred H. Bartlit Jr., will persuade Halliburton to hand over its cement formulation by reminding its officials that anything they withhold from federal investigators will enlarge the Justice Department’s billowing civil and criminal charges. He’ll then ask Chevron to create a batch and test the mixture under various conditions. In all nine tests, the cement formulation will prove unstable. The unstable cement solidifies into a firm indictment of Halliburton and BP liability.

At the stupendous pressures acting upon the oil and gas in the surrounding strata, even small cracks in the cement are enough to allow the flow rates that would send 60,000 barrels of oil a day out of the well.

Something called a “float collar” enters the discussion. These flapping one-way valves were situated far down the well casing. Rig workers had a hard time getting them to close. They may not have sealed properly, and the fact that the oil and gas shot up the well casing indicates that the float collar’s valves also failed.

Having mistakenly concluded that no hydrocarbons are coming into the well, the workers declare success at 7:55 p.m. on April 20.

At 8:02 they begin displacing all the remaining heavy fluids with seawater. This will take over an hour. They know they’re near completion when the spacer comes back up to the surface.

Returning fluids are usually directed into “pits” on the rig. This time, when the spacer reaches the surface, the crew directs the material directly overboard. This was their way, remember, of avoiding the requirement to bring it ashore and dispose of it as hazardous waste. While the material is being dumped overboard, certain flow meters, or “mudloggers,” are bypassed. In fact, they may have also been bypassed for much of the day as valuable returning drilling fluids were directed onto a waiting ship, before the spacer was just dumped directly overboard.

BP’s September investigation will conclude: “The investigation team did not find evidence that the pits were configured to allow monitoring while displacing the well to seawater. Furthermore, the investigation team did not find evidence that either the Transocean rig crew or the Sperry-Sun mudloggers monitored the pits from 13:28 hours (when the offloading to the supply vessel began) to 21:10 hours (when returns were routed overboard).”

Consultant Dr. John Smith will later testify that bypassing the flow-out meter amounted to “eliminating all conventional well control monitoring methods. That’s essentially in direct violation of the Minerals Management Service rules.”

There’s another major wrinkle. Typical spacers are 180 to 200 barrels in volume, an amount that can be pumped out in fifteen to twenty minutes. But because the crew was trying to get rid of all the unused kill-pill material and bypass the solid-waste requirements by using unwanted material, this spacer was over 400 barrels. That meant that the rig crew had to spend an extra fifteen to twenty minutes or so pumping it overboard.

This extra fifteen minutes occurred between 9:15 and 9:30. Had any crewmates been monitoring the flow through the meters, they would have seen some very irregular pressure and flow readings. Those fifteen minutes, fifteen crucial minutes of not monitoring the volume of their fluids, ended at 9:30 P.M., when they so clearly should have realized they had a problem. Those fifteen minutes could have saved the rig.

Halliburton’s cement. M-I Swaco’s spacer. Transocean and BP’s misinterpretation of the negative pressure test. BP’s push to replace all the heavy fluid with seawater. An observation comes to me via this e-mail from a friend: “My ex-brother-in-law was up for the weekend. He was a mud engineer on rigs all over the world, offshore and on. He says there are no excuses, the company man’s supposed to be in charge of everything. One thing he was very insistent on is that there’s no such noun as ‘drill’ on the rig. You can have drill bit, drill string, drill pipe, but a drill is what you use to find the lifeboats.”

Now the crew is bypassing their monitors as their excess spacer is being dumped overboard.

They’d slowed the pumps at approximately 8:50 P.M. in anticipation of the returning spacer. Slowing meant they should have seen reduced flow coming out, but the flow out actually increased. This was another indication that pressurized oil and gas were entering the well.

Starting at approximately 9:01 P.M., without a change in pump rate, the drill pipe pressure increased from 1,250 psi to 1,350 psi. Another indicator. The pressure should have decreased at this time, not increased, because they were replacing fluid weighing 14.17 pounds per gallon with 8.6-pounds-per-gallon seawater. This increase should have gotten the rig crew’s attention.

Over the ten-minute period from 8:58 to 9:08, they gained 39 barrels of fluid, the result of upward pressure in the well.

BP’s September report will note: “No apparent well control actions were taken until hydrocarbons were in the riser.” In other words, gas had already gotten past the blowout preventer and was rushing the final mile to the surface.

Now the rig crew begins sending returning fluids into a mud-gas separator with limited capacity. They may have thought this was just a “kick,” a belch.

In fact, an enormous volume of methane was streaming into the well, shooting upward from miles below, expanding as the surrounding pressure lessened, pushing out the fluid above it, gathering itself into an accelerating blowout. In an awful irony, this would have been the time to send all the returning material overboard.

BP’s report says that they’d gained 1,000 barrels of liquid volume before anyone tried to activate the blowout preventer. The report adds, “Actions taken prior to the explosion suggest the rig crew was not sufficiently prepared to manage an escalating well control situation.”

The gas quickly overwhelms the separator’s capacity and mud begins flowing onto the rig floor.

The blowout preventer is attached to the wellhead at the seafloor and to the riser pipe that connects to the rig at the surface. Its many components are often used during routine operations like pressure testing, sealing around drill pipe, and pressure control in the well. It doesn’t just sit there unless there’s an emergency. And it is tested routinely. It was tested just a few days before the explosion.

The blowout preventer is controlled from the rig through two cables connected to two redundant control “pods”—blue and yellow— and with a hydraulic line. Remotely operated vehicles can also control the blowout preventer by directly operating the pods.

The BP investigation team will conclude that, if the blowout pre-venter had been closed at any time prior to 9:38 P.M., the flow of hydrocarbons to the riser and up to the surface would have been reduced or eliminated.

They missed it by four minutes.

Remember, by pumping the extra 200 barrels of spacer fluid just to save disposal costs, they’d wasted fifteen minutes.

At 9:42, the crew did try to activate the blowout preventer, tightening a gasket against the drill pipe. At first it did not seal. It does appear that the blowout preventer was sealed around the drill pipe at approximately 9:47. The part of the blowout preventer that they closed simply tightened a rubber gasket against the pipe, a chokehold. What they needed was to close the blind shear rams and sever the pipe—to chop its head off and seal the well.

It was too little. And then, it was too late.

Randy Ezell, a Transocean senior tool pusher, was asleep when his room phone rang. He recalled,

Well, I hit my little alarm clock light and, according to that alarm clock, it was ten minutes till 10:00. And the person at the other end of the line there was the assistant driller, Steve Curtis. Steve opened up by saying “We have a situation.” He said, “The well is blown out.” He said, “We have mud going to the crown.” And I said, “Well—.” I was just horrified. I said, “Do y’all have it shut in?” He said, “Jason is shutting it in now.” And he said, “Randy, we need your help.” And I’ll never forget that.

And I said, “Steve, I’ll be— I’ll be right there.”

So, I put my coveralls on; they were hanging on the hook. I put my socks on. My boots and my hard that were right across that hall in the tool pusher’s office. So, I opened my door and I remember a couple of people standing in the hallway, but I kind of had tunnel vision. I looked straight ahead and I don’t even remember who those people were.

I made it to the doorway of the tool pusher’s office when a tremendous explosion occurred. It blew me probably twenty feet against a bulkhead, against the wall in that office. And I remember then that the lights went out, power went out. I could hear everything deathly calm. My next recollection was that I had a lot of debris on top of me. I tried two different times to get up, but whatever it was it was a substantial weight. The third time something like adrenaline had kicked in and I told myself, “Either you get up or you’re going to lay here and die.” My right leg was hung on something; I don’t know what. But I pulled it as hard as I could and it came free. I attempted to stand up. That was the wrong thing to do ’cause I immediately stuck my head into smoke. And with the training that we’ve all had on the rig I knew to stay low. So, I dropped back down. I got on my hands and knees and for a few moments I was totally disoriented on which way the doorway was. And I remember just sitting there and just trying to think “Which way is it?”

Now there was mud shooting out the top of the rig and the loud and continuous whoosh of surging gas. More explosions followed, igniting a high-intensity hydrocarbon fire fueled by incoming gas and oil.

Up until the explosions, the crew had two different ways to activate the shear rams that could cut the pipe and seal the well. They did not activate them. Then the explosions damaged the control cables and hydraulic line to the blowout preventer, costing the rig crew the ability to control the blowout preventer.

The loss of connections should have triggered the blowout preventer’s automatic emergency mode—and closed the blind shear rams. However, the yellow pod had a defective solenoid and the blue pod’s batteries were weak, so the blind shear rams did not activate.

Sensors for fire, gas, and toxic fumes were working; any irregularities appeared on a screen. But their audio alarms were inhibited. This is understandable, but many rigs don’t allow it. The Deepwater Horizon had hundreds of individual fire and gas alarms. Having the general alarm go off for local minor problems would cost workers sleep, a safety concern. And people would start ignoring alarms—also a safety concern. The idea was: have a person monitoring the computer, and let them control the general audio alarm. Sound it only when conditions require.

But chief electrician Mike Williams has asserted that inhibiting alarms also prevents the computer from activating emergency shutdown of air vents and power. Such a shutdown could have prevented the rig’s diesel generator engines from inhaling the gas and surging wildly.

The over-revving engines send surges of electricity that make lights and computer monitors begin exploding. The engines spark, igniting the gas, triggering explosions.

Transocean’s chief mechanic, Doug Brown, knew there was a manual engine shutdown system. He also understood that he was not authorized to activate it. He later said, “If I would have shut down those engines, it could have stopped as an ignition source.”

******

Mike Williams hears loud hissing. Hears the engines revving. See s his light bulbs getting “brighter and brighter and brighter,” knows “something bad is getting ready to happen,” hears “this awful whoosh.”

He reaches for a door that’s three inches thick, steel, fire-rated, supported by six stainless steel hinges. An explosion blows the door from those hinges, throwing him across the shop. When he comes around, he’s up against a wall with the door on top of him. He thinks, “This is it. I’m gonna die right here.”

When he crawls across the floor to the next door, it too explodes, taking him thirty -five feet backward, smacking him up against another wall. He gets angry at the doors; he feels “mad that these fire doors that are supposed to protect me are hurting me.” He crawls through an opening. He thinks, “I’ve accomplished what I set out to accomplish. I made it outside. I may die out here, but I can breathe.”

Williams can’t see. Something’s pouring into his eyes. “I didn’t know if it was blood. I didn’t know if it was brains. I didn’t know if it was flesh. I just knew I was in trouble.”

There’s a gash in his forehead. He’s on one of the rig’s lifeboat decks. He’s got two functioning lifeboats, right there. But he thinks, “I can’t board them. I have responsibilities.”

He hears alarms, radio chatter, “Mayday! Mayday!” Calls of lost power. Calls of fire. Calls of man overboard. People jumping from the rig.

Transocean’s subsea supervisor Chris Pleasant wants the rig’s master, Captain Curt Kuchta, to activate the emergency disconnect system, or EDS. With the blowout preventer unresponsive, the last-ditch response is: disconnect the rig from the pipe that is delivering the gas that’s feeding the fire. Kuchta replies, “Calm down! We’re not EDSing.” Jimmy Harrell, Transocean’s man in charge of all drilling operations, has just had his quarters destroyed in explosions while he was in the shower; he now comes running, partially clothed, partially blinded by fine insulation debris. He tells Chris Pleasant to activate the emergency disconnect system. Pleasant tries it. All attempts to disconnect the pipe fail. Having survived the explosions and freed himself from entrapment in debris, Randy Ezell is trying to get his bearings from where he sits, stunned. “Then I felt something and it felt like air,” he later recalled. He says to himself, “Well, that’s got to be the hallway. So, that’s the direction I need to go. That leads out.” Crawling over debris, he makes it to the doorway. But then he realizes, “What I thought was air was actually methane and I could feel, like, droplets; it was moist on the side of my face. So he continues crawling down the dark hallway. Suddenly he puts his hand on a body. He hears a groan. In the dark, Ezell can’t see who it is. (It’s Wyman Wheeler.) Next, he sees a wavering beam of light. Someone is coming down the hallway, their light going up and down as they duck debris hanging from the ceiling and make their way around jutting walls and over a buckled floor. As the approaching person rounds the corner, Ezell recognizes Stan Carden. While they are pulling debris off of Wyman Wheeler, another fl ash-light arrives, wielded by Chad Murray. Ezell and Carden ask Murray to find a stretcher while they continue removing debris from Wheeler. Thinking it might be quicker to try to help Wheeler walk out, Ezell helps him to his feet, but, after just a couple of steps with his arm around Ezell’s shoulder Wheeler, overcome by pain, says, “Set me down. Set me down.” So, Ezell lets him back down. Wheeler says, “Y’all go on. Save yourself.” To which Ezell replies, “No, we’re not going to leave you.”

Suddenly Ezell hears another voice saying, “God help me. Somebody please help me.” He looks. Where their maintenance office had been, all he sees is a pile of wreckage over a pair of feet. Removing that debris requires the efforts of all three: Ezell, Carden, and Murray. When they get the debris off, they realize it’s Buddy Trahan, one of Transocean’s visiting dignitaries. Trahan’s injuries are worse than Wheeler’s, so he gets the first stretcher.

Stan Carden and Chad Murray convey Trahan all the way to the lifeboat station. Ezell stays back. “I stayed right there with Wyman Wheeler because I told him I wasn’t going to leave him, and I didn’t,” he recalled later. “And it seemed like an eternity, but it was only a couple of minutes before they came back with the second stretcher.”

Carrying Wheeler outside of the living quarters, Ezell notices that the main lifeboats are gone. Then he notices a few people starting to deploy a raft . The men carrying Wheeler continue down the walkway to the raft and set the stretcher down. “And after several minutes,” Ezell will recall, “we had everything deployed and got in the life raft. But the main thing is, Wyman was there, you know—he didn’t get left behind.”

But unbeknownst to those in the boats, others are left behind.

Mike Williams, who minutes earlier could have had both now-departed lifeboats to himself, watches eight other survivors drop an inflatable raft from a crane.

In weekly lifeboat drills they’d practiced accounting for everyone. There is no longer such a thing as “everyone.”

Now left watching are Williams, another man, and twenty -three year-old Andrea Fleytas. Williams experiences several more blasts that he’ll later describe as “Take-your-breath-away explosions. Shake-your-body-to-the-core explosions. Take-your-vision-away explosions.”

Fire spreads from the derrick to the deck itself.

Williams sees in Andrea’s eyes that she seems resigned to death. He says, “It’s okay to be scared. I’m scared, too.” She says, “What are we gonna do?” Williams outlines the choice: Burn up or jump down.

From where they are, it’s ten stories to a black ocean. Bloodied, backlit by raging fire, Williams takes three steps and jumps feet-fi rst. “And I fell for what seemed like forever,” he later recalled. He thinks of his wife, their little girl. “A lotta things go through your mind.”

Love conquers all. But only sometimes.

He crashes into the sea and the momentum takes him way, way beneath the surface. He pops up thinking, “Okay, I’ve made it.” But he feels like he’s burning all over. He’s thinking, “Am I on fire?” He just doesn’t know.

He realizes he’s floating in oil and grease and diesel fuel. The smell and the feel of it. He sees that the oil that has become the sea’s surface beneath the rig is already on fire.

Says to himself, “What have you done? You were dry, and you weren’t covered in oil up there; now you’ve jumped and you’ve landed in oil. The fire’s gonna come across the water, and you’re gonna burn up.” He thinks, “Swim harder!” Stroke, kick, stroke, kick, stroke, kick, stroke, kick. As hard as he can until he realizes: he feels no more pain. He thinks, “Well, I must have burned up, ’cause I don’t fee l anything, I don’t hear anything, I don’t smell anything. I must be dead.”

He hears a faint voice calling, and next thing, a hand grabs his lifejacket and flips him over into a boat. Then the boat finds one more survivor. Andrea.

A ship that had been tending the rig, the Banks ton, retrieves those in lifeboats. Not aboard the Banks ton: Jason Anderson, of Midfield, Texas, thirty -five, father of two, tool pusher, the supervisor on the floor at the time of the accident who’d worried aloud to his wife and dad about safety on the rig and who’d spoken of the “bladder effect” causing the pressure discrepancies they were seeing; Aaron Dale Burkeen, thirty-seven, of Philadelphia, Mississippi, father of a fourteenyear-old daughter, Aryn, and a six-year-old son, Timothy; Donald Clark, forty-nine, an oil industry veteran married to Sheila, living in Newellton, Louisiana; Steven Ray Curtis, thirty-nine, the driller who’d named this the “well from hell”; Roy Wyatt Kemp, twenty seven years old, who lived in Jonesville, Louisiana, with his wife, Courtney; Karl Kleppinger Jr., thirty-eight, of Natchez, Mississippi, Army veteran of Operation Desert Storm, leaving behind a wife and son; Keith Blair Manuel, fifty-six, father of three daughters, avid supporter of Louisiana State University sports teams, and engaged to be married to his longtime love, Melinda; Dewey Revett e, forty-eight, of State Line, Mississippi, having been with Transocean for twenty-nine years, and leaving a wife and two daughters; Shane Roshto, just twenty -two, of Liberty, Mississippi, husband to Natalie and already father to three year-old son Blaine Michael; Adam Weise, twenty-four, of Yorktown, Texas, a former high school football star who loved the outdoors; Gordon Jones, twenty-eight, of Baton Rouge. A few days after Gordon died, his widow, Michelle, gave birth to their second son.

Mike Williams says, “All the things that they told us could never happen, happened.”

For two days, a fireball. So hot it appears to be melting some of the rig. Which finally sinks.

Accusations: BP’s own report will later say, “A complex and interlinked series of mechanical failures, human judgments, engineering design, operational implementation and team interfaces came together to allow the initiation and escalation of the accident. Multiple companies, work teams and circumstances were involved.” BP’s recap: The cements failed to prevent the oil and gas from entering the well. Staff of both Transocean and BP incorrectly interpreted the negative pressure test by tragically explaining away the pressure they were seeing on one gauge. This led them to release the downward fluid pressure on the well by replacing the heavier fluid with seawater in a well that they falsely believed—because the kill line was clogged with the “snotty” spacer—was not exerting upward pressure. It was. The pressure in the drill pipe, which they chose to ignore, was telling them that the cement had failed. They didn’t notice other warning signs because they bypassed gauges and routed displacement fluid and their irregularly concocted spacer overboard. But as gas reached the rig, when the crew might have prevented disaster, they routed the flow to a mud-gas separator whose capacity was soon overwhelmed. Gas flowing directly onto the rig got sucked into generators, causing them to surge and spark, igniting a series of explosions. Fire and gas emergency systems that should have prevented those explosions failed. The blowout pre-venter should have automatically sealed the well but it, too, failed.

Unlike a tanker running aground and spilling oil—a simple cause-and-effect accident—this is a chain disaster. Each of the distinct failures of equipment and judgment, combined, was required to cause the event. And if any single component had not failed, or had been handled differently, this blowout never would have happened. And we’re not done yet, because a failure of preparedness to deal with a deepwater blowout will cost many pounds of cure over the coming months.