Abstract
On April 20, 2010, a multiple-fatality incident occurred at the Macondo oil well approximately 50 miles off the coast of Louisiana in the Gulf of Mexico during temporary well-abandonment activities on the Deepwater Horizon drilling platform. One of the root causes of the incident was the failure of the well's blow-out preventer (BOP) on the sea floor. Several components within this sophisticated device failed to isolate the well head, including the upper and lower annular sealing elements, and the blind shear ram valves. Despite its multiple safeguards and redundancy, the BOP was unable to prevent the flow of high pressure hydrocarbons from travelling back up through the riser pipe and onto the drilling rig. On the rig, the hydrocarbons found an ignition source and ignited. The resulting explosions and fire led to the deaths of 11 individuals, serious physical injuries to 17 others, the evacuation of 115 individuals from the rig, the sinking of the drilling platform, and massive marine and coastal damage from a reported 4 million barrels of released hydrocarbons. While the Macondo well explosion and fire is one of the most catastrophic accidents and environmental releases in US history, the failure of its remote-operated emergency isolation system is certainly not unique.
This paper reviews selected CSB, OHSA and MSHA investigations of severe chemical, petrochemical and metallurgical plant incidents with the objective of identifying examples where one or more emergency isolation valves, if installed and operated successfully, could have minimized the severity of the outcome, or perhaps averted the incident entirely. It examines the root cause of failures of critical isolation valves, actuators, and emergency shutdown systems, and identifies preventive maintenance and testing measures than can be taken to minimize the probability of failure-on-demand.