A blowout preventer is a stack of valves bolted to the well head on the seabed, built to close automatically and seal a well the moment pressure surges out of control. On the Deepwater Horizon rig in the Gulf of Mexico, that stack failed to engage. Oil and gas shot up the well fast enough to ignite, and the resulting explosions killed eleven workers.

The Deepwater Horizon oil rig burning in the Gulf of Mexico in 2010, after its blowout preventer failed to seal the well.
more
Deepwater Horizon Offshore Drilling Platform on FireLicence: CC BY-SA 2.0

The rig sat over the Macondo well, roughly 5,000 feet above the seabed. The blowout preventer is the last line of defence at that depth, where nobody can reach the well head by hand. It is meant to shut off the reservoir from below before oil or gas ever reaches the surface.

What went wrong first

BP’s own report, published in September 2010, put the start of the disaster down to a “well integrity failure” followed by a loss of control of pressure in the well. The blowout preventer should have sealed the well automatically at that point. It did not.

Hydrocarbons flowed up the well at an uncontrollable rate and ignited on the rig, setting off a chain of explosions. Two days later the rig sank, and the riser pipe connecting it to the well fell to the seabed. Oil and gas kept flowing from the broken pipe and from the blowout preventer itself, producing a slick five miles long within two days.

BP’s report assigned most of the blame to Halliburton, which had cemented the well, and to Transocean, which owned and maintained the rig. Both companies rejected that account. Halliburton said BP’s report contained “a number of substantial omissions and inaccuracies” and stood by its cementing work. Transocean called the report “a self-serving attempt to conceal” what it said was BP’s own flawed well design. BP’s report also faulted Transocean’s maintenance of the blowout preventer itself, pointing to inaccurate maintenance records and a non-original part found in the device after it was recovered.

Ten attempts to close it

With the blowout preventer already open, engineers spent weeks trying to force it shut or block the well another way. A remotely operated vehicle made the first attempt, trying to trigger the blowout preventer’s valves directly on the seabed. That failed, and BP moved through nine more methods before the leak stopped.

One of those methods, the “top kill”, pumped heavy drilling mud into the blowout preventer from a vessel on the surface. A manifold of pipes connected to the device’s “choke and kill” bypass systems, giving access to its main valves. Engineers also fired a “junk shot” of rubber, golf balls and rope into the works, hoping it would help block the flow. BP announced on 29 May that the top kill had failed.

On 10 July, engineers replaced a loosely fitting cap over the blowout preventer with a tightly sealed capping stack. Five days later, with that stack in place, engineers turned off all three of its internal valves, called rams, and the flow of oil stopped for the first time since 20 April. The capping stack did the job the blowout preventer’s own valves had failed to do on the day of the explosion.

Sealing it for good

A sealed well is not the same as a dead one. Engineers spent days testing whether pressure would force oil out somewhere else in the blowout preventer or the well below it. Only once those tests passed did the next stage begin: a “static kill”, pumping drilling mud back through the blowout preventer into the well and the reservoir beneath it.

Cement followed the mud on 5 August, permanently blocking the well from within. By then, US government scientists had put the total spill at 4.9 million barrels. BP had also been drilling two relief wells since early May. Those were meant to intersect the original well and pump in enough heavy liquid to kill it, had the capping stack not held. The original well was declared permanently sealed on 19 September 2010, five months after the blowout began.

What the spill left behind

How much of that oil is still out there depends on who answers. Ed Owens, the shoreline cleanup technical adviser BP hired through the contractor Polaris, surveyed roughly 4,000 miles of coastline with his team. He found that most of the oil had stayed on the surface, with only about 10% reaching shore. By the time he spoke to the Guardian, he put the remaining heavily oiled coastline at 15 miles, with “some tens of miles” more moderately affected.

Samantha Joye, a researcher at the University of Georgia, disputed that picture. Her team found a 22-mile plume of oil and gas droplets deep in the Gulf of Mexico, reported in the peer-reviewed journal Science. They later found a coating of oil and dead marine life spread over 2,900 square miles of seabed. She told the Guardian that as much as “50% of the oil is still floating around out there”. Simon Boxall, an expert on the disaster at the National Oceanography Centre in Southampton, disagreed. He said organisations sampling the seabed had found no evidence for oil on that scale, and that Joye’s estimate rested on only a sample or two.

What is not disputed is what the blowout preventer was meant to do and did not. It sits on the well head as the point where a runaway well can still be shut off before it reaches open water, and on 20 April 2010 that point failed.