At 8:52 on the evening of Tuesday 20 April 2010, the senior BP man aboard the drilling rig Deepwater Horizon, floating in 4,992 feet of water about forty miles off the Louisiana coast, telephoned a BP drilling engineer in Houston to ask how the company wanted a cement plug tested. The man on the rig was Don Vidrine, the night well site leader. The engineer was Mark Hafle, who had the rig’s instrument readings on the screen in front of him. Before the call ended Vidrine mentioned the test the crew had finished an hour before. They had bled the pressure off the well and watched a pipe called the kill line for thirty minutes, he said, and not a drip had come out of it. But there was still pressure on the drill pipe. By the notes BP’s own investigators took of Hafle’s account in July, Hafle told him that “you can’t have pressure on the drill pipe and zero pressure on the kill line in a test that’s properly lined up,” and that Vidrine might consider whether he had pressure trapped in a line or a valve wrongly set. Vidrine told him that he was fully satisfied that the rig crew had performed a successful negative test. The call ended at 9:02.

By the model BP’s investigators built afterwards, the well began to flow at 8:52, the minute the call began. The pressure on the drill pipe that Vidrine mentioned was 1,400 pounds per square inch. It had stood there since about 6:35. The first explosion came at 9:49.

Who ran it

BP held the lease on Mississippi Canyon Block 252, and the well it was drilling there, which it had named Macondo, was an exploration well: its job was to find oil, not to produce it. BP’s partners were Anadarko and MOEX; the three had budgeted $96.2 million and fifty-one days. Another Transocean rig, the Marianas, had begun the well in October 2009 and been knocked out by Hurricane Ida in November. The Deepwater Horizon arrived on 31 January 2010 and drilled to 18,360 feet, into a reservoir of oil and gas at more than 200 degrees Fahrenheit, two and a half miles below a seabed that was itself nearly a mile down. By 20 April the well was almost six weeks behind and more than $58 million over. Some of the crew called it the well from hell. BP’s drilling engineer Brian Morel, who had designed it with Hafle and others, wrote to colleagues on 14 April that “this has been [a] nightmare well which has everyone all over the place.”

The rig belonged to Transocean, the largest offshore drilling contractor in the world. Built in 2001 for $350 million, it had worked for BP since its first voyage, at a rate said to reach $1 million a day, and was thought the best in the fleet. About 126 people were aboard: some eighty from Transocean, a few from BP, and contractors, among them Halliburton’s cementers, mud loggers from Sperry Sun, a Halliburton subsidiary, and mud engineers from M-I SWACO. In seven years of drilling the rig had not had a single lost-time injury.

BP’s authority on board was carried by two well site leaders, the “company men”, on twelve-hour shifts. The day man on 20 April was Robert Kaluza, four days into his first time on the rig, relieving Ronald Sepulvado, who had flown ashore on 16 April for a well-control course. The night man was Vidrine. Transocean’s senior man while the rig was latched to the well was Jimmy Harrell, the offshore installation manager; under him Randy Ezell, senior toolpusher, twenty-three years with the company; and two toolpushers who ran the drill floor by shifts, Wyman Wheeler by day and Jason Anderson by night. Anderson was from Bay City, Texas, had been on the rig since it left the yard, and was reckoned the man aboard who best understood the finer points of well control. He had been promoted to teach in Transocean’s well-control school and was due to fly out the next day. This was his last shift. The driller that night was Dewey Revette; the assistant drillers were Stephen Curtis and Donald Clark. A BP trainee, Lee Lambert, was learning the company man’s job. Ashore in Houston were Morel, Hafle, and the wells team leader, John Guide.

The regulator was the Minerals Management Service of the Department of the Interior. In April 2010 it did not require the test this entry is about, and it had no rule for how such a test should be done.

What they were trying to find out

Having found its oil, BP meant to leave. The plan was to plug the well, pull the blowout preventer and the riser off the wellhead, and come back some unfixed time later with a cheaper rig to prepare it for production. The industry calls this temporary abandonment. The last big job before it, the production casing, had been run on 19 April: a single string of steel pipe from the wellhead to 18,360 feet, with cement pumped by Halliburton overnight into the shoe track at its foot and the ring of space outside it, to seal the oil and gas behind the pipe. At 5:45 on the morning of 20 April the Halliburton engineer on the rig emailed Houston: “We have completed the job and it went well.”

The question of 20 April was whether that was true. If the cement had sealed the reservoir off, the well could be left for months with light seawater instead of heavy mud in its upper reaches and no rig above it. If it had not, the reservoir would find its way up the casing the moment the weight came off.

There were, properly speaking, two claims to test, and two tests for them. The first claim was that the casing, the seal at the wellhead and the blowout preventer could hold pressure from inside. The positive pressure test checked that: shut the well below the preventer, pump fluid in to 250 pounds per square inch and then to 2,500 or 2,700, depending on which report you read, and watch for a drop. The crew ran it between about half past ten and noon and it held. The second claim was that the cement at the bottom could hold the reservoir out once the inside of the well was lighter than the rock around it. Only the negative pressure test checked that, because it was the only test whose pressure reached the bottom of the hole. It worked in reverse: take the weight off the well, bleed whatever pressure remained down to zero, and then watch. If the pressure stayed at zero and nothing flowed, the cement was sound. If pressure built, or fluid came up, the reservoir was in the well.

There had been a third check. A three-man Schlumberger team was on board to run a cement bond log, an acoustic survey of the cement behind the casing. BP’s decision tree said the log would be run if the cement job had lost returns, meaning if fluid had leaked away into the rock while it was pumped; it had not, and at the 7:30 morning call the team was stood down and sent home on the 11:00 helicopter, saving $128,000 and the hours. Morel wrote at 8:52 that morning: “Just wanted to let everyone know the cement job went well.” Guide later put it this way: “Everyone involved with the job on the rig site was completely satisfied with the [cementing] job.”

So the negative pressure test was now carrying the whole weight of the cement. That cement, as every inquiry would list, had more against it than usual. The rock at the bottom had fractured and swallowed mud earlier in April, so the cement was pumped slowly and in a small volume. The long single string of casing was harder to cement than a shorter liner. Halliburton’s model had called for twenty-one centralisers to hold the pipe in the middle of the hole; BP ran six, and when an engineer, Brett Cocales, disagreed with Morel about it on 16 April he ended his email: “But, who cares, it’s done, end of story, [we] will probably be fine and we’ll get a good cement job.” The valves at the foot of the casing, designed to open at 750 pounds, had needed 3,142 before the crew decided they had opened. The cement was a nitrogen foam, and Halliburton’s own laboratory had found the foam unstable in tests in February and again in April; those results did not reach BP. Hafle himself had said, by the investigators’ notes, that the job was designed “on [the] ragged edge.”

What a pass looked like was understood. Bleed to zero; no build-up and no flow for a sustained period, which on this rig meant thirty minutes. As an expert for Transocean put it to the court four years later, “This isn’t baseball, the tie doesn’t go to the runner, the tie goes to the failed test.” What nobody had written down was how the test at Macondo was to be done, what pressures and volumes to expect while doing it, or what to do if it failed.

Morel’s plan of 12 April had no negative pressure test in it at all; Sepulvado told him to add one, and Harrell told Kaluza the same when Kaluza’s briefing left it out. The plan went through four versions in eight days, and the one the well site leaders worked from on 20 April was an “Ops Note” Morel emailed at 10:43, as he left on the helicopter. The fullest written procedure anyone had was a displacement sheet typed up that morning by the M-I SWACO mud engineer, Leo Lindner, after Kaluza and then Morel had each asked him how the rig usually did the test. Its instruction for the test itself was “[c]onduct negative test.” It ended: “[g]ood communication will be necessary to accomplish a successful displacement. If you are not sure, stop and ask.” The companion piece “Conduct negative test” follows the writing of the procedure day by day.

Asked afterwards what a successful test was, Guide said “[a] successful test needs to be run for 30 minutes with no flow from the well,” Morel said “[n]o flow for 30 minutes,” and Vidrine said “[c]heck[ing] for flow or no-flow.” None of them mentioned pressure. Kaluza told the investigators: “[w]e didn’t talk about what if the negative test fails.” Transocean’s well control handbook did not describe the test and the company did not train its crews in it; they learned it by doing it, and each rig did it its own way.

What they built

The rig floated on four columns above the well, with a riser, a wide steel pipe, running down nearly a mile to the blowout preventer, a stack of valves and rams on the seabed. Beside the riser ran three narrower lines, about three inches across, to the stack: the boost line, the choke line and the kill line. The last two were the lines the crew would use to control a kick, the industry’s word for an unwanted flow into the well. Below the stack hung the casing, to 18,360 feet, with the cement at its foot and the reservoir behind the cement. The whole system was full of synthetic oil-based mud weighing about fourteen pounds a gallon, and the weight of that column was what held the reservoir down: at the bottom of the well the mud pressed about 2,350 pounds per square inch harder than seawater would.

To imitate the abandoned well, the crew ran drill pipe into the casing to 8,367 feet below the sea, 3,300 feet below the mud line, and pumped down it first a buffer fluid, the spacer, and then seawater, so that the mud in the top 3,300 feet of the casing was pushed up into the riser above the stack. Then they closed the annular preventer, a thick rubber ring in the stack that squeezes shut around the drill pipe, which cut the well off from the weight of the mud and spacer still standing in the riser. What now bore on the cement was the lighter column in the drill pipe, 8,367 feet of seawater: less than the reservoir’s pressure, as the abandoned well’s would be. Open the top of the drill pipe on the rig, bleed off what pressure was left, shut it, and watch the gauge.

The spacer was the first of the night’s improvisations. Spacers are routine, a couple of hundred barrels of water-based fluid to keep the seawater from fouling the expensive mud. BP’s was 454 barrels of two leftover batches of lost-circulation material, a thick fluid made to clog fractures in rock, mixed earlier in the month in case the well lost returns again. It weighed sixteen pounds a gallon, heavier than the mud it was meant to lift and nearly twice the weight of the seawater behind it. The reason for using it was in BP’s emails: once pumped through the well it could be dumped overboard under an exemption for drilling fluids, instead of being shipped ashore as hazardous waste. No one on the rig or at BP had used such a thing as a spacer before, and M-I SWACO warned that it could set up in small restrictions. Behind it the crew pumped 352 barrels of seawater, a volume BP’s investigators later calculated would have put the tail of the spacer twelve feet above the preventer, if none of it had slid back down through the lighter water on the way up.

The instruments were a gauge for the pressure in the drill pipe and a gauge for the pressure in the kill line, both shown in the driller’s shack on Transocean’s displays and on Sperry Sun’s log, which was also transmitted to Houston, where BP engineers could call it up on their desks. There were the mud pits and the trip tank, whose levels said how much fluid had come back. There was the riser itself, which a man could look down with a torch. And there were the two straws in one glass: the drill pipe and the kill line both led down to the same well beneath the closed preventer, so whatever the gauges read, they had to agree with each other.

Nobody had worked out beforehand what they ought to read. The BOEMRE panel did the sum afterwards: with the spacer and seawater in place, the drill pipe gauge should have shown 1,610 pounds. When the preventer closed at 4:53 it showed 2,325.

Fourteen hundred

The crew’s safety meeting for the displacement was at about 3:00, led by Lindner because it was his fluids being moved. Kaluza attended and then went to his office to do the sums for the cement plug that would follow. Revette, the driller, pumped seawater into the boost, choke and kill lines; just before 4:00 the spacer went down the drill pipe, then the seawater, until about 4:53, when the annular preventer was closed around the pipe.

The reading of 2,325 pounds, about 700 more than it should have been, was the first sign that heavy spacer was still below the preventer. The crew bled the drill pipe down to 1,250 to match the kill line, then opened the kill line’s valve at the stack so that both were on the well together. Two straws in one glass: both should have stayed at 1,250. Instead the drill pipe pressure jumped and the kill line pressure fell.

Just before 5:00 the crew opened the drill pipe at the rig to bleed it to zero. They could not get it below 260 pounds. Three witnesses said twenty-three to twenty-five barrels came back; a well behaving as a closed vessel would have given up three to five. They shut the pipe. The pressure climbed to 1,262.

At about 5:10 someone noticed the level in the riser was falling. On the drill floor men stood round the rotary table shining a torch down the pipe to see how far it had dropped. The spacer was leaking down past the preventer into the well. By now the drill shack was filling: the night crew arriving for the 6:00 change, and a party of four visiting executives, two from BP and two from Transocean, who had landed by helicopter that afternoon for a twenty-four-hour tour and were being shown round by Harrell and Ezell. Daun Winslow, Transocean’s operations manager, testified in August: “There was quite a few people in there. I tapped Dewey Revette on the shoulder. He was the driller master. I said, ‘Hey, how’s it going, Dewey? You got everything under control here?’ And he said, ‘Yes, sir.’ And there seemed to be a discussion going on about some pressure or a negative test. And I said to Jimmy [Harrell] and Randy Ezell, ‘Looks like they’re having a discussion here. Maybe you could give them some assistance.’ And they happily agreed to that.” The tour went on without them. Harrell had the preventer’s closing pressure raised; the leak stopped; Wheeler topped the riser up with twenty to twenty-five barrels of mud and the level held. Nobody pumped the spacer that had leaked down back above the stack.

At 5:26 they bled the drill pipe again. This time it went to zero. Fifteen barrels came back, three times what the sum would have predicted. They shut it in. The pressure built to 773 and was still rising when they opened it once more.

Shortly before 6:00 Kaluza, back on the floor, said, by one account, “Let’s open the kill line and see what happens.” They bled the well down through the kill line instead; the drill pipe gauge fell nearly to zero, and the kill line went on spurting water until the valve on the rig was closed. Witnesses put the volume at anything from three barrels to fifteen. Kaluza left to find Vidrine, whose shift was beginning. Over the next thirty or forty minutes, with everything shut, the drill pipe gauge rose from near zero to 1,400 pounds per square inch, and stayed there.

Every investigation agreed afterwards on what that number was. It was, near enough, the pressure the reservoir would show at the rig through 8,367 feet of seawater if there were no cement at the bottom of the well at all. One expert called it a “conclusive failure.” It was the third time in an hour that the well had been bled down and had climbed back.

At about this time, in the shack, Anderson turned to Ezell and said, “Why don’t you go eat?” Ezell had a meeting with the visitors at 7:00 and said he could eat and come back. Anderson told him, by Ezell’s testimony: “Man, you ain’t got to do that. I’ve got this. Don’t worry about it. If I have any problems at all with this test I’ll give you a call.” Ezell had worked with him eight or nine years. “He was just like a brother,” he said. “So I had no doubt that if he had any indication of any problem or difficulty at all he would have called me.” He went to eat, and then to the meeting, and did not come back.

Wheeler, going off shift, was by the account of a subsea supervisor, Christopher Pleasant, “convinced that something wasn’t right,” and did not believe the explanations he was hearing. But his twelve hours were up.

The explanation that carried the room came from Anderson. Kaluza and Vidrine, Anderson, Revette, Curtis and Lambert were in the shack when it was given, and the only surviving accounts of it are the notes BP’s investigators took from Kaluza and Vidrine, who afterwards declined to testify to anyone, and Lambert’s evidence to the joint investigation in July. The 1,400 pounds, Anderson said, was a “bladder effect”, or “annular compressibility”: the weight of mud and spacer in the riser was pressing down on the rubber of the closed preventer, and the preventer was passing that pressure into the well below it, where the drill pipe gauge picked it up. Lambert’s version was that “heavier mud in the riser would push against the annular and transmit pressure into the wellbore, which in turn you would expect to see up the drill pipe.” Anderson told the two company men, by their accounts, “Bob and Don, this happens all the time.” Revette said he had seen it before. Lambert asked about it and accepted it; after the blowout he agreed it did not make sense. Nobody in the room, so far as any record shows, seriously challenged it, and no engineer, before or since, has found that any such effect exists. Even had it existed, a pressure passed through a rubber ring would have gone when the pipe was bled, and come back only if something kept pushing.

Vidrine kept talking about the 1,400. He later told BP’s investigators that he went on about it so long that the crew found it “humorous.” Then he insisted on running the test again, this time on the kill line rather than the drill pipe, because the permit to the MMS had said the kill line. From about 6:40 the crew topped the kill line up, led it to a small tank by the shack, and bled it to zero. Less than a barrel came out. From about 7:15 they watched it for thirty minutes. Nothing flowed and no pressure built. On the other gauge, throughout, the drill pipe read 1,400.

Kaluza told the investigators afterwards that if Anderson had seen the thing so many times, it must be real. At about 7:55 Vidrine declared the test a success. Nobody disagreed. Nobody called Houston, where Guide later said that given the readings he would have expected a call. Nobody fetched Ezell, who had been sent to dinner, or asked the two BP executives on board, who between them had more than fifty years of drilling. Kaluza went off shift.

Why the kill line read zero while the drill pipe read 1,400 is not known. The likeliest answer is that it was blocked, by the spacer that had leaked down and been left there, by mud never displaced from it, by a hydrate of gas frozen in the cold water of the seabed, or by a valve left shut. A blocked line reads zero whatever the well is doing. The test had been moved from the gauge that was telling the truth to the one that could not.

The Commission’s Chief Counsel put the night’s result in one sentence: the test “failed” in the sense that it did not show the well had integrity. “It was successful, however, in that it repeatedly and accurately identified a serious problem.”

What it looked like from inside

At 7:00 the visitors sat down with the rig’s leaders in the third-floor conference room. BP’s vice-president for drilling, Pat O’Bryan, had come partly to learn what made this the “best performing rig that we had in our fleet and in the Gulf of Mexico.” They talked about a maintenance backlog and about dropped objects, which on a rig with cranes and many decks are what hurt people. Ezell came out of the meeting pleased at the praise.

At 8:02 the crew opened the preventer and began pumping seawater down the drill pipe to push the mud and spacer out of the riser, the step that would leave the cement as the only thing between the reservoir and the rig. Halliburton’s cementer came to the shack to ask about the plug job; Revette and Anderson told him the negative test had passed. Vidrine watched the start and went to his office to do paperwork. The returns were routed from pit to pit as the mud came up; the sand traps were emptied into the active pits, the trip tank was emptied and refilled, the cranes were working on deck, and the mud logger was not told of the changes. At 8:52 Vidrine rang Hafle.

At 9:01 the drill pipe pressure, which had been falling steadily as light water replaced heavy mud, turned and began to rise. Over seven minutes it rose about 100 pounds at a constant pump rate. At 9:08 the spacer reached the surface and the pumps were stopped for a sheen test, to confirm that no oil-based mud remained before the spacer went overboard. The mud logger, Joseph Keith, who had taken a ten-minute break just before 9:00, looked at the camera on the flow line and saw no flow. With the pumps off the drill pipe pressure rose about 250 pounds in six minutes. Nobody remarked on it. The sheen test passed, Vidrine signed for it, the returns were lined up to go over the side, past the pits, the flow meter and the gas sensors, and at 9:14 the pumps went back on. At 9:17 a relief valve on one pump lifted, and Revette sent a party to the pump room to fix it.

At about 9:20 Ezell, back in his cabin, telephoned the floor. “How did your negative test go?” Anderson: “It went good. . . . We bled it off. We watched it for 30 minutes and we had no flow.” “What about your displacement? How’s it going?” “It’s going fine. . . . It won’t be much longer and we ought to have our spacer back.” “Do you need any help from me?” “No, man. . . . I’ve got this. . . . Go to bed. I’ve got it.” Ezell called his wife and turned on the television.

At 9:27 the kill line gauge, readable again now its valve was open, showed about 800 pounds against about 2,500 on the drill pipe. Revette and Anderson saw it. At 9:30 they stopped the pumps to look. The chief mate, David Young, came to the shack to ask about the plug job and found the two of them watching the screens and talking about “a differential pressure.” “It was quiet,” he testified. “There was no panic or anything like that.” Anderson told him the cement job would be delayed and he probably would not be needed for a couple of hours. With the pumps off the drill pipe pressure climbed 550 pounds in five and a half minutes. At 9:36 Revette had a floorhand, Caleb Holloway, open a valve to bleed it down. It came down and immediately climbed again, and was taking longer than it should. “Okay, close it back,” Revette said. At 9:38 it jumped about 600 pounds. By BP’s model that was the minute gas passed the preventer into the riser, nearly a mile of pipe in which it would expand a hundredfold on the way up. Nobody looked over the side to see whether the well was flowing, and nobody shut it in. Anderson went to the pump room. At 9:39 the pressure turned down.

Between 9:40 and 9:43 mud came out of the rotary table onto the floor and then shot to the top of the derrick and rained on the deck and on the supply ship Damon Bankston alongside, whose captain saw it “kind of like a black rain.” Now they acted. The flow was diverted to the mud-gas separator rather than overboard; at 9:41 Anderson, back in the shack, closed an annular preventer; Anderson rang Vidrine to say they were getting mud back; Curtis rang Ezell: “We have a situation. …The well is blown out. . . . We have mud going to the crown.” “Do y’all have it shut in?” “Jason is shutting it in now. . . Randy, we need your help.” The bridge told the Bankston to stand off 500 metres. The separator was overwhelmed; gas hissed from its vents across the deck; at 9:47 the gas alarms began and the engines, breathing gas, ran away. At 9:49 the power failed and the data stopped. About five seconds later the first explosion came, and ten seconds after that the second.

What happened

Anderson, Revette and Curtis were in the drill shack. Clark and three others were in the pump room, where they had just finished the valve. The chief engineer, Steve Bertone, who had been reading in bed, reached the bridge to find no engines, no thrusters and no power, and looked out of the starboard window: “I saw fire from derrick leg to derrick leg and as high as I could see. At that point, I realized that we had just had a blowout.” The dynamic positioning officer, Andrea Fleytas, sounded the general alarm and, at 9:52, the Mayday. A subsea supervisor pushed the emergency disconnect, which should have sheared the drill pipe, sealed the well and freed the rig from it; the lights on the panel changed and nothing happened, and the system that should have done it by itself once the rig’s connections were cut did not work either. Ezell dug Wheeler out of the wreckage of the toolpushers’ office and would not leave him; the two lifeboats went without them, and they went down on a raft with Bertone and the captain’s party into water that was burning. The Bankston’s crew hauled men out of the sea. By 11:30 the count was taken: 115 alive, sixteen of them injured enough to be flown to hospital, and eleven missing. They were Jason Anderson, Dale Burkeen, Donald Clark, Stephen Curtis, Roy Wyatt Kemp, Karl Kleppinger, Dewey Revette, Shane Roshto and Adam Weise of Transocean, and Gordon Jones and Blair Manuel, the two M-I SWACO mud engineers. None was found.

The survivors sat on the Bankston through the night and watched the rig burn, which Ezell called “one of the most painful things we could have ever done.” “Those guys that were on there were our family.” The rig burned for a day and a half, with the well feeding the fire through the riser, and sank at 10:26 on the morning of 22 April. Oil came up from the open well for eighty-seven days, until a capping stack was shut on it at about 2:25 on the afternoon of 15 July. A relief well reached it in September, and on the 19th, 152 days after the blowout, the national incident commander, Admiral Thad Allen, announced that “the Macondo 252 well is effectively dead.” The government’s estimate of the oil released was about 4.9 million barrels. The court that eventually fixed the penalty found in 2015 that about 4.0 million barrels had left the reservoir and 3.19 million had gone into the Gulf, after what was caught at the wellhead was taken off.

After

BP’s own investigation reported on 8 September 2010. Its third key finding was that the negative pressure test “was accepted although well integrity had not been established,” and on the bladder effect it said: “The investigation team could find no evidence that this pressure effect exists.” The report also said the team had found no evidence that anyone on the rig had consulted anyone outside their team about the pressure, and it did not mention the 8:52 call. When the matter came to trial, the judge found that sentence “patently false,” and inferred that BP’s investigators had left the call out “to avoid casting further blame on BP.”

Kaluza did not let the bladder effect go. On 25 April he emailed BP management that “pressure can and will build below the annular bladder due to the differential pressure but can not flow – the bladder prevents flow, but we see differential pressure on the other side of the bladder,” and a week after the blowout he was still calling the test results “rock solid.”

The President’s commission reported in January 2011 and its Chief Counsel in February; the joint investigation of the Coast Guard and the MMS’s successor reported in April and September 2011, and found that Hafle had been logged into the live well data that afternoon until 5:27, had not looked at it when Vidrine called, and had stayed in the office until about 10:00. The commission’s judgement on the test was that the men “started from the assumption that the well could not be flowing, and kept running tests and coming up with various explanations until they had convinced themselves their assumption was correct.”

In November 2012 BP agreed to plead guilty to eleven counts of seaman’s manslaughter and three other offences and to pay $4 billion, admitting that the test “provided multiple indications that the wellbore was not secure” and that its well site leaders “negligently supervised the negative pressure test during this time, failed to alert engineers on the shore of these indications, and along with others, ultimately deemed the negative pressure test a success.” Transocean pleaded guilty in January 2013 and paid $1.4 billion. In the civil trial, Judge Carl Barbier found on 4 September 2014 that “the one thing the 1,400 psi reading absolutely precluded was a determination that the negative pressure test was successful or that the well was secure,” that its misinterpretation was “a substantial cause of the blowout, explosion, fire, and oil spill,” and that BP had been grossly negligent; the fault was BP’s by sixty-seven parts in a hundred, Transocean’s by thirty and Halliburton’s by three. Of the drill crew he found that they “were attentive to the well during the negative pressure test and took the procedure seriously.” In 2015 BP settled the civil claims for $20.8 billion. Kaluza and Vidrine were charged with manslaughter in 2012; the charges were dropped, Vidrine pleaded guilty to a misdemeanour and was given ten months’ probation, and a jury acquitted Kaluza in February 2016. Nobody went to prison for the eleven. The companion piece “The reckoning” follows the inquiries and the courts.

What it taught

The test worked. That is the first thing to hold on to, and the hardest. Three times between 5:00 and 6:35 the crew bled the well down and three times it climbed back, to 1,262, to 773 and rising, to 1,400; it gave up more fluid than a sealed well could; and the last reading was the number the reservoir would make with no cement at all. The instrument said the same thing for three hours. What was missing was not the signal.

A test with no written failure is not a test. BP’s engineers left the test out of the plan, put it in, took the plan through four versions in eight days and sent the test to the rig as two words on a mud engineer’s sheet. Nobody wrote what the gauge should read when the preventer closed, how many barrels should come back when the pipe was bled, what counted as a fail, or who had to stop the job when it appeared. Kaluza’s “we didn’t talk about what if the negative test fails” is the whole design flaw in one clause. A test whose only defined outcome is the pass will be passed. The submersible Titan’s hull, in Dive Eighty-Eight, spoke on dive 80 to sensors that had no threshold and no hand on the switch; the Macondo well spoke to a gauge with the same want.

The explanation arrived before the evidence, and it could not be checked. The bladder effect was not a measurement, a calculation or a thing in a book. It was a name, offered by the most experienced man in the room on his last shift, and its warrant was that he had seen it before. Experience is a record of the times the thing went well; the pressure that “happens all the time” had been, on those other nights, a well that did not blow out, which proves nothing about this one. The test’s whole purpose was to overrule experience with a number. Once a name was found for the number, the number had nothing left to say.

A second gauge that agrees with you is not a tie-break. Two straws in one glass must read the same. When they did not, the right question was which was wrong, and a line that reads zero is the one more easily blocked. Instead the test was moved to the gauge that gave the better answer, and the thirty quiet minutes on the kill line were taken as the verdict while the drill pipe read 1,400 the whole time. “The tie goes to the failed test.” When one instrument says safe and another says not, the one that says not is the one to believe until it is explained by something you can measure.

Nobody called. The data were on a screen in Houston. The senior toolpusher was at dinner, having been told he would be called. Two executives with fifty years of drilling were on the rig. Guide expected a call and none came. And when a call did come, at 8:52, the engineer on the other end gave the right answer and let the man on the rig overrule it with “fully satisfied.” There were thirty-six minutes after that call in which two actions would have ended the story. The rule that was missing was not technical: it was that a confusing result goes to someone who did not produce it, and that the person who hears it has to act, not advise.

The barrier you have just tested is the one you stop watching. After 7:55 the crew behaved like men who had been told the well was safe, because they had told themselves so. They shifted mud between pits, emptied tanks into the flow line, sent the returns overboard past the flow meter and the gas sensors, and ran the cranes, each of which muddied the one thing left to watch. The investigators of two blowouts in 2009 had used the word “blinkered” for crews reassured by a negative test. The signs of the kick that night, a drill pipe pressure that rose with the pumps off and a kill line that disagreed with it, were the signs of the test, and the two men watching them at 9:30, calm and quiet, were looking at the same thing for the second time.

Check the story before you learn from it. The test began at 5:00 in one report and 4:55 in another; the first bleed stopped at 260 pounds or 266; the positive test went to 2,500 or 2,700; the rig sank at 10:22 or 10:26; the oil was 4.9 million barrels or 3.19. The conversation that turned the night is known only from the notes of two men who never testified and the memory of a trainee, and the men who gave the explanation did not survive to say whether they had given it. What the record carries without argument is the gauge: bled to zero, and back to 1,400, and left there.

Sources

• National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling, Deep Water: The Gulf Oil Disaster and the Future of Offshore Drilling, Report to the President, January 2011, chapters 1 and 4: the day of 20 April, the morning emails, the cement decisions, the test, the kick, the explosion and the evacuation, and the testimony of Winslow, Ezell, Pleasant, Bertone, Sandell, Landry and Young, which is quoted at second hand from it. A US government work. govinfo.gov
• National Commission, Macondo: The Gulf Oil Disaster, Chief Counsel’s Report, February 2011, chapters 4.6 (Negative Pressure Test) and 4.7 (Kick Detection): the readings and times from 3:00 to 9:49, the spacer, the bladder effect as given by Lambert’s testimony of 20 July 2010 and BP’s interview notes of Kaluza and Vidrine, the “conclusive failure”, the lack of procedures and training, and Hafle’s and Kaluza’s statements. A US government work. govinfo.gov
• Bureau of Ocean Energy Management, Regulation and Enforcement, Report Regarding the Causes of the April 20, 2010 Macondo Well Blowout, 14 September 2011, sections VII and VIII: the Morel and Guide emails of 18 April, Harrell’s and Lindner’s testimony, Lindner’s procedure, the expected drill pipe pressure of 1,610 pounds, Kaluza’s email of 25 April, Hafle’s access log, and the panel’s recommendation on negative tests. bsee.gov
• United States Coast Guard, Report of Investigation into the Circumstances Surrounding the Explosion, Fire, Sinking and Loss of Eleven Crew Members Aboard the Mobile Offshore Drilling Unit Deepwater Horizon, volume I, April 2011: the evacuation, the 115 survivors and sixteen injured, the dead and their employers, and the sinking at 10:26 on 22 April. dco.uscg.mil, archived copy
• BP, Deepwater Horizon Accident Investigation Report, 8 September 2010 (the Bly report), section 3 (chronology) and key finding 3: the times of 20:52, 21:31 to 21:49, the 3.5 barrels expected against fifteen bled, the 0.2 barrels from the kill line, and “could find no evidence that this pressure effect exists.” BP’s copyright; quoted briefly. bp.com, archived copy
• United States District Court for the Eastern District of Louisiana, In re Oil Spill by the Oil Rig “Deepwater Horizon”, MDL 2179, Findings of Fact and Conclusions of Law, Phase One trial, 4 September 2014 (revised 9 September), paragraphs 236 to 282: the test as the court found it, the 8:52 call from BP’s interview notes of Hafle, the plea agreements of BP and Transocean, “patently false”, Barnhill’s and Heenan’s evidence, the drill crew’s attentiveness, and the shares of fault. uscourts.gov
• The same court, Findings of Fact and Conclusions of Law, Penalty Phase, 30 November 2015: the 3.19 million barrels found in the Phase Two findings of 15 January 2015, BP’s criminal payments under the November 2012 plea, and Transocean’s $1 billion civil penalty. laed.uscourts.gov
• United States Department of Justice, press releases of 15 November 2012 (BP’s agreement to plead guilty and the $4 billion), 3 January 2013 (Transocean’s plea and the $1.4 billion) and 5 October 2015 (the $20.8 billion civil settlement and the $5.5 billion penalty); and the Environmental Crimes Section’s monthly bulletins for January, March and May 2016 (Vidrine’s plea of 2 December 2015, Kaluza’s acquittal of 27 February 2016, Vidrine’s sentence of 6 April 2016). justice.gov, 2012 (archived), justice.gov, 2013 (archived), justice.gov, 2015 (archived), bulletin, May 2016
• United States Coast Guard photograph of the burning rig, 21 April 2010, as published by the United States Geological Survey, public domain. usgs.gov