What caused the Deepwater Horizon explosion, and why didn't the blowout preventer work? The chief counsel to the President's National Commission answered that second question under oath: even a blowout preventer working perfectly would not have stopped the blowout, and eleven men would still have died. This is the record from the congressional hearings themselves - forty hours of them - on what had already been taken away before the last device was ever asked to do anything.
On the night of the twentieth of April, 2010, a column of gas came up a well in the Gulf of Mexico, about fifty miles off the coast of Louisiana, reached the drilling rig sitting above it, and ignited. Eleven men did not come home. Two days later the rig capsized and sank. Sitting on the sea floor, a mile below the surface, was the device built for exactly this moment.
A blowout preventer: a stack of steel about five storeys tall, clamped over the top of the well, with hydraulic rams inside it that are supposed to close on the pipe and seal everything below. Think of it as the shut-off valve of last resort. It did not seal the well. That is the part almost everyone remembers, and it is where most accounts of this disaster stop.
But when the President's National Commission finished its work, its chief counsel put a conclusion on the record that runs the other way. Even if the blowout preventer had functioned flawlessly, the explosion would have occurred, and eleven men would have died. If that is true, then the question is not why the last device failed. The question is what had already happened above it — and how much of it was written down before the fire.
Three companies were on that rig, and the difference between them matters for everything that follows. BP was the operator. The operator owns the lease,
designs the well, and makes the decisions about how it is drilled. Transocean owned and operated the rig itself — the world's largest offshore drilling company, working under contract to BP. And Halliburton was a service contractor, providing, among other things, the cementing: the job of pumping cement down the well to seal it. So: BP decided, Transocean drilled, Halliburton cemented.
When the committee later asked who was responsible, each of the three would point at the other two. The well was called Macondo. The water there is five thousand feet deep — close to a mile. From the sea floor, the well went down another thirteen thousand feet, two and a half more miles, to the reservoir.
When the chairman of the subcommittee put that description to Transocean's chief executive, he agreed it was accurate. To understand the pressure involved, one member of Congress laid it out in the hearing. At five thousand feet of water you are dealing with around twelve thousand pounds of pressure. Thirteen thousand feet below the ocean floor, it is far greater still.
Everything that follows is about holding that back with cement and steel. BP was paying Transocean approximately five hundred thousand dollars a day for the rig. That is the meter running in the background of every decision in this film. At the same time, BP's profits were running at approximately ninety-three million dollars a day in the first quarter of that year.
And the well was late. Asked directly whether completion of the Macondo well had been running behind schedule, BP's chief executive answered: I believe it was running behind schedule, that is correct. Inside BP, the well had a name. The company's own drilling engineer for the rig called Macondo a nightmare well.
That phrase is not a journalist's summary. It is BP's internal language, read into the congressional record. There is one more piece of context, and the subcommittee supplied it in its opening statement. This was not the first time the committee had seen this company.
BP had a history of cutting corners, the subcommittee said, apparently for the almighty dollar. In Texas City, an explosion at a BP refinery had led the company to pay fifty million dollars in criminal fines. On Alaska's North Slope — a case this same subcommittee had investigated — a corroded pipe let a million litres of oil escape. In each instance, the subcommittee said, BP had given assurances that it would not happen again, and those assurances had, regrettably, proved untrue.
That is the situation on the twentieth of April, 2010. A well that is difficult, expensive and late; an operator with a documented record of shortcuts; and a chain of barriers between two and a half miles of pressurised hydrocarbons and one hundred and twenty-six people asleep and awake on a platform above. Over the next eight weeks, every one of the decisions that removed those barriers would be described, one at a time, in public, under oath. Start with the cement.
A deep well is a set of nested steel tubes, called casing, running down inside the hole that has been drilled. Cement is pumped down and back up the gap between the steel and
the rock, so that when it hardens it grips the casing and forms a seal. If the seal is complete, nothing can travel up that gap. If the cement channels — if it runs up one side and leaves a path on the other — gas can rise around the outside of the pipe. Whether cement seals evenly depends on whether the casing is centred in the hole.
That is what centralizers do. They are metal collars fitted to the outside of the casing at intervals, holding it away from the rock wall so cement can flow all the way around. Too few, and the pipe leans against one side, and the cement goes where it is easiest, not where it is needed. Halliburton, BP's cement contractor, ran a computer model of this well.
Its model said that if BP ran the final string of casing with only six centralizers instead of the twenty-one Halliburton recommended, the well could have — in the capitals the document itself uses — a SEVERE gas flow problem. BP rejected the advice and used six. The reason is in an email written on the sixteenth of April by a BP official involved in the decision. It will take ten hours to install them.
I do not like this. Then there is the way you check the cement afterwards. There is a test for this, called a cement bond log. A tool is lowered into the well and it measures whether the cement has bonded properly to the casing, all the way around.
It is the direct answer to the question: did the seal actually work. BP chose not to run it. The crew that performs that test was already on the rig. They were sent home before performing it.
The subcommittee put the arithmetic on the record: by sending the team home, BP saved one hundred thousand dollars and nine or ten hours of work. And there is an email about the warnings themselves. After learning of the risks, and of BP's decision to ignore them, the operations drilling engineer who oversaw BP's team of drilling engineers wrote four words that the subcommittee read aloud. Who cares, it's done, end of story, will probably be fine.
There were two further decisions, and the subcommittee listed them alongside the others. Before cementing, drilling mud is normally circulated all the way around the well — pumped down and brought back up to the surface. There are two reasons. It cleans the hole so the cement can bond, and it lets the crew examine the mud coming back for traces of gas.
BP did not fully circulate. That is a barrier and a test, removed together. And BP chose not to use a casing hanger lockdown sleeve. This is a mechanical lock that pins the casing hanger down at the wellhead, so that pressure from below cannot lift the assembly.
It is extra protection against a blowout from beneath, and it was not used. There was also a choice about the shape of the well itself: whether to run a single long string of casing all the way from the reservoir to the sea floor, or a shorter liner with a separate section tied back on top of it. The long string was chosen. It was approved by the Minerals Management Service — the federal agency that regulated offshore drilling, and which returns in chapter six.
Set those out in order, because the order is the argument of this film. A cement design warned against by the contractor who designed it. The recommended centralizers reduced from twenty-one to six. The test that would have found a bad seal, skipped.
The circulation that would have revealed gas, incomplete. The mechanical lock that resists pressure from below, absent. None of that is the blowout preventer. All of it happened before anyone reached for it.
Halliburton finished cementing the well at twelve thirty-five in the morning on the twentieth of April. The cement was given time to set. Then, at around five in the afternoon,
the crew ran the test that decides whether a well is safe to leave. It is called a negative pressure test. In plain terms: a well being drilled is held down by the weight of heavy drilling mud sitting in it, the way a column of water holds down a straw. Before the rig can move off, that weight has to come out and be replaced with lighter seawater — so before you do that, you take the pressure off and see whether the well holds by itself.
Whether the cement at the bottom is actually sealing. If pressure builds when it should not, the well is not sealed, and there is something coming in. The first test was unsatisfactory and inconclusive. Significant pressure discrepancies were recorded.
So the crew ran it a second time. On the second test, fourteen hundred pounds per square inch was observed on the drill pipe. Zero was observed on the kill line and the choke line. Those are three routes into the same well, and they should have been telling the same story.
Two said nothing was happening. One said there were fourteen hundred pounds pushing back. It was recorded as a pass. The National Commission's finding on this is precise, and it does not describe an accident.
The negative pressure test, the Commission found, identified a cementing failure — but it was incorrectly judged a success, because of insufficiently rigorous test procedures and inadequate training of key personnel. Read that again in the order it happened. The test worked. The test found the problem.
The problem was then explained away, by people who had not been trained to know that they could not explain it away. When the committee reported to Congress in May, it put it in careful language: there were anomalous pressure test readings prior to the explosion, and these could have raised concerns about well control before the operation to replace the mud with seawater began. Well control is the industry's term for keeping what is in the reservoir from coming up the hole uninvited. Raising a concern about well control means stopping, and asking why.
Nobody stopped. The mud came out, the seawater went in, and the last heavy thing standing on top of that reservoir was removed on the strength of a test that had already failed. This is the point in the sequence where the film's whole argument becomes visible, so it is worth being exact about what is and is not being claimed. Nobody on that rig knew they were about to die.
The record does not show a crew that understood the danger and ignored it. It shows a test that produced a contradiction, and a set of procedures too weak to force that contradiction to be resolved. The Commission's language is about procedures and training, not about malice. But the consequence is not softened by that.
At around five in the afternoon on the twentieth of April, the last barrier that could have been checked, was checked — and the result was misread. Everything after that point is a countdown that no one on board knew had started. What happened next is documented, and it is documented in two very different registers: the flat findings of a federal commission, and the testimony of a man who was standing in it. The Commission's finding first.
There was a failure to understand that a kick was occurring —
a kick being the industry word for the moment when fluid from the reservoir starts entering the well, the first sign of a blowout — even though there were several odd and unexpected pressure readings in the hour or so leading up to the explosion that the crew should have realised signalled a problem. And there was a failure to respond appropriately once mud and gas began spewing onto the rig floor. An hour or so. That is how long the well was signalling before anybody understood what it was saying.
Gas that reaches a drilling rig does not stay outside. It is pushed up the riser — the pipe connecting the rig to the wellhead a mile below — and when it arrives, it arrives everywhere: across the deck, into the ventilation, into the engine rooms. The engines ramping up that the witness described is what happens when engines designed to burn diesel start ingesting natural gas from the air around them. They over-speed.
And a rig with power generation running out of control is a rig with hundreds of possible ignition sources. Then, the last technical fact of that night, and it is the one that carries the whole film. The chief counsel of the National Commission concluded that the crew first activated an annular preventer — the uppermost sealing element inside the blowout preventer stack — at best only moments before drilling mud erupted onto the rig floor. By that time, gaseous and liquid hydrocarbons had already passed the blowout preventer's rams and were in the riser.
Already past it. Already above it. A valve cannot close off something that has gone by. Eleven men were killed.
One hundred and fifteen people got off. Two days later, on the twenty-second of April, the rig capsized and sank to the sea floor, and oil began leaking from the wreckage. Now the device itself — and it deserves the examination, because when Congress opened it up, what they found was genuinely damning.
Take those findings one at a time. A socket that was supposed to activate a variable bore ram was wired wrong, and an entire day of work had been spent engaging rams that closed the wrong way. The modifications made to the stack were extensive — so extensive that after the accident, when BP asked Transocean for the drawings, the drawings it received did not match the structure sitting on the sea floor. BP said it wasted many hours trying to work out what was actually down there.
The committee was also told of a leaking hydraulic system, and a dead battery in a control pod. And there is one more, which is not a fault at all but a design limit. A Transocean document, put up on the screen at the hearing, stated that most blind shear rams are designed to shear effectively only on the body of the drill pipe — and that procedures must therefore ensure there is no tool joint opposite the ram before shearing. A tool joint is the thicker, threaded coupling where two lengths of drill pipe screw together.
The blades are built to cut the thin part. Put the thick part in front of them and they will not cut it. So: miswired, undocumented, leaking, partly unpowered, and unable to cut a joint. That is the last line of defence as Congress found it.
Now the finding that reframes all of it. The Chemical Safety Board — the federal agency that investigates industrial accidents — spent years reconstructing what happened inside that stack. Its conclusion was that the blind shear ram, the emergency device with two cutting blades meant to sever the pipe and seal the well, likely did activate on the night of the accident. But the drill pipe had buckled, and was off-centre inside the blowout preventer.
It was trapped, and only partially cut. The Board attributes that buckling to a mechanism it calls effective compression. And here is the part that matters most: the Board states that effective compression had never previously been recognised as affecting drill pipe during well operations. It was not a known failure that was tolerated.
It was a piece of physics the industry had not accounted for — and the Board warns the same conditions could compromise blowout preventers at other drilling operations. So the device fired. It closed on a pipe that had already been bent out of its reach by the forces of the blowout it was being asked to stop. There is one more barrier that was never on the diagram, because it was supposed to be standing on shore.
Offshore drilling in United States waters was regulated by the Minerals Management Service, part of the Department of the Interior. It approved the plans. It issued the permits — including the approval for the long string of casing in chapter two. It inspected the rigs.
It also collected the money. The Minerals Management Service was one of the largest collectors of non-tax revenue for the United States Treasury,
taking in an average of more than thirteen billion dollars a year over the preceding five years, from the same industry it was policing. A witness put the problem to the committee in one sentence. The agency had suffered from a conflict in its mission — and oversight and promotion of production should never be combined in one agency. Both halves of that sentence are doing work.
It is not only that the agency wanted the revenue. It is that promoting production and restraining it were the same people's job, and when those two duties disagree, one of them has to lose. The committee heard how it had been losing. Members returned repeatedly to a provision called the categorical exclusion — a rule that lets a category of activity proceed without an individual environmental review, on the basis that the category as a whole has already been assessed.
Applied to a routine action, it saves pointless paperwork. Applied broadly to deepwater drilling permits, it means the specific well is never examined on its own terms. One member, a lawyer, put it simply: the statute requires agencies to look before they leap, and an agency cannot look before it leaps when it grants broad categorical exclusions. The committee was also told that Interior had been providing inconsistent and limited information about how it used them.
The word that recurs in the transcripts, from members of both parties, is cozy. The relationship between the regulator and the regulated. And then there is the number the regulator accepted on paper. BP's own exploration plan, filed with the Minerals Management Service, stated that the company could respond to a spill of two hundred and fifty thousand barrels a day.
That figure was approved. In May 2010, while the committee was sitting, BP was struggling with a blowout the committee then described as releasing five to twenty-five thousand barrels a day. A fraction of what the plan promised the company could handle. Hold on to that number — five to twenty-five thousand barrels a day, the figure the committee was working from in May.
It returns in chapter eight, and when it does, it turns out not to be an estimate at all. By July, a member summarised what would have to change, and the list reads as a description of what had been wrong. That offshore drilling could no longer be regulated on the honour system. That there must be rigorous federal oversight and effective enforcement.
That conflicts of interest must be eliminated. That royalty collection must be separated from regulation and enforcement. And that sham environmental reviews could not be tolerated any longer. Every item on that list is an admission about the system that certified this well.
On the seventeenth of June, 2010, fifty-nine days after the explosion, the chief executive of BP, Tony Hayward, appeared before the House Energy and Commerce subcommittee. The hearing ran for most of a day. He began with an apology. The explosion and fire aboard the Deepwater Horizon and the resulting oil spill, he said, never should have happened, and he was deeply sorry that it did.
When he learned that eleven men had lost their lives, he was personally devastated. Three weeks earlier he had attended a memorial service for those men, and it had been,
in his words, a shattering moment. Then the questions started, and the subcommittee had the documents. The centralizers. The bond log.
The lockdown sleeve. The circulation. Every one of those had come out of BP's own files. That exchange is worth stating plainly, because it defines the hearing.
Asked whether he disagreed with the conclusion that the chosen design was the riskier one, the chief executive said he was not prepared to draw conclusions about the accident until the investigation was concluded. The chairman replied that this was an investigation — that the committee he was sitting in front of was an investigatory committee — and asked whether he was failing to cooperate with other investigators as well, because they would have a hard time reaching conclusions if he stonewalled them, which was what the committee seemed to be getting that day. The same pattern held on specifics. Asked about the decision not to run the cement bond log — the test from chapter two — and pressed for a yes or a no, he answered that he could not answer the question in that form.
By that point in the day, members had stopped asking about cement. It is worth being fair about what this proves and what it does not. A chief executive declining to assign blame while investigations are open is not, by itself, evidence of anything. Lawyers advise exactly that.
The record does not show Tony Hayward making the decisions on that well; it shows him unable or unwilling to discuss them. What makes the day significant is narrower, and harder. Every document the chairman was holding up had come from BP. The company had already produced them.
The decisions had already been made, by people the company employed, and they were already written down. The subcommittee was not asking the chief executive to speculate about a mystery. It was asking him to read back his own company's paperwork. He would leave the company within months.
The well flowed for eighty-seven days. Nearly five million barrels of oil went into the Gulf of Mexico, and tens of thousands of fishermen were economically displaced. Then the law arrived, and it arrived in two very different sizes. On the twenty-ninth of January, 2013, in the United States District Court for the Eastern District of Louisiana, Judge Sarah Vance accepted BP's guilty plea.
The company pleaded guilty to every count of a fourteen-count information:
eleven counts of felony manslaughter, one count of felony obstruction of Congress, and violations of the Clean Water Act and the Migratory Bird Treaty Act. It was sentenced to pay four billion dollars in criminal fines and penalties. In pleading guilty, BP admitted what happened on the rig. Its two most senior supervisors on board — the well site leaders, known on the rig as the company men — observed clear indications that the well was not secure and that oil and gas were flowing into it, and chose not to take obvious and appropriate steps to prevent the blowout.
Through their conduct, BP admitted, control of the well was lost, and eleven men were negligently killed. That is the company's own admission, entered in open court. Now the eleventh count. The obstruction of Congress.
BP admitted that, through a senior executive, it obstructed an inquiry by the United States Congress into how much oil was escaping while the spill was still going on. The executive withheld documents. He provided false and misleading information in response to the House of Representatives' request for flow-rate information. He manipulated internal estimates to understate the amount of oil flowing from the well, and withheld data that contradicted BP's public figure of five thousand barrels a day.
At the same time, BP admitted, the company's own engineering teams were using sophisticated methods that generated significantly higher estimates. The government's Flow Rate Technical Group later concluded that more than sixty thousand barrels a day were leaking into the Gulf. Five thousand, said in public. More than sixty thousand, in fact.
And a felony conviction for the work done to keep the difference from Congress. Go back to chapter six for a moment. The committee sitting in May was working from a figure of five to twenty-five thousand barrels a day. This film is built out of those hearings — forty hours of them.
The record we have been reading from all along was itself a target. And the individuals? The two well site leaders were indicted, each charged with eleven counts of seaman's manslaughter and eleven counts of involuntary manslaughter. The Justice Department later dropped the involuntary manslaughter counts.
One of the two eventually pleaded guilty to a single Clean Water Act misdemeanour. The other went to trial on his remaining charge and was acquitted. No individual went to prison for the deaths of the eleven men. There is a structural reason underneath that, and the Commission put it on the record.
Liability for damages from an offshore facility was capped by the Oil Pollution Act at seventy-five million dollars, unless the responsible party could be shown to have been grossly negligent. Seventy-five million, against a company earning ninety-three million a day. BP placed twenty billion dollars in escrow to compensate individuals and businesses — but it did that as a company large enough to choose to. The Commission's point was that a smaller operator, drilling the same well, could not have.
The regulator was taken apart. The Minerals Management Service was reorganised into the Bureau of Ocean Energy Management, Regulation and Enforcement, and then split further, so that leasing, safety enforcement and revenue collection no longer sat in the same agency. A witness warned the committee that splitting the conflict also produced three smaller agencies inside the same bureaucracy — a caution, not a verdict. One number from those hearings stands for the condition the system was in.
The committee was told that the budget of the agency responsible for policing this industry had fallen by twenty per cent since
1984, while offshore oil and gas production had tripled. Return, finally, to where this began. A blowout preventer sat on the sea floor a mile down, and it did not seal the well. Congress found it miswired in one place, undocumented in another, leaking, partly unpowered, and built with blades that could not cut through a joint of pipe.
Every one of those findings is real. And the Chemical Safety Board found that it fired anyway — closing on a pipe that had buckled out of its reach through a mechanism nobody in the industry had known to look for. Above it, in order: a cement design its own contractor's model had warned about. Twenty-one centralizers recommended and six installed.
The test that would have found the bad seal, not run. The circulation that would have shown the gas, incomplete. The mechanical lock against pressure from below, absent. A negative pressure test that identified the cementing failure and was recorded as a pass.
An hour of unexplained readings that were not understood as a kick. By the time anyone reached for the last device, hydrocarbons were already past it. That is why the chief counsel of the President's National Commission could conclude that a flawless blowout preventer would have changed nothing, and it is why this film has spent most of its length somewhere other than the sea floor. Nothing here was uncovered by this film.
The centralizers, the bond log, the fourteen hundred pounds against zero, the wiring, the drawings that did not match — all of it was said out loud, in public, under oath, in Washington, within eight weeks of the night itself. The company later pleaded guilty to eleven counts of manslaughter, and to obstructing the very inquiry that produced this record. Everything you have seen was written down before the fire, or immediately after it. It was not hidden.
It only had to be read in order.
Wonder Minute