S c i e n t i s t s '

Nightstand

The Scientists' Nightstand,American Scientist's bookssection, offers reviews, reviewessays, brief excerpts, and more.For additional books coverage,please see our Science Cultureblog channel, which exploreshozu science intersects with otherareas of knowledge, entertainment, and society:americanscientist.org/blog/scienceculture.

ALSO IN THIS ISSUE

THROUGH THE SHADOW-LANDS: A Science Writer's Odyssey into an Illness That ScienceDoesn't Understand.By lulie Rehmeyer.page 186

O N L I N EON TRAILS: An Exploration.By Robert Moor.Review: bit.ly/2oR0AkC

With her illness in remission, authorJulie Rehmeyer and her husband,John, dance at their 2013 wedding.

Over the EdgeDEEPWATER HORIZON: A SystemsAnalysis of the Macondo Disaster. EarlBoebert and James M. Blossom. 290 pp.Harvard University Press, 2016. $39.95.

A book about a disaster necessarily belongs to the genre oftragedy. You read the story al

ready knowing that it will end withloss and carnage. But in a technologicaldisaster, unlike a Greek play, the actorsare not mere helpless playthings of thegods. They make their own fate, andthe forces driving them onward to ruinare very human foibles: haste, inattention, overconfidence, wishful thinking.

In Deepzuater Horizon, engineers EarlBoebert, retired from Sandia NationalLaboratories, and James M. Blossom,whose career has included 20 years atLos Alamos National Laboratory, reexamine one of the most horrifying technological disasters of recent memory:the blowout of an oil well in the Gulfof Mexico that destroyed a drilling rig,killed 11 crew members, and led to thelargest marine oil spill in U.S. history.

Transocean, which controls a fleet ofmobile offshore rigs, owned the drilling vessel Deepzuater Horizon and operated it under contract to the petroleumproducer BP. In April 2010 the rig wascompleting work on the Macondo wellin the Gulf of Mexico, 40 miles southeastof New Orleans, Louisiana. It floatedin mile-deep water, connected to thewellhead on the sea floor by a long tubecalled a riser. The well itself extendedanother two miles into the sedimentaryrocks beneath the Gulf, reaching layersof oil and gas at a total depth of morethan 18,000 feet below sea level.

On the night of April 20, the crew waspreparing to disengage from the welland move on to their next assignment.They had poured a cement plug into thebottom of the well to seal off the hydrocarbon layers. This plug was meant tobe drilled out by a different rig when thewell was eventually reopened for pro

duction. Until then, the cement wouldhave to resist the tremendous pressureof the surrounding fluids—roughly13,000 pounds per square inch.

Before placing a cap on the well andleaving the site, the Deepzuater Horizonwas required to test the integrity of thecement plug. The essence of the procedure was to open a valve in a pipeconnected to the riser and make sure nofluid was driven up the drill pipe by oiland gas leaking in at the bottom of thewell. When the crew conducted the test,its result was unclear. They repeated it,but the outcome of the second test wasalso uncertain. After extended discussion, the crew decided there must besome benign explanation for the fluctuating flows and pressures they were observing. They continued on to the finalsteps in the well-capping procedure. Atthis point the chorus in the Greek tragedy would begin their keening.

Less than an hour later, fluids began spurring out of the riser pipe ontothe drilling floor, in the middle of therig's main deck. Soon a geyser of sea-water and mud reached the crown ofthe drilling derrick, 250 feet above thewater's surface. The last line of defensewas the blowout preventer, a towering400-ton stack of valves, hydraulic rams,and other devices mounted atop thewellhead a mile below the rig. Crewmembers activated controls to shut offthe flow at the blowout preventer andto detach the riser so that the platformcould move away, but the commandshad no effect. (The reason for that failure remains a subject of contention.)

In a few minutes the oil and gasreached the water's surface, and theDeepzuater Horizon was engulfed inflames. Considering the scale of thecataclysm, it's remarkable there wereno more than 11 deaths; 115 people escaped the explosions and fire and wererescued after leaping into the sea. Therig burned for 36 hours before sinking.

If this were the end of the story, itwould be an industrial accident of thefirst magnitude. But indeed, the sinkingwas not the end of the story. The dam-

182 American Scientist, Volume 105 rv\<v/_Tu*e %0\y

aged wellhead continued to spew petroleum into the sea, thwarting severalattempts to contain or control the spill.By the time the well was finally sealedthree months later, more than 200 million gallons had escaped, becoming thelargest oil spill in U.S. history.

The tale of the Deepzuater Horizon hasbeen told many times in the seven yearssince the accident. The companies involved released the results of their owninternal investigations, and official reports came from the Coast Guard, theDepartment of the Interior (which regulates oil-drilling activities), and a specialpresidential commission. Also availableare the transcript of a federal trial, atleast six earlier books, and a movie starring Mark Wahlberg. All of these documents attempt, in one way or another, totell us what went wrong. So what's leftto say in this new account?

Boebert and Blossom promise a scholarly rather than a judicial approach:"The judicial mindset concentrates onthe accident that was, in support of assigning blame; the scholarly mindsetconsiders both the accident that wasand the accidents that might have been,seeking all factors with the potential tocombine into a disaster." Their telling ofthe story features neither heroes nor villains. Their focus is first on the technicalchallenges that need to be overcome tosafely drill an offshore well, and secondon organizational factors—the planningprocess, decision making, patterns ofcommunication, and adherence to established procedures.

The technical challenges mainly haveto do with "well control." To an outsider, it's not obvious that a well is something that needs to be controlled. Afterall, isn't it just a hole in the ground?But imagine drilling a hole into the fueltank of an automobile: How do youmake the hole without letting any ofthe liquid or vapor leak out? Drilling awell deep into the Earth poses a similarproblem, but with the added difficultythat the oil and gas are under high pressure. They don't merely dribble out butare expelled with great force.

While a well is under construction,the key to controlling it lies in a substance called drilling mud, a soupy fluidthat is pumped down the hollow drillpipe and back up the annular space between the drill pipe and the steel casingthat lines the hole. The mud's weightkeeps the flammable hydrocarbonssafely confined, but the balance is delicate. The "push" from the mud must

Derrick

Riser

BlowoutPreventer

14.1 ppgmud from

rig tobottom of

well

Drilling Floor

Semi-SubmersibleMobile Drilling

Unit

Seafloor

14.1 ppgMud in

Annulus toTop of Well

14.1 ppg Mudfrom Cement

Plug to Bottomof Well

TemporaryAbandonment with"Production Tall"

Lockdown Sleeveand Metal Cap

.6 ppg Seawaterto Cement Plug

Cement PlugSet at 8367 ft

Below SeaLevel

9 7/8" x 7" TaperedProduction Casingwith Hangar at Top

7" End ofProduction Casing

Cemented intoBottom of Well

The procedure for closing the Macondo well in the Gulf of Mexico was nearly complete in April2010 when a blowout destroyed the Deepzuater Horizon drilling vessel and led to the largestmarine oil spill in U.S. history. The vessel, floating at the sea surface, was connected to the wellthrough a mile-long riser pipe and a blowout preventer mounted on the sea floor. The well itself,extending another two miles into the sedimentary rocks of the gulf, was not just a hole in theground; it was a complex assembly of telescoping steel tubes. The diagram at right shows the planfor temporarily capping the well with two cement plugs and a steel lockdown sleeve. Oil and gaserupted through the riser pipe before that work could be completed. The diagrams are not to scaleand greatly exaggerate the width of the well bore. From Deepzuater Horizon.

be matched to the "shove" from thehydrocarbons. If the mud is too light,it will not hold back the oil and gas. Ifit is too dense, the excessive pressure atthe bottom of the hole will fracture thesurrounding rock, allowing the mud toleak out of the well; then, without theprotective column of mud, the oil andgas can infiltrate the well.

Most of us have little experience dealing with such unstable systems, andeven less familiarity with circumstancesin which a miscalculation can lead tomultiple deaths and a major environmental catastrophe. In a metaphor thatrecurs throughout the book, Boebert andBlossom convey the intense complexitiesof living and working near "The Edge,"where the slightest misstep can take youover the precipice. In this dangerousenvironment, they assert, drillers musthave "the ability to draw conclusionsfrom incomplete and conflicting information and ... the moral fiber to act."

The authors argue that the Deepzuater Horizon disaster was a failure of

well control. Other tellings emphasizeother failures—such as that of the cement plug at the bottom of the well ormat of the blowout preventer. It's truethat those components did fail, but theprocedures of well control—developedthrough more than a century of drillingexperience—are intended to cope withjust such untoward events. The breach ofthe cement seal was not a sudden failurein the moments before the well erupted in flames; multiple signs of troublehad appeared hours earlier, but thosein charge of the project (both on the rigand on land) either didn't recognize thesigns or chose not to act on them.

The most obvious warnings were thetwo integrity tests that gave puzzlingresults, but there were other missedsignals as well. One of the simplest andmost reliable ways of monitoring thestatus of a well is to keep an eye on the"mud pits," which hold a reserve ofdrilling mud. When the well is in equilibrium, the amount of mud pumpeddown the hole equals the amount

For more on the Deepwater Horizon disaster, see our explainer: bit.ly/2nZuPrL. 2017 May-June 183

Cement Unit

CheckPressureAnd/Or

Check forFlow on

Drill Pipe

Annular —PreventerClosed,Isolating

Mud in Riser

8367 ft

Kill LineProvides

Alternate PathFor Test; Can

be Isolated byLower Valve

A negative pressure test on the Macondo well was meant to verify the integrity of acement plug poured into the bottom of the well. During drilling operations, the well isfilled with heavy mud whose weight balances the pressure of the hydrocarbons in the"pay zone." During the test, mud in the drill pipe extending from the sea floor down toa depth of 8,367 feet was replaced with seawater, which is much lighter than the mud.The well was then in an unbalanced state, with only the cement seal at the bottom toprevent oil and gas from pushing their way into the well and up to the surface. The crewon the drilling rig monitored the well for half an hour, watching for a rise in pressure orfor flow out of the drill pipe, either of which would indicate infiltration of high-pressurehydrocarbons. The results of two such tests were inconclusive, but the crew and theirsupervisors ashore fatefully decided to proceed anyway. From Deepzuater Horizon.

HydrostaticHead Using

Drill PipeEquals Head

Down to UpperCement PlugAfter Riser is

Pulled

Cement In andAround Production

Casing IsolatingPay Zone

returning to the surface, and the levelin the pits remains steady. A rising orfalling level is a sign of trouble. Unfortunately, the crew of Deepzuater Horizonwas deprived of this intelligence: During certain critical operations, mud wasbeing transferred to a supply ship inpreparation for moving on to the nextwell. Changes in mud level caused bythe transfers obscured any signals frommud moving up or down the riser.

It's easy to fasten onto these particular events (or others like them) as keymissed opportunities. If only BP hadmonitored the mud pits, the conflagration might have been averted. If onlythey had run a third test. If only theyhad chosen a different kind of cementor replaced the batteries in the blowout preventer. Yet Boebert and Blossomtake a dim view of this if-only reasoning. Yes, some of those actions mighthave saved the rig on April 20, butthe next accident could be triggeredby a quite different series of mistakes.

The authors argue for broaderchanges—for a more cautiousand conscientious approach tothe management of risk.

According to the authors,safety-critical operations inthe last stages of the Macondoproject were carried out withonly vague and informal planning. For example, no detailedprocedure was ever establishedfor the cement-integrity test,nor a specific criterion to define success and failure. Suchprocedures must be customdesigned for the specific well,a task that would generally beundertaken by an experiencedmember of the drilling crew inconsultation with experts onshore. At the Macondo well, theplan was assembled in haste byjunior personnel. Complicat-ing matters, communicationamong various groups working on the rig was sporadic andunreliable. The person respon

sible for monitoring mud levels wasnot told when transfers to the supplyship started and stopped; as a result hecould not correctly interpret what hewas seeing. Supervision from BP's officein Houston, Texas, was inadequate; onlytwo professionals were assigned to thewell, and they had been on the job onlya few months. (The authors note thatanother oil company, Shell, assigns 15 to20 professionals to each well.)

Furthermore, all those working tofinish the Macondo project were conscious of a ticking clock. BP risked losing its drilling rights in another regionof the Gulf if it did not move the Deepzuater Horizon to a new well site withinabout three weeks. BP managers denythat they pressured the crew to hurryor take risks, but Boebert and Blossom find that disclaimer inadequate:"What was required for survival wasexplicit pressure on the crew membersto slow down, determine how closethey were to The Edge, and take steps

to move away from it—pressure thatnever came."

Many tellings of the Deepzuater Horizon story point out a painful irony: Onthe day of the disaster, four executivesfrom Transocean and BP were visitingthe rig to celebrate seven years withouta loss-of-worktime accident. That's acommendable achievement, one thatbetokens a serious commitment to personal safety—always wearing a hardhat and steel-toed shoes, for example.The events of that night suggest a neglect of process safety—making sure theentire rig doesn't burn and sink. Boebert and Blossom put it this way:

Promoting a "safety culture" ofmethodical wariness is insufficient unless that culture is backedup by an "engineering culture"that includes methodical decisionmaking, contextual review, andmanagement of change. . . . lustas important, a corporation mustaccept that an engineering cultureimposes inefficiency in two ways:directly, because of the time employees must devote to those vital efforts, and indirectly, becauseensuring that employees at everylevel take pains with safety-criticaldecisions slows down other activities. Macondo teaches that those inan oil company who are responsible for allocating resources mightsave thousands or even millions ofdollars by forgoing such activitiesbut spend multiple billions on theother side of The Edge.

Beyond safety culture and engineering culture, mere is another level of riskmanagement that Boebert and Blossomdo not discuss. Through its government,a society can collectively decide whatrisks are worth taking, and how close toThe Edge we choose to live. The Deep-water Horizon accident had fearful consequences: the 11 lives lost, the environmental damage, the economic penaltiespaid by Gulf Coast fishermen and the

184 American Scientist, Volume 105

tourist industry as well as shareholders and employees of BP and the othercompanies held liable. One possibleresponse might have been to declare amoratorium on drilling in deep watersand other high-risk environments.

Petroleum and natural gas are notin short supply. We could afford toleave those deposits in the ground fornow, and they would still be there ifwe ever needed them in the future. Butthat option was overridden by currenteconomic incentives and an abidingdistaste for government-imposed regulations. Perhaps it is not only corporations but whole societies that needto develop more methodical wariness,methodical decision making, contextu-

•al review, and management of change.Most accounts of the Deepwater Ho

rizon disaster dwell on the drama of therig's last hours, as the crew struggledto cope with the well blowout and thenfought to survive. Those events are alsopart of Boebert and Blossom's story, butthe scope of their narrative is broader.Much of the action takes place deep underground, where drilling technologymeets the uncertainties of geology, orelse miles away in BP's Houston offices.Their approach is analytic rather thandramatic. Theirs is the account for readers who want to understand how suchdisasters come about and what strategies might have the best chance of preventing more of them.Brian Hayes is senior contributing writer forAmerican Scientist. His book Foolproof, andOther Mathematical Meditations will be published by MIT Press this fall.

An IllnessObserved: AConversation withJulie RehmeyerDianne Timblin

In 2006, science journalist and mathematician Julie Rehmeyer zuas diagnosed withmyalgic encephalomyelitis, or chronic fatigue syndrome (ME/CFS). Among hersymptoms zuere bouts of partial paralysisthat regularly rendered her unable to zualk.As her condition worsened, she learnedeverything she could about the disease—including hozu little relief the medical community could offer her. She tells of her

TheUsefulnessof UselessKnowledge

Unsolved!

C R A ' ° B A U E R

UNDERSTANDINGTHE DIGITAL WORLD

BRIAN W. KERNIGHAH

mi

JOURNEYor

MAN

The Usefulness of Useless KnowledgeAbraham FlexnerWith a companion essay by Robbert Dijkgraaf

"These two eloquent essays are timely and timelesstreasures that remind us why and how the pursuit ofknowledge for its own sake has transformed humanity andhuman affairs. ... A gift to all those concerned with theworld of tomorrow."—Sean B. Carroll, author The Serengeti Rules and

Brave GeniusCloth S9.95

Unsolved!The History and Mystery of the World'sGreatest Ciphers from Ancient Egypt toOnline Secret SocietiesCraig Bauer

"Exceptional. Not only are these ciphers fascinatingindividually, but together they provide a comprehensivepicture of the different methods and types of encryption,which Bauer explains and guides readers through in turn.I thoroughly enjoyed this book."—Todd S. Sauter, National Cryptologic MuseumCloth $35.00

Understanding the Digital WorldWhat You Need to Know about Computers,the Internet, Privacy, and Security

Brian W. Kernighan

"This is the clearest and simplest explanation of the worldwe now all depend on—how it works and why it doeswhat it does—from one of our best-known inventors.Everyone on Earth needs to read it."—Eric Schmidt, executive chairman of Alphabet Inc.

and GoogleCloth S22.95 £18.95

The Journey of ManA Genetic Odyssey

Spencer WellsWith a new preface by the author

"The Journey of Man is fascinating and oozes charm. ...[It] is packed with important insights into our history andour relationships with each other. . . . Who needs literaturewhen science is this much fun?"—Chris Lavers, GuardianPaper $16.95Not for sale in the Commonwealth (except Canada) and the European Union

P R I N C E T O N U N I V E R S I T Y P R E S SSee our e-books atpress.princeton.edu

www.americanscientist.org 2017 May-June 185